fix mergify (#60)

The systemd service unit file generate environment file requests secrets
from the systemd-vaultd socket.

We make sure this socket is ready before starting the service.

.mergify.yml

@@ -1,18 +1,11 @@
 queue_rules:
   - name: default
     merge_conditions:
-      - check-success=Evaluate flake.nix
+      - check-success=buildbot/nix-eval
-      - check-success=check systemd-vaultd [x86_64-linux]
-      - check-success=check treefmt [x86_64-linux]
-      - check-success=check unittests [x86_64-linux]
-      - check-success=check vault-agent [x86_64-linux]
-      - check-success=devShell default [x86_64-linux]
-      - check-success=package default [x86_64-linux]
 defaults:
   actions:
     queue:
-      allow_merging_configuration_change: true
+      merge_method: rebase
-      method: rebase
 pull_request_rules:
   - name: merge using the merge queue
     conditions:

default.nix

@@ -2,7 +2,7 @@
 pkgs.buildGoModule {
   name = "systemd-vaultd";
   src = ./.;
-  vendorSha256 = null;
+  vendorHash = null;
   meta = with pkgs.lib; {
     description = "A proxy for secrets between systemd services and vault";
     homepage = "https://github.com/numtide/systemd-vaultd";

flake.lock

@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1693611461,
+        "lastModified": 1698579227,
-        "narHash": "sha256-aPODl8vAgGQ0ZYFIRisxYG5MOGSkIczvu2Cd8Gb9+1Y=",
+        "narHash": "sha256-KVWjFZky+gRuWennKsbo6cWyo7c/z/VgCte5pR9pEKg=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "7f53fdb7bdc5bb237da7fefef12d099e4fd611ca",
+        "rev": "f76e870d64779109e41370848074ac4eaa1606ec",
         "type": "github"
       },
       "original": {
@@ -22,11 +22,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1694928810,
+        "lastModified": 1698443389,
-        "narHash": "sha256-M/3+pRQmM+FeBeSKRp0b01pncbNiiC2ggJE4Wpi7c1Q=",
+        "narHash": "sha256-/IhqtAuFPL1gew2h1+b+xQipv2WVt9EuszSHz5a4PNI=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "948e8754755a9f27587d5bd109af2cfad313add8",
+        "rev": "a9d001fd4af2df7f5702bbdb28a0081c855cb625",
         "type": "github"
       },
       "original": {
@@ -50,11 +50,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1694528738,
+        "lastModified": 1698438538,
-        "narHash": "sha256-aWMEjib5oTqEzF9f3WXffC1cwICo6v/4dYKjwNktV8k=",
+        "narHash": "sha256-AWxaKTDL3MtxaVTVU5lYBvSnlspOS0Fjt8GxBgnU0Do=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "7a49c388d7a6b63bb551b1ddedfa4efab8f400d8",
+        "rev": "5deb8dc125a9f83b65ca86cf0c8167c46593e0b1",
         "type": "github"
       },
       "original": {

nix/modules/vault-secrets.nix

@@ -175,6 +175,8 @@ in
               Before=${service}.service
               BindsTo=${service}.service
               StopPropagatedFrom=${service}.service
+              After=systemd-vaultd.socket
+              Requires=systemd-vaultd.socket
 
               [Service]
               Type=oneshot