From 37496b974eec17d223913705195a9667a638f0da Mon Sep 17 00:00:00 2001
From: kurogeek <kurogeek@lmvhaus.com>
Date: Mon, 26 Oct 2026 09:27:42 +0000
Subject: [PATCH] modules/prometheus: run alertmanager as a static user

nixpkgs' alertmanager uses DynamicUser, so the `alertmanager` user only
exists while the service is running. The matrix-alertmanager-urlfile
secret is owned by that user; at boot sops-install-secrets cannot resolve
it and rejects the whole manifest, leaving /run/secrets empty (no ssh
host key, yggdrasil key, tor key, ...). Deploys masked it because the
dynamic user was resolvable via nss-systemd at switch time.

Create a static alertmanager user/group and disable DynamicUser.
---
 modules/clan/prometheus/default.nix | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/modules/clan/prometheus/default.nix b/modules/clan/prometheus/default.nix
index 23d93b3a..7c852674 100644
--- a/modules/clan/prometheus/default.nix
+++ b/modules/clan/prometheus/default.nix
@@ -256,6 +256,21 @@
                 ];
               };
 
+              # nixpkgs runs alertmanager with DynamicUser; that user only exists
+              # while the service runs, so sops-install-secrets cannot resolve the
+              # owner of matrix-alertmanager-urlfile at boot and rejects the whole
+              # manifest (no secrets installed). Use a static user instead.
+              users.users.alertmanager = {
+                isSystemUser = true;
+                group = "alertmanager";
+              };
+              users.groups.alertmanager = { };
+              systemd.services.alertmanager.serviceConfig = {
+                DynamicUser = lib.mkForce false;
+                User = "alertmanager";
+                Group = "alertmanager";
+              };
+
               services.matrix-alertmanager = lib.mkIf settings.matrix-alertmanager.enable {
                 enable = true;
                 tokenFile = config.clan.core.vars.generators.prometheus.files.matrix-alertmanager-token.path;