kurogeek
37496b974e
nixpkgs' alertmanager uses DynamicUser, so the `alertmanager` user only exists while the service is running. The matrix-alertmanager-urlfile secret is owned by that user; at boot sops-install-secrets cannot resolve it and rejects the whole manifest, leaving /run/secrets empty (no ssh host key, yggdrasil key, tor key, ...). Deploys masked it because the dynamic user was resolvable via nss-systemd at switch time. Create a static alertmanager user/group and disable DynamicUser.
infra
Infrastructure for NewEdge