add secrets-subscriber service, make hostapd use it

modules/secrets/default.nix

@@ -14,6 +14,10 @@ in {
       description = "fetch secrets from external vault with https";
       type = liminix.lib.types.serviceDefn;
     };
+    subscriber = mkOption {
+      description = "wrapper around a service that needs notifying (e.g. restarting) when secrets change";
+      type = liminix.lib.types.serviceDefn;
+    };
 
   };
   config.system.service.secrets = {
@@ -32,5 +36,31 @@ in {
         description = "how often to check the source, in minutes";
       };
     };
+    subscriber = config.system.callService ./subscriber.nix {
+      watch = {
+        service = mkOption {
+          description = "secrets service to subscribe to";
+          type = liminix.lib.types.service;
+        };
+        paths = mkOption {
+          description = "list of output paths we are interested in";
+          example = ["wan/l2tp" "wifi/wlan5"];
+          type = types.listOf types.str;
+        };
+      };
+      service = mkOption {
+        description = "subscribing service that will receive notification";
+        type = liminix.lib.types.service;
+      };
+      action = mkOption {
+        description = "how do we notify the service to regenerate its config";
+        default = "restart-all";
+        type = types.enum [
+          "restart" "restart-all"
+          "hup" "int" "quit" "kill" "term"
+          "winch" "usr1" "usr2"
+        ];
+      };
+    };
   };
 }