treewide: add missing systemd ordering directives

In particular, we were missing `sops-install-secrets.service` in a ton
of places, and `network-online.target` for some homebrewn services.

This has caused failure of some services on machine startup.

hosts/bicep/services/matrix/coturn.nix

@@ -55,6 +55,11 @@
   # It needs this to be allowed to access the files with the acme group
   systemd.services.coturn.serviceConfig.PrivateUsers = lib.mkForce false;
 
+  systemd.services.coturn = {
+    requires = [ "sops-install-secrets.service" ];
+    after = [ "sops-install-secrets.service" ];
+  };
+
   systemd.services."acme-${config.services.coturn.realm}".serviceConfig = {
     AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
   };

hosts/bicep/services/matrix/discord.nix

@@ -39,6 +39,8 @@ in
   };
 
   systemd.services.mx-puppet-discord = {
+    after = [ "sops-install-secrets.service" ];
+    requires = [ "sops-install-secrets.service" ];
     serviceConfig.SupplementaryGroups = [
       config.users.groups.keys-matrix-registrations.name
     ];

hosts/bicep/services/matrix/hookshot/default.nix

@@ -183,6 +183,7 @@ in
   };
 
   services.matrix-hookshot.serviceDependencies = [
+    "sops-install-secrets.service"
     "matrix-synapse.target"
     "nginx.service"
   ];

hosts/bicep/services/matrix/livekit.nix

@@ -43,7 +43,12 @@ in
     keyFile = config.sops.templates."matrix-livekit-keyfile".path;
   };
 
-  systemd.services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = lib.mkIf cfg.enable (builtins.concatStringsSep "," [ "pvv.ntnu.no" "dodsorf.as" ]);
+  systemd.services.lk-jwt-service = lib.mkIf cfg.enable {
+    after = [ "sops-install-secrets.service" ];
+    requires = [ "sops-install-secrets.service" ];
+
+    environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = builtins.concatStringsSep "," [ "pvv.ntnu.no" "dodsorf.as" ];
+  };
 
   services.nginx.virtualHosts.${matrixDomain} = lib.mkIf cfg.enable {
     locations."^~ /livekit/jwt/" = {

hosts/bicep/services/matrix/mjolnir.nix

@@ -55,52 +55,57 @@
     pantalaimon.username = "bot_admin";
   };
 
-  systemd.services.mjolnir.serviceConfig = {
-    DynamicUser = true;
-    RuntimeDirectory = [ "mjolnir/root-mnt" ];
-    RootDirectory = "/run/mjolnir/root-mnt";
-    BindReadOnlyPaths = [
-      config.sops.secrets."matrix/mjolnir/access_token".path
-      builtins.storeDir
-      "/etc"
-      "/run/nscd"
-      "/var/run/nscd"
-    ];
+  systemd.services.mjolnir = {
+    requires = [ "sops-install-secrets.service" ];
+    after = [ "sops-install-secrets.service" ];
 
-    AmbientCapabilities = "";
-    CapabilityBoundingSet = "";
-    LockPersonality = true;
-    MemoryDenyWriteExecute = false; # node needs this
-    NoNewPrivileges = true;
-    PrivateDevices = true;
-    PrivateMounts = true;
-    PrivateTmp = true;
-    PrivateUsers = true;
-    ProcSubset = "pid";
-    ProtectClock = true;
-    ProtectControlGroups = true;
-    ProtectHome = true;
-    ProtectHostname = true;
-    ProtectKernelLogs = true;
-    ProtectKernelModules = true;
-    ProtectKernelTunables = true;
-    ProtectProc = "invisible";
-    ProtectSystem = "strict";
-    RemoveIPC = true;
-    RestrictAddressFamilies = [
-      "AF_INET"
-      "AF_INET6"
-      "AF_UNIX"
-    ];
-    RestrictNamespaces = true;
-    RestrictRealtime = true;
-    RestrictSUIDSGID = true;
-    SystemCallArchitectures = "native";
-    SystemCallFilter = [
-      "@system-service"
-      "~@privileged"
-      "~@resources"
-    ];
-    UMask = "0077";
+    serviceConfig = {
+      DynamicUser = true;
+      RuntimeDirectory = [ "mjolnir/root-mnt" ];
+      RootDirectory = "/run/mjolnir/root-mnt";
+      BindReadOnlyPaths = [
+        config.sops.secrets."matrix/mjolnir/access_token".path
+        builtins.storeDir
+        "/etc"
+        "/run/nscd"
+        "/var/run/nscd"
+      ];
+
+      AmbientCapabilities = "";
+      CapabilityBoundingSet = "";
+      LockPersonality = true;
+      MemoryDenyWriteExecute = false; # node needs this
+      NoNewPrivileges = true;
+      PrivateDevices = true;
+      PrivateMounts = true;
+      PrivateTmp = true;
+      PrivateUsers = true;
+      ProcSubset = "pid";
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "invisible";
+      ProtectSystem = "strict";
+      RemoveIPC = true;
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_INET6"
+        "AF_UNIX"
+      ];
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "@system-service"
+        "~@privileged"
+        "~@resources"
+      ];
+      UMask = "0077";
+    };
   };
 }

hosts/bicep/services/matrix/out-of-your-element.nix

@@ -56,7 +56,15 @@ in
     enableSynapseIntegration = false;
   };
 
+  systemd.services."matrix-ooye-pre-start" = {
+    after = [ "sops-install-secrets.service" ];
+    requires = [ "sops-install-secrets.service" ];
+  };
+
   systemd.services."matrix-ooye" = {
+    after = [ "sops-install-secrets.service" ];
+    requires = [ "sops-install-secrets.service" ];
+
     serviceConfig = {
       RuntimeDirectory = [ "matrix-ooye/root-mnt" ];
       RootDirectory = "/run/matrix-ooye/root-mnt";

hosts/bicep/services/matrix/synapse.nix

@@ -44,6 +44,11 @@ in {
     };
   };
 
+  systemd.targets."matrix-synapse" = {
+    after = [ "sops-install-secrets.service" ];
+    requires = [ "sops-install-secrets.service" ];
+  };
+
   services.matrix-synapse-next = {
     enable = true;
 
@@ -74,7 +79,7 @@ in {
         name = "psycopg2";
         args = {
           host = "/var/run/postgresql";
-          database = "synapse";
+          dbname = "synapse";
           user = "matrix-synapse";
           cp_min = 1;
           cp_max = 5;