orion: generate SearXNG secret in activationScripts

searx-init loads EnvironmentFile at spawn, so the secret must exist
before systemd starts that unit. Drop the racing oneshot. Make
tailscale-serve restart on NoState during switch.

hw/orion/default.nix

@@ -28,17 +28,12 @@
       };
     };
 
-    # Secret stays on the box, never in the nix store. Mode 0640 root:searx.
-    systemd.services.searx-secret = {
-      description = "Generate SearXNG secret if missing";
-      wantedBy = [ "searx.service" ];
-      before = [ "searx.service" ];
-      after = [ "systemd-sysusers.service" ];
-      serviceConfig = {
-        Type = "oneshot";
-        RemainAfterExit = true;
-      };
-      script = ''
+    # searx-init loads EnvironmentFile at spawn. The file must exist before
+    # systemd starts that unit. activationScripts run after users/groups and
+    # before units, so the first boot/switch cannot race.
+    system.activationScripts.searx-secret = {
+      deps = [ "users" ];
+      text = ''
         install -d -m 0750 -o root -g searx /var/lib/searx
         if [ ! -f /var/lib/searx/secret.env ]; then
           umask 027
@@ -50,14 +45,17 @@
     };
 
     # Loopback-only SearXNG, TLS via Tailscale Serve. No host firewall hole.
+    # Restart on NoState: during switch, tailscaled can still be coming up.
     systemd.services.tailscale-serve-searx = {
       description = "Advertise SearXNG on Tailscale Serve";
-      after = [ "tailscaled.service" "searx.service" ];
-      wants = [ "tailscaled.service" ];
+      after = [ "tailscaled.service" "network-online.target" "searx.service" ];
+      wants = [ "tailscaled.service" "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
         Type = "oneshot";
         RemainAfterExit = true;
+        Restart = "on-failure";
+        RestartSec = "5s";
         ExecStart = "${pkgs.tailscale}/bin/tailscale serve --bg --yes 8888";
       };
     };