From 94e85283c38161bdcea3bd675c412f358a96378e Mon Sep 17 00:00:00 2001
From: Kyle Isom <kyle@imap.cc>
Date: Tue, 22 Sep 2026 18:49:42 -0700
Subject: [PATCH] orion: generate SearXNG secret in activationScripts

searx-init loads EnvironmentFile at spawn, so the secret must exist
before systemd starts that unit. Drop the racing oneshot. Make
tailscale-serve restart on NoState during switch.
---
 hw/orion/default.nix | 24 +++++++++++-------------
 1 file changed, 11 insertions(+), 13 deletions(-)

diff --git a/hw/orion/default.nix b/hw/orion/default.nix
index f05a715..4f761c4 100644
--- a/hw/orion/default.nix
+++ b/hw/orion/default.nix
@@ -28,17 +28,12 @@
       };
     };
 
-    # Secret stays on the box, never in the nix store. Mode 0640 root:searx.
-    systemd.services.searx-secret = {
-      description = "Generate SearXNG secret if missing";
-      wantedBy = [ "searx.service" ];
-      before = [ "searx.service" ];
-      after = [ "systemd-sysusers.service" ];
-      serviceConfig = {
-        Type = "oneshot";
-        RemainAfterExit = true;
-      };
-      script = ''
+    # searx-init loads EnvironmentFile at spawn. The file must exist before
+    # systemd starts that unit. activationScripts run after users/groups and
+    # before units, so the first boot/switch cannot race.
+    system.activationScripts.searx-secret = {
+      deps = [ "users" ];
+      text = ''
         install -d -m 0750 -o root -g searx /var/lib/searx
         if [ ! -f /var/lib/searx/secret.env ]; then
           umask 027
@@ -50,14 +45,17 @@
     };
 
     # Loopback-only SearXNG, TLS via Tailscale Serve. No host firewall hole.
+    # Restart on NoState: during switch, tailscaled can still be coming up.
     systemd.services.tailscale-serve-searx = {
       description = "Advertise SearXNG on Tailscale Serve";
-      after = [ "tailscaled.service" "searx.service" ];
-      wants = [ "tailscaled.service" ];
+      after = [ "tailscaled.service" "network-online.target" "searx.service" ];
+      wants = [ "tailscaled.service" "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
         Type = "oneshot";
         RemainAfterExit = true;
+        Restart = "on-failure";
+        RestartSec = "5s";
         ExecStart = "${pkgs.tailscale}/bin/tailscale serve --bg --yes 8888";
       };
     };