From 0dc279bcc387d9837a1d64c338e6d92f08c1af27 Mon Sep 17 00:00:00 2001
From: Greg Hellings <greg.hellings@gmail.com>
Date: Thu, 20 Jun 2024 16:49:59 -0500
Subject: [PATCH] Use standard systemd configs

---
 hosts/myself/container-git.nix |  3 +++
 hosts/myself/git.nix           | 15 ++++++++-------
 2 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/hosts/myself/container-git.nix b/hosts/myself/container-git.nix
index 3309365..a704b51 100644
--- a/hosts/myself/container-git.nix
+++ b/hosts/myself/container-git.nix
@@ -188,6 +188,9 @@ in {
 			"network.target"
 			"network-online.target"
 		];
+		requires = [
+			"tailscaled.service"
+		];
 		preStart = ''
 			sleep 5  # tailscaled is up before it's ACTUALLY up... try waiting?
 		'';
diff --git a/hosts/myself/git.nix b/hosts/myself/git.nix
index 01b0316..a88a930 100644
--- a/hosts/myself/git.nix
+++ b/hosts/myself/git.nix
@@ -40,17 +40,18 @@ in  {
 
 	systemd.services = {
 		"gitlab-runner" = {
+			preStart = builtins.concatStringsSep "\n" [
+				"${pkgs.kmod}/bin/modprobe kvm"
+				"${pkgs.kmod}/bin/modprobe kvm_amd"
+			];
+			postStop = builtins.concatStringsSep "\n" [
+				"${pkgs.kmod}/bin/rmmod -f kvm_amd kvm"
+			];
 			serviceConfig = {
 				DevicePolicy = lib.mkForce "auto";
 				DevicesAllow = [ "/dev/kvm" "/dev/mem" ];
 				EnvironmentFile = config.age.secrets.docker-auth.path;
-				ExecStopPost = [
-					"${pkgs.kmod}/bin/rmmod kvm_amd kvm || true"
-				];
-				ExecStartPre = [
-					"+${pkgs.kmod}/bin/modprobe kvm"
-					"+${pkgs.kmod}/bin/modprobe kvm_amd"
-				];
+				PermissionsStartOnly = "true";
 				PrivateDevices = false;
 				ProtectKernelModules = false;
 			};