Daaamn NFS is a pain

lib/fudo/host-filesystems.nix

@@ -32,7 +32,7 @@ in {
       # Ensure the mountpoints exist
       tmpfiles.rules = let
         mountpointToPath = mp: mpOpts:
-          "d '${mp}' - root ${optionalOrDefault mpOpts.group "-"} - -";
+          "d '${mp}' 750 root ${optionalOrDefault mpOpts.group "-"} - -";
         filesystemsToMountpointLists = mapAttrsToList
           (fs: fsOpts: fsOpts.mountpoints);
         mountpointListsToPaths = concatMap
@@ -53,9 +53,10 @@ in {
                 type = fs.opts.filesystem-type;
                 where = mp;
                 options = concatStringsSep "," (fs.opts.options ++ mp-opts.options);
-                wantedBy = [ "default.target" ];
                 description = "${fs.opts.filesystem-type} filesystem on ${fs.filesystem} mounted to ${mp}";
                 requires = [ "${fs.filesystem}-decrypt.service" ];
+                partOf = [ "${fs.filesystem}.target" ];
+                wantedBy = [ "${fs.filesystem}.target" ];
               })
             fs.opts.mountpoints)
           filesystems;
@@ -65,33 +66,54 @@ in {
       services = mapAttrs' (filesystem-name: opts:
         nameValuePair "${filesystem-name}-decrypt"
           {
-            wantedBy = [ "default.target" ];
             description = "Decrypt the ${filesystem-name} filesystem when the key is available at ${opts.key-path}";
             path = with pkgs; [ cryptsetup ];
             serviceConfig = {
               Type = "oneshot";
               RemainAfterExit = true;
               ExecStart = pkgs.writeShellScript "decrypt-${filesystem-name}.sh" ''
-                [ ! -d /dev/mapper/${filesystem-name} ] || cryptsetup open --type luks --key-file ${opts.key-path} ${opts.encrypted-device} ${filesystem-name}
+                [ -e /dev/mapper/${filesystem-name} ] || cryptsetup open --type luks --key-file ${opts.key-path} ${opts.encrypted-device} ${filesystem-name}
+              '';
+              ExecStartPost = pkgs.writeShellScript "remove-${filesystem-name}-key.sh" ''
+                rm ${opts.key-path}
               '';
               ExecStop = pkgs.writeShellScript "close-${filesystem-name}.sh" ''
                 cryptsetup close /dev/mapper/${filesystem-name}
               '';
             };
+            restartIfChanged = true;
           })
         host-filesystems;
 
       # Watch the path of the key, trigger decrypt when it's available
-      paths = mapAttrs' (filesystem-name: opts:
-        nameValuePair "${filesystem-name}-decrypt"
-          {
-            wantedBy = [ "default.target" ];
-            description = "Watch for decryption key, then decrypt the target filesystem.";
-            pathConfig = {
-              PathExists = opts.key-path;
-              Service = "${filesystem-name}-decrypt.service";
-            };
-          }) host-filesystems;
+      paths = let
+        decryption-jobs = mapAttrs' (filesystem-name: opts:
+          nameValuePair "${filesystem-name}-decrypt"
+            {
+              wantedBy = [ "default.target" ];
+              description = "Watch for decryption key, then decrypt the target filesystem.";
+              pathConfig = {
+                PathExists = opts.key-path;
+                Unit = "${filesystem-name}-decrypt.service";
+              };
+            }) host-filesystems;
+
+        post-decryption-jobs = mapAttrs' (filesystem-name: opts:
+          nameValuePair "${filesystem-name}-mount"
+            {
+              wantedBy = [ "default.target" ];
+              description = "Mount ${filesystem-name} filesystems once the decrypted device is available.";
+              pathConfig = {
+                PathExists = "/dev/mapper/${filesystem-name}";
+                Unit = "${filesystem-name}.target";
+              };
+            }) host-filesystems;
+      in decryption-jobs // post-decryption-jobs;
+
+      targets = mapAttrs (filesystem-name: opts:
+        {
+          description = "${filesystem-name} enabled and available.";
+        }) host-filesystems;
     };
   };
 }

lib/fudo/users.nix

@@ -134,18 +134,35 @@ in {
       };
     };
 
-    home-manager.useGlobalPkgs = true;
-    # home-manager.useGlobalPkgs = {
-    #   useGlobalPkgs = true;
+    services.nfs.idmapd.settings = let
+      local-domain = config.instance.local-domain;
+      local-admins = config.instance.local-admins;
+      local-users = config.instance.local-users;
+      local-realm = config.fudo.domains.${local-domain}.gssapi-realm;
+    in {
+      General = {
+        Verbosity = 10;
+        Domain = local-domain;
+        "Local-Realms" = local-realm;
+      };
+      Translation = {
+        GSS-Methods = "static";
+      };
+      Static = let
+        generate-admin-entry = admin: userOpts:
+          nameValuePair "${admin}/root@${local-realm}" "root";
+        generate-user-entry = user: userOpts:
+          nameValuePair "${user}@${local-realm}" user;
 
-    #   users = let
-    #     home-manager-users =
-    #       filterAttrs (username: userOpts: userOpts.home-manager-generator != null)
-    #       sys.local-users;
-    #   in mapAttrs (username: userOpts: userOpts.home-manager-generator {
-    #     enable-gui = host-cfg.enable-gui;
-    #   }) home-manager-users;
-    # };
+        admin-entries =
+          mapAttrs' generate-admin-entry (getAttrs local-admins local-users);
+        user-entries =
+          mapAttrs' generate-user-entry local-users;
+      in admin-entries // user-entries;
+    };
+
+    # TODO: This is NOT where this should be...
+    home-manager.useGlobalPkgs = true;
 
     # Group home directories have to exist, otherwise users can't log in
     systemd.services = let