fix(youko): wait for data mounts before tmpfiles setup (#498)

systemd-tmpfiles-setup only orders itself after local-fs.target, but the nofail /data submounts can complete later. It then sees /data as the read-only fallback tmpfs and fails to create the Transmission, Immich, RustFS and restic directories at boot.

Add RequiresMountsFor for the data mounts and cover the generated unit dependency with an eval test.

hosts/12kingdoms-youko/homelab-services/disko-fs.nix

@@ -33,6 +33,18 @@ in
 
   fileSystems."/data/fileshare/public".depends = [ "/data/fileshare" ];
 
+  # The nofail data mounts finish after local-fs.target. systemd-tmpfiles-setup
+  # only orders itself after local-fs.target, so without an explicit dependency
+  # it can run while /data is still the read-only fallback tmpfs and fail to
+  # create the Transmission, Immich, RustFS and restic directories at boot.
+  systemd.services.systemd-tmpfiles-setup.unitConfig.RequiresMountsFor = [
+    "/data/apps"
+    "/data/fileshare"
+    "/data/fileshare/public"
+    "/data/backups"
+    "/data/apps-snapshots"
+  ];
+
   # By adding this crypttab entry, the disk will be unlocked by systemd-cryptsetup@xxx.service at boot time.
   # This systemd service is running after agenix, so that the keyfile is already available.
   environment.etc = {

outputs/x86_64-linux/tests/youko-tmpfiles/expected.nix

@@ -0,0 +1,10 @@
+{ ... }:
+{
+  requiresMountsFor = [
+    "/data/apps"
+    "/data/apps-snapshots"
+    "/data/backups"
+    "/data/fileshare"
+    "/data/fileshare/public"
+  ];
+}

outputs/x86_64-linux/tests/youko-tmpfiles/expr.nix

@@ -0,0 +1,11 @@
+{
+  lib,
+  outputs,
+  ...
+}:
+let
+  unit = outputs.nixosConfigurations.youko.config.systemd.services.systemd-tmpfiles-setup;
+in
+{
+  requiresMountsFor = builtins.sort builtins.lessThan unit.unitConfig.RequiresMountsFor;
+}