fix(minecraft-fabric): avoid unset CREDENTIALS_DIRECTORY in ExecStop r/8819

For mystifying reasons, Type=simple and CREDENTIALS_DIRECTORY in
ExecStop have stopped working (when exactly I don't know, but presumably
256). Apparently, you are supposed to use Type=exec with credentials due
to raciness (I've personally never experienced):
<https://github.com/systemd/systemd/issues/32583>.

Just changing the type did not resolve the issue of
CREDENTIALS_DIRECTORY being unset, though. It appears, though, that the
issue is merely an unset environment variable and not the credentials
being unavailable: We can work around the problem by setting an
appropriate environment variable ourselves.

Change-Id: Ifcdb1f3bce782ea1c568a9bc413f3fb29f0985c5
Reviewed-on: https://cl.tvl.fyi/c/depot/+/12649
Tested-by: BuildkiteCI
Reviewed-by: sterni <sternenseemann@systemli.org>
Autosubmit: sterni <sternenseemann@systemli.org>

1 files changed, 8 insertions, 3 deletions

diff --git a/users/sterni/modules/minecraft-fabric.nix b/users/sterni/modules/minecraft-fabric.nix
index 6cc32cd20587..8f44c8a536af 100644
--- a/users/sterni/modules/minecraft-fabric.nix
+++ b/users/sterni/modules/minecraft-fabric.nix
@@ -273,7 +273,7 @@ let
       export MCRCON_HOST=localhost
       export MCRCON_PORT=${lib.escapeShellArg instanceCfg.serverProperties."rcon.port"}
       # Unfortunately, mcrcon can't read the password from a file
-      export MCRCON_PASS="$(cat "''${CREDENTIALS_DIRECTORY}/rcon-password")"
+      export MCRCON_PASS="$(cat "''${RCON_PASSWORD}")"
 
       # Send stop request
       "${bins.mcrcon}" 'say Server is stopping' save-all stop
@@ -314,7 +314,7 @@ let
 
       # Create config and set password from credentials (echo hopefully doesn't leak)
       copyFromStore "${serverPropertiesFile name instanceCfg}" server.properties
-      echo "rcon.password=$(cat "$CREDENTIALS_DIRECTORY/rcon-password")" >> server.properties
+      echo "rcon.password=$(cat "$RCON_PASSWORD")" >> server.properties
 
       # Build patched jar
       "${bins.java}" -jar "${fabricInstallerJar}" \
@@ -509,8 +509,13 @@ in
             after = [ "network.target" ];
             inherit (instanceCfg) enable;
 
+            environment = {
+              # Workaround for https://github.com/systemd/systemd/issues/34805
+              "RCON_PASSWORD" = "%d/rcon-password";
+            };
+
             serviceConfig = {
-              Type = "simple";
+              Type = "exec";
               User = instanceCfg.user;
               Group = instanceCfg.group;
               ExecStart = startScript name instanceCfg;