···6060 };
6161 };
62626363+ # A changed tinc unit is restarted in switch-to-configuration's start phase
6464+ # instead of stopped up front: otherwise retiolum stays down for the whole
6565+ # stop phase (minutes when a unit like ipfs waits out its stop timeout) and
6666+ # takes the deploying ssh session over <machine>.r with it.
6767+ systemd.services."tinc.retiolum".stopIfChanged = false;
6868+6369 # Copy keys into the tinc config directory before tinc starts.
6470 # Running before nixpkgs' preStart ensures key generation is skipped.
6571 systemd.services."tinc.retiolum".preStart = lib.mkBefore ''