This fixes https://github.com/Mic92/sops-nix/issues/659
In https://github.com/Mic92/sops-nix/pull/649, we started rendering
templates twice:
1. When rendering `neededForUsers` secrets (if there are any
`neededForUsers` secrets).
2. When decrypting "regular" secrets.
This alone was weird and wrong, but didn't cause issues
for people until https://github.com/Mic92/sops-nix/pull/655, which
triggered https://github.com/Mic92/sops-nix/issues/659. The cause is not
super obvious:
1. When rendering `neededForUsers` secrets, we'd generate templates in
`/run/secrets-for-users/rendered`.
2. However, the `path` for these templates is in
`/run/secrets/rendered`, which is not inside of the
`/run/secrets-for-users` directory we're dealing with, so we'd
generate a symlink from `/run/secrets/rendered/<foo>` to
`/run/secrets-for-users/rendered/<foo>`, which required making
the parent directory of the symlink (`/run/secrets/rendered/`).
3. This breaks sops-nix's assumption that `/run/secrets` either doesn't
exist, or is a symlink, and you get the symptoms described in
<https://github.com/Mic92/sops-nix/issues/659>.
Reproducing this in a test was straightforward: just expand our existing
template test to also have a `neededForUsers` secret.
Fixing this was also straightforward: don't render templates during the
`neededForUsers` phase (if we want to add support for `neededForUsers`
templates in the future, that would be straightforward to do, but I
opted not do that here).
* Since 0d957142b6 the manual doesn't
build since `<name>` is interpreted by docbook as (unmatched) XML-tag.
I decided to use `<xref linkend` as this provides proper linking to
the referenced option.
* Also, if the module is included on a machine where `sops` isn't used,
but `documentation.nixos.includeAllModules = true;` is set, the module
wouldn't evaluate because `config.sopsFile` is referenced in a
`default`-tag. This is generally an issue since every change to this
option would trigger a rebuild of the manual anyways.
See also 94fd200305 for that.
When using `documentation.nixos.includeAllModules = true;`, I'd
otherwise have to rebuild the manual on each change since I have my
`defaultSopsFile` in a git-repo with all my other configs.
