nixos/dex: Restart on referenced file changes

Dex now restarts when EnvironmentFile or client secretFile paths
change.

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -558,6 +558,8 @@
 - `nix.channel.enable = false` no longer implies `nix.settings.nix-path = []`.
   Since Nix 2.13, a `nix-path` set in `nix.conf` cannot be overriden by the `NIX_PATH` configuration variable.
 
+- `services.dex` now restarts upon changes to the `.environmentFile` or entries in `.settings.staticClients[].secretFile` when the entry is a `path` type.
+
 ## Detailed migration information {#sec-release-24.11-migration}
 
 ### `sound` options removal {#sec-release-24.11-migration-sound}

nixos/modules/services/web-apps/dex.nix

@@ -16,6 +16,10 @@ let
       replace-secret '${file}' '${file}' /run/dex/config.yaml
     '')
     secretFiles));
+
+  restartTriggers = []
+  ++ (optionals (cfg.environmentFile != null) [ cfg.environmentFile ])
+  ++ (filter (file: builtins.typeOf file == "path") secretFiles);
 in
 {
   options.services.dex = {
@@ -72,6 +76,7 @@ in
       wantedBy = [ "multi-user.target" ];
       after = [ "networking.target" ] ++ (optional (cfg.settings.storage.type == "postgres") "postgresql.service");
       path = with pkgs; [ replace-secret ];
+      restartTriggers = restartTriggers;
       serviceConfig = {
         ExecStart = "${pkgs.dex-oidc}/bin/dex serve /run/dex/config.yaml";
         ExecStartPre = [