nix: support systemctl reload in the headscale service

Fixes #3027

Claude-Session: https://claude.ai/code/session_01RHEZM1qJ2hgndiXio7P56h

CHANGELOG.md

@@ -170,6 +170,7 @@ the ACME DNS-01 challenge through a built-in DNS provider: `acmedns`,
 ### Changes
 
 - A SIGHUP now reloads the certificate from `tls.cert_path` and `tls.key_path` without a restart; a certificate that cannot be loaded or is not valid now is logged as an error and the previous one keeps serving [#3027](https://github.com/juanfont/headscale/issues/3027)
+- The NixOS module's `headscale` service now supports `systemctl reload`
 - PostgreSQL connection settings are assembled into a `postgres://` URL with proper escaping, so a password (or host, user, database name) containing spaces, quotes or other reserved characters no longer truncates the DSN [#3477](https://github.com/juanfont/headscale/pull/3477)
 - Expiring or deleting a non-existent pre-auth key now returns an error instead of silently succeeding [#3324](https://github.com/juanfont/headscale/pull/3324)
 - Improve systemd service file hardening [#3341](https://github.com/juanfont/headscale/pull/3341)

nix/module.nix

@@ -822,6 +822,7 @@ in
           capabilityBoundingSet = [ "CAP_CHOWN" ] ++ lib.optional (cfg.port < 1024) "CAP_NET_BIND_SERVICE";
         in
         {
+          ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
           Restart = "always";
           RestartSec = "5s";
           Type = "simple";

nix/tests/headscale.nix

@@ -70,6 +70,10 @@ in
 
     headscale.succeed("headscale policy set -f ${policy}")
 
+    # The docs tell operators to run this; it needs ExecReload in the unit.
+    headscale.succeed("systemctl reload headscale.service")
+    headscale.wait_until_succeeds("journalctl -u headscale.service --grep 'Received SIGHUP'")
+
     # Clients reconnect after a control restart, peer1 over the TLS listener.
     headscale.systemctl("restart headscale.service")
     headscale.wait_until_succeeds(