add after option to cert client

common/cascade-cert-client.nix

@@ -16,7 +16,7 @@ let cfg = config.security.cascade-certs;
       };
     };
     
-    confToService = n: {enabled, readers, minSecondsRemaining, readerGroups, vaultPkiRole, vaultPkiPath, issueOptions, ...}@opts: mkIf enabled {
+    confToService = n: {enabled, after, readers, minSecondsRemaining, readerGroups, vaultPkiRole, vaultPkiPath, issueOptions, ...}@opts: mkIf enabled {
       serviceConfig = {
         Type = "oneshot";
       };
@@ -25,9 +25,8 @@ let cfg = config.security.cascade-certs;
         certFolder = "${cfg.destination}/${n}";
         caFolder = "${cfg.destination}/@trust";
       in ''
-        set -x 
         PATH="${pkgs.curl}/bin:${pkgs.coreutils}/bin:${pkgs.jq}/bin:${pkgs.openssl}/bin:${pkgs.acl}/bin:$PATH"
-    
+
         if [ -r ${shq certFolder}/cert.pem ] \
 	   && [ -h ${shq certFolder}/current ] \
 	   && openssl x509 -checkend ${shq minSecondsRemaining} -in ${shq certFolder}/cert.pem ;then
@@ -109,6 +108,8 @@ let cfg = config.security.cascade-certs;
             fi
             rm -rf "$f"
         done
+
+	${after}
       '';
     };
     
@@ -258,6 +259,13 @@ options = with types; {
 	  default = null;
 	};
 
+        after = mkOption {
+	  type = lines;
+	  description = ''
+	    A script which will be run after a new certificate is written.
+	  '';
+	  default = "";
+	};
         names = mkOption {
 	  type = listOf str;
 	  description = ''