oysteikt/nix-dotfiles
oysteikt/nix-dotfiles
2
1
Fork 0
Code Issues Pull Requests Activity

tsuki/hedgedoc: use sops templates for env, dedent

Browse Source
This commit is contained in:
Oystein Kristoffer Tveit 2024-11-29 00:41:30 +01:00
parent fac13db8cb
commit 1301e848ed
Signed by: oysteikt
GPG Key ID: 9F2F7D8250F35146
2 changed files with 77 additions and 66 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
hosts/tsuki/services/hedgedoc.nix
View File

@ -1,19 +1,29 @@
{ pkgs, lib, config, options, ... }: let { pkgs, lib, config, ... }: let
cfg = config.services.hedgedoc; cfg = config.services.hedgedoc;
in { in {
config = { sops = {
# Contains CMD_SESSION_SECRET and CMD_OAUTH2_CLIENT_SECRET secrets = {
sops.secrets."hedgedoc/env" = { "hedgedoc/env/cmd_session_secret" = { };
"hedgedoc/env/cmd_oauth2_client_secret" = { };
};
templates."hedgedoc.env" = {
restartUnits = [ "hedgedoc.service" ]; restartUnits = [ "hedgedoc.service" ];
owner = "hedgedoc"; owner = "hedgedoc";
group = "hedgedoc"; group = "hedgedoc";
content = let
inherit (config.sops) placeholder;
in ''
CMD_SESSION_SECRET=${placeholder."hedgedoc/env/cmd_session_secret"}
CMD_OAUTH2_CLIENT_SECRET=${placeholder."hedgedoc/env/cmd_oauth2_client_secret"}
'';
};
}; };
users.groups.hedgedoc.members = [ "nginx" ]; users.groups.hedgedoc.members = [ "nginx" ];
services.hedgedoc = { services.hedgedoc = {
enable = true; enable = true;
environmentFile = config.sops.secrets."hedgedoc/env".path; environmentFile = config.sops.templates."hedgedoc.env".path;
settings = { settings = {
domain = "docs.nani.wtf"; domain = "docs.nani.wtf";
email = false; email = false;
@ -67,5 +77,4 @@ in {
]; ];
after = requires; after = requires;
}; };
};
} }

8
secrets/tsuki.yaml
View File

@ -11,7 +11,9 @@ grafana:
headscale: headscale:
oauth2_secret: ENC[AES256_GCM,data:OUOh2ICq4eMeo5WleqIui3rG8VJVW+XVyAkqF1hh6kdijr5G+1CkpQQbsbafwhq3,iv:99xDRg5b2gc7uGNput4R6QZung9voQWnanCDkvmdjyA=,tag:xEaQFbliEZeg508LubNWYA==,type:str] oauth2_secret: ENC[AES256_GCM,data:OUOh2ICq4eMeo5WleqIui3rG8VJVW+XVyAkqF1hh6kdijr5G+1CkpQQbsbafwhq3,iv:99xDRg5b2gc7uGNput4R6QZung9voQWnanCDkvmdjyA=,tag:xEaQFbliEZeg508LubNWYA==,type:str]
hedgedoc: hedgedoc:
env: ENC[AES256_GCM,data:Sq69/2EIPexulpYTIe3VqsnGd5WfMf3/d52uai8QvNMIS+dXxie6OtFEZzh51I94F1vnA1rshTR0rv2zxerVUR2ZSaw+igWII6VJUu/Aw8tOilMhJv8K17xfxTCLjZFedMYmJOw88PfOFUuYH/CVA9Yj4xh/q8PE0Js8Mz1Ft48wNjze5SAlCiDbagRvJKQqBu9prUjEsQ4Db9vkDuTdej9w,iv:9Tkdp4ZXcTrJ4HdOE/OyCnNHOE6JXAkJOTRt2mXa9/o=,tag:h/FTyRC/ouURh8IyCjw6Mw==,type:str] env:
cmd_session_secret: ENC[AES256_GCM,data:07Qg7KtmbFDq/rGfY3t/Q1epp+qef8PecWqn7FhZS2wc3TKsxwx2f38zKbe/V/8dRCG7eXAoJo63JfmnEscz9Q==,iv:YgpcyCmg6+Bmd0S78OKpBZ7qqR12YLYhn5Pa6dvscPk=,tag:ar6s7AlH/NMzskt8CGE18w==,type:str]
cmd_oauth2_client_secret: ENC[AES256_GCM,data:rSLCdLSe0svTaufu8VuaWwS8H26uypONs7g7RKJbqUITAKPtAwOOyxpwuV+9rvPT,iv:yQCBVcCLnotVUf4txxX8q6RHaMwhuCtfA3TjNdiyhxs=,tag:MwkdyQnijo6u6EHIt4dYWA==,type:str]
cloudflare: cloudflare:
api-key: ENC[AES256_GCM,data:Y1sHbPTUSiFzRyAiwk0ycFdM4s9ET5g/RPjVsb3sHXMlc3AJHDBYhTljyytZ1lCoFz7OdcZcUOHWzgvHtce6yXiGUpmo34XBKZqloFlNA5u6XC2UG31qfuUEWpRZb0kL,iv:iwN243uzSCjl5Za1msKbaC4pPAOE8frZ2WEvgZ5xknA=,tag:q32vyQI7SOFoN6s1RjQV5A==,type:str] api-key: ENC[AES256_GCM,data:Y1sHbPTUSiFzRyAiwk0ycFdM4s9ET5g/RPjVsb3sHXMlc3AJHDBYhTljyytZ1lCoFz7OdcZcUOHWzgvHtce6yXiGUpmo34XBKZqloFlNA5u6XC2UG31qfuUEWpRZb0kL,iv:iwN243uzSCjl5Za1msKbaC4pPAOE8frZ2WEvgZ5xknA=,tag:q32vyQI7SOFoN6s1RjQV5A==,type:str]
drives: drives:
@ -56,8 +58,8 @@ sops:
MThmQ1Iza0F6Q0Y4N1JpT2V5a0FrTGMKIzpNe4dyCLuyKjjXjadZepRYvULr3j3i MThmQ1Iza0F6Q0Y4N1JpT2V5a0FrTGMKIzpNe4dyCLuyKjjXjadZepRYvULr3j3i
7SSwFgVvESj0aVwcGMW1swkhdb2evZgcghhrJpiK8kKIPrWEuFiCcw== 7SSwFgVvESj0aVwcGMW1swkhdb2evZgcghhrJpiK8kKIPrWEuFiCcw==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
lastmodified: "2024-11-28T23:23:32Z" lastmodified: "2024-11-28T23:33:37Z"
mac: ENC[AES256_GCM,data:lA4bB1kaZKeau71Fa7ZhUusoZ+jhF405N6cJap/EEQ3EYIDEwK9hYYGZas+AsrvQ/0HW9lDXI/LliVMUxpEWuOoizaK1gW+ZxVz7jsgoSINILU3I6ZJewcPXh5fbwRS6g5+HEVJ53ozXxcnyVx+jpE7Rysfe9wK+kAk90NL0i5c=,iv:/Ltl/Gcm3QDhsK6MnZqKo/UWjwFVPYENc5xKW38jLxk=,tag:Hly2g9tVihTfwqjJb2e+Dw==,type:str] mac: ENC[AES256_GCM,data:iw6m2XmdVgEvGeYQC9ORcaxu4p6kiYWJNWmkYPPOPLSn4xECgd8tmPlxUWHwiIEjDzD+Vi7atafW8eAtQg9T8s4mvV1Ovw7oBKzzGk3DqFKB9//myedBtIvntCYGDpBSXcVqK1iHKsG605fnY1CrzyRG5gi3xoub3AabcM8l8sQ=,iv:JdIKfELLUUG/2AzQx/uc+YaHhGNAb0sSiih3rDBkUjg=,tag:fqCMmnjIDACAzG+eiCCKrQ==,type:str]
pgp: pgp:
- created_at: "2024-06-25T17:16:27Z" - created_at: "2024-06-25T17:16:27Z"
enc: |- enc: |-