My Nix Configuration
[marvin] update all services with multiple secrets
Now they all use `mkServiceSecrets` for a bit of cleaner code.
+39
-108
+11
-19
hosts/marvin/services/buildbot.nix
+11
-19
hosts/marvin/services/buildbot.nix
···
1
1
{ config, self, ... }:
2
2
let
3
-
as = config.age.secrets;
4
3
d = self.lib.data.services.buildbot;
5
4
g = self.lib.data.services.git;
6
-
bbSecret = {
7
-
owner = "buildbot";
8
-
group = "buildbot";
9
-
};
5
+
sec = config.age.secrets;
6
+
inherit (self.lib.secrets) mkServiceSecrets;
10
7
in
11
8
{
12
9
services = {
13
10
buildbot-nix.master = {
14
11
enable = true;
15
12
dbUrl = "postgresql://buildbot@localhost/buildbot";
16
-
workersFile = as.buildbot-workers.path;
13
+
workersFile = sec.buildbot-workers.path;
17
14
authBackend = "gitea";
18
15
gitea = {
19
16
enable = true;
20
-
tokenFile = as.buildbot-gitea-token.path;
21
-
oauthSecretFile = as.buildbot-oauth-secret.path;
17
+
tokenFile = sec.buildbot-gitea-token.path;
18
+
oauthSecretFile = sec.buildbot-oauth-secret.path;
22
19
instanceUrl = g.extUrl;
23
20
oauthId = "2bfd5c46-43a7-4d98-b443-9176dc0a9452";
24
21
topic = "buildbot-enable";
···
39
36
};
40
37
buildbot-master.port = 6915;
41
38
};
42
-
age.secrets = {
43
-
buildbot-gitea-token = bbSecret // {
44
-
file = ./secrets/buildbot-gitea-token.age;
45
-
};
46
-
buildbot-oauth-secret = bbSecret // {
47
-
file = ./secrets/buildbot-oauth-secret.age;
48
-
};
49
-
buildbot-workers = bbSecret // {
50
-
file = ./secrets/buildbot-workers.age;
51
-
};
52
-
};
39
+
age.secrets = mkServiceSecrets "buildbot" ./secrets [
40
+
"gitea-token"
41
+
"oauth-secret"
42
+
"worker-password"
43
+
"workers"
44
+
];
53
45
}
+14
-48
hosts/marvin/services/git.nix
+14
-48
hosts/marvin/services/git.nix
···
8
8
}:
9
9
let
10
10
cfg = config.services.forgejo.settings;
11
-
age = config.age.secrets;
12
-
13
-
forgejoSecret = {
14
-
owner = "forgejo";
15
-
group = "forgejo";
16
-
};
17
-
11
+
sec = config.age.secrets;
18
12
d = self.lib.data.services.git;
19
13
in
20
14
{
21
15
catppuccin.forgejo.enable = true;
22
16
py.services.forgejo-runner = {
23
17
enable = true;
24
-
tokenFile = age.forgejo-default-runner-token.path;
18
+
tokenFile = sec.forgejo-default-runner-token.path;
25
19
};
26
20
services.forgejo = {
27
21
enable = true;
···
32
26
database = {
33
27
type = "postgres";
34
28
createDatabase = true;
35
-
passwordFile = age.forgejo-db-pw.path;
29
+
passwordFile = sec.forgejo-db-pw.path;
36
30
};
37
31
secrets = {
38
-
mailer.PASSWD = age.forgejo-mail-pw.path;
39
-
security.SECRET_KEY = lib.mkForce age.forgejo-secret-key.path;
40
-
security.INTERNAL_TOKEN = lib.mkForce age.forgejo-internal-token.path;
41
-
oauth2.JWT_SECRET = lib.mkForce age.forgejo-oauth2-jwt-secret.path;
42
-
server.LFS_JWT_SECRET = lib.mkForce age.forgejo-lfs-jwt-secret.path;
32
+
mailer.PASSWD = sec.forgejo-mail-pw.path;
33
+
security.SECRET_KEY = lib.mkForce sec.forgejo-secret-key.path;
34
+
security.INTERNAL_TOKEN = lib.mkForce sec.forgejo-internal-token.path;
35
+
oauth2.JWT_SECRET = lib.mkForce sec.forgejo-oauth2-jwt-secret.path;
36
+
server.LFS_JWT_SECRET = lib.mkForce sec.forgejo-lfs-jwt-secret.path;
43
37
};
44
38
settings = {
45
39
DEFAULT = {
···
125
119
};
126
120
};
127
121
};
128
-
age.secrets = self.lib.secrets.mkServiceSecrets "forgejo" true ./secrets [
129
-
"oidc-secret"
130
-
"db-pw"
131
-
"mail-pw"
122
+
age.secrets = self.lib.secrets.mkServiceSecrets "forgejo" ./secrets [
123
+
# keep-sorted start
132
124
"aux-docs-runner-token"
125
+
"db-pw"
133
126
"default-runner-token"
134
127
"gitgay-runner-token"
135
128
"internal-token"
129
+
"lfs-jwt-secret"
130
+
"mail-pw"
136
131
"oauth2-jwt-secret"
137
-
"lfs-jwt-secret"
138
132
"secret-key"
133
+
# keep-sorted end
139
134
];
140
-
# age.secrets = lib.mkIf config.services.forgejo.enable {
141
-
# forgejo-db-pw = forgejoSecret // {
142
-
# file = ./secrets/forgejo/db-pw.age;
143
-
# };
144
-
# forgejo-mail-pw = forgejoSecret // {
145
-
# file = ./secrets/forgejo/mail-pw.age;
146
-
# };
147
-
# forgejo-aux-docs-runner-token = forgejoSecret // {
148
-
# file = ./secrets/forgejo/aux-docs-runner-token.age;
149
-
# };
150
-
# forgejo-default-runner-token = forgejoSecret // {
151
-
# file = ./secrets/forgejo/default-runner-token.age;
152
-
# };
153
-
# forgejo-gitgay-runner-token = forgejoSecret // {
154
-
# file = ./secrets/forgejo/gitgay-runner-token.age;
155
-
# };
156
-
# forgejo-internal-token = forgejoSecret // {
157
-
# file = ./secrets/forgejo/internal-token.age;
158
-
# };
159
-
# forgejo-oauth2-jwt-secret = forgejoSecret // {
160
-
# file = ./secrets/forgejo/oauth2-jwt-secret.age;
161
-
# };
162
-
# forgejo-lfs-jwt-secret = forgejoSecret // {
163
-
# file = ./secrets/forgejo/lfs-jwt-secret.age;
164
-
# };
165
-
# forgejo-secret-key = forgejoSecret // {
166
-
# file = ./secrets/forgejo/secret-key.age;
167
-
# };
168
-
# };
169
135
services.anubis.instances.forgejo = lib.mkIf config.services.forgejo.enable {
170
136
settings = {
171
137
BIND = ":${toString d.anubis}";
+2
-16
hosts/marvin/services/grafana.nix
+2
-16
hosts/marvin/services/grafana.nix
···
7
7
let
8
8
d = self.lib.data.services.grafana;
9
9
p = self.lib.data.services.pocket-id;
10
-
11
-
grafanaSecret = name: {
12
-
owner = "grafana";
13
-
group = "grafana";
14
-
file = ./secrets/grafana/${name}.age;
15
-
};
16
-
17
-
mkGrafanaSecrets =
18
-
secrets:
19
-
builtins.listToAttrs (
20
-
map (sec: {
21
-
name = "grafana-${sec}";
22
-
value = grafanaSecret sec;
23
-
}) secrets
24
-
);
10
+
inherit (self.lib.secrets) mkServiceSecrets;
25
11
in
26
12
{
27
13
services.grafana = {
···
63
49
};
64
50
};
65
51
};
66
-
age.secrets = mkGrafanaSecrets [
52
+
age.secrets = mkServiceSecrets "grafana" ./secrets [
67
53
"admin-password"
68
54
"smtp-password"
69
55
"oidc-secret"
+5
-12
hosts/marvin/services/immich.nix
+5
-12
hosts/marvin/services/immich.nix
···
6
6
}:
7
7
let
8
8
d = self.lib.data.services.immich;
9
+
inherit (self.lib.secrets) mkServiceSecrets;
9
10
in
10
11
{
11
12
services = {
···
38
39
"video"
39
40
"render"
40
41
];
41
-
age.secrets = {
42
-
immich-oauth-secret = {
43
-
file = ./secrets/immich/oauth-secret.age;
44
-
owner = "immich";
45
-
group = "immich";
46
-
};
47
-
immich-mail-pw = {
48
-
file = ./secrets/immich/mail-pw.age;
49
-
owner = "immich";
50
-
group = "immich";
51
-
};
52
-
};
42
+
age.secrets = mkServiceSecrets "immich" ./secrets [
43
+
"oauth-secret"
44
+
"mail-pw"
45
+
];
53
46
}
+7
-13
hosts/marvin/services/paperless.nix
+7
-13
hosts/marvin/services/paperless.nix
···
6
6
let
7
7
d = self.lib.data.services.paperless;
8
8
sec = config.age.secrets;
9
+
inherit (self.lib.secrets) mkServiceSecrets;
9
10
in
10
11
{
11
12
services.paperless = {
···
13
14
inherit (d) port;
14
15
address = "0.0.0.0";
15
16
domain = d.extUrl;
16
-
passwordFile = sec.paperless-admin-pw.path;
17
+
passwordFile = sec.paperless-admin-password.path;
17
18
database.createLocally = true;
18
19
configureTika = true;
19
20
settings = {
···
28
29
PAPERLESS_TASK_WORKERS = 3;
29
30
};
30
31
};
31
-
age.secrets = {
32
-
paperless-admin-pw = {
33
-
file = ./secrets/paperless/admin-password.age;
34
-
owner = "paperless";
35
-
group = "paperless";
36
-
};
37
-
paperless-secrets = {
38
-
file = ./secrets/paperless/secrets.age;
39
-
owner = "paperless";
40
-
group = "paperless";
41
-
};
42
-
};
32
+
33
+
age.secrets = mkServiceSecrets "paperless" ./secrets [
34
+
"admin-password"
35
+
"secrets"
36
+
];
43
37
}