88 lines
2.9 KiB
Nix
88 lines
2.9 KiB
Nix
{ pkgs, ... }: {
|
|
services.secrets = {
|
|
enable = true;
|
|
|
|
extraPackages = with pkgs;
|
|
[
|
|
# for music & mail passwd files
|
|
apacheHttpd
|
|
];
|
|
|
|
secrets = {
|
|
mpd_control_password = {
|
|
user = "mpd";
|
|
group = "mpd";
|
|
fetchScript = ''
|
|
simple_get "/api-keys/mpd" .password > $secretFile
|
|
'';
|
|
};
|
|
music_stream_passwd = {
|
|
user = "nginx";
|
|
group = "nginx";
|
|
fetchScript = ''
|
|
username=$(simple_get "/api-keys/music-stream" .username)
|
|
password=$(simple_get "/api-keys/music-stream" .password)
|
|
htpasswd -bc $secretFile "$username" "$password" 2>/dev/null
|
|
'';
|
|
};
|
|
chaos_mail_passwd = {
|
|
user = "dovecot2";
|
|
group = "dovecot2";
|
|
fetchScript = ''
|
|
password=$(simple_get "/passwords/mail" .password)
|
|
htpasswd -nbB "" "$password" 2>/dev/null | cut -d: -f2 > $secretFile
|
|
'';
|
|
};
|
|
gitlab_env = {
|
|
user = "gitlab_artifacts_sync";
|
|
group = "gitlab_artifacts_sync";
|
|
fetchScript = ''
|
|
token=$(simple_get "/api-keys/gitlab/gitlab_pages_serve" .token)
|
|
echo "GITLAB_TOKEN=$token" > $secretFile
|
|
'';
|
|
};
|
|
restic_password = {
|
|
fetchScript = ''
|
|
simple_get "/private-public-keys/restic/HetznerVM" .password > $secretFile
|
|
'';
|
|
};
|
|
restic_env = {
|
|
fetchScript = ''
|
|
RESTIC_USERNAME=$(simple_get "/api-keys/storage/restic/HetznerVM" .username)
|
|
RESTIC_PASSWORD=$(simple_get "/api-keys/storage/restic/HetznerVM" .password)
|
|
echo "RESTIC_REPOSITORY=rest:https://$RESTIC_USERNAME:$RESTIC_PASSWORD@storage-restic.owo.monster/HetznerVM" > $secretFile
|
|
'';
|
|
};
|
|
wg_privkey = {
|
|
fetchScript = ''
|
|
simple_get "/private-public-keys/wireguard/chaos-internal/hetzner-vm" .private > $secretFile
|
|
'';
|
|
};
|
|
wg_preshared_tablet = {
|
|
path = "/secrets/wg_preshared_tablet";
|
|
fetchScript = ''
|
|
simple_get "/private-public-keys/wireguard/chaos-internal/hetzner-vm" .preshared_keys.tablet > $secretFile
|
|
'';
|
|
};
|
|
wg_preshared_vault = {
|
|
path = "/secrets/wg_preshared_vault";
|
|
fetchScript = ''
|
|
simple_get "/private-public-keys/wireguard/chaos-internal/hetzner-vm" .preshared_keys.vault > $secretFile
|
|
'';
|
|
};
|
|
wg_preshared_storage = {
|
|
path = "/secrets/wg_preshared_storage";
|
|
fetchScript = ''
|
|
simple_get "/private-public-keys/wireguard/chaos-internal/hetzner-vm" .preshared_keys.storage > $secretFile
|
|
'';
|
|
};
|
|
wg_preshared_iphone8 = {
|
|
path = "/secrets/wg_preshared_iphone8";
|
|
fetchScript = ''
|
|
simple_get "/private-public-keys/wireguard/chaos-internal/hetzner-vm" .preshared_keys.iphone8 > $secretFile
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
}
|