SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-01-22 06:54:25 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Move secrets decryption from containers to server

Browse source
This commit is contained in:
SebastianStork 2024-09-22 19:10:52 +02:00
parent a4abd033cc
commit a7e1ced2a2
13 changed files with 58 additions and 196 deletions
Download patch file Download diff file Expand all files Collapse all files

13
hosts/stratus/containers/nspawn/forgejo/default.nix
View file

@ -4,6 +4,8 @@ let
subdomain = "git";
in
{
sops.secrets."container/forgejo/admin-password" = { };
containers.${serviceName}.config =
{
config,
@ -18,12 +20,8 @@ in
{
imports = [ ./backup.nix ];
sops.secrets."admin-password" = {
owner = userName;
group = groupName;
};
systemd.tmpfiles.rules = [
"z /run/secrets/container/forgejo/admin-password - ${userName} ${groupName} -"
"d ${dataDir}/home 750 ${userName} ${groupName} -"
"d ${dataDir}/postgresql 700 postgres postgres -"
];
@ -47,14 +45,13 @@ in
systemd.services.forgejo.preStart = ''
create="${lib.getExe config.services.forgejo.package} admin user create"
$create --admin --email "sebastian.stork@pm.me" --username seb --password "$(cat ${
config.sops.secrets."admin-password".path
})" || true
$create --admin --email "sebastian.stork@pm.me" --username seb --password "$(cat /run/secrets/container/forgejo/admin-password)" || true
'';
myConfig.tailscale = {
inherit subdomain;
serve = "3000";
};
};
}