SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-01-21 17:31:34 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Treat hedgedoc seesion-secret as data

Browse source
This commit is contained in:
SebastianStork 2025-05-19 01:04:18 +02:00
parent d610349204
commit f58ae84c6e
2 changed files with 24 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

47
modules/system/hedgedoc/default.nix
View file

@ -26,27 +26,14 @@ in
};
config = lib.mkIf cfg.enable {
sops = {
secrets = {
"hedgedoc/session-secret" = {
owner = user;
inherit group;
};
"hedgedoc/seb-password" = {
owner = user;
inherit group;
};
};
templates."hedgedoc/environment".content = ''
SESSION_SECRET=${config.sops.placeholder."hedgedoc/session-secret"}
'';
sops.secrets."hedgedoc/seb-password" = {
owner = user;
inherit group;
};
services.hedgedoc = {
enable = true;
environmentFile = config.sops.templates."hedgedoc/environment".path;
settings = {
domain = "${cfg.subdomain}.${config.networking.domain}";
inherit (cfg) port;
@ -58,15 +45,25 @@ in
};
};
systemd.services.hedgedoc.postStart =
let
manageUserSeb =
mode:
"${manage_users} --${mode} sebastian.stork@pm.me --pass \"$(cat ${
config.sops.secrets."hedgedoc/seb-password".path
})\"";
in
"${manageUserSeb "add"} || ${manageUserSeb "reset"}";
systemd.services.hedgedoc = {
# Ensure session-secret
preStart = lib.mkBefore ''
if [ ! -f /var/lib/hedgedoc/session-secret ]; then
${lib.getExe pkgs.pwgen} -s 64 1 > /var/lib/hedgedoc/session-secret
fi
export SESSION_SECRET=$(cat /var/lib/hedgedoc/session-secret)
'';
postStart =
let
manageUserSeb =
mode:
"${manage_users} --${mode} sebastian.stork@pm.me --pass \"$(cat ${
config.sops.secrets."hedgedoc/seb-password".path
})\"";
in
"${manageUserSeb "add"} || ${manageUserSeb "reset"}";
};
environment.shellAliases.hedgedoc-manage-users = "sudo --user=${user} ${manage_users}";
};