alarsyo/nixos-config
alarsyo/nixos-config
1
1
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

secrets: move paperless secrets to agenix

Browse source
This commit is contained in:
Antoine Martin 2022-03-11 18:55:56 +01:00
parent 8d75500055
commit 2c3032c642
10 changed files with 34 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

23
services/paperless.nix
View file

@ -11,7 +11,6 @@ let
my = config.my;
domain = config.networking.domain;
paperlessDomain = "paperless.${domain}";
secretKeyFile = pkgs.writeText "paperless-secret-key-file.env" my.secrets.paperless.secretKey;
in
{
options.my.services.paperless = let inherit (lib) types; in {
@ -23,13 +22,27 @@ in
example = 8080;
description = "Internal port for Paperless service";
};
passwordFile = mkOption {
type = types.path;
description = ''
Path to a file containing the admin's password
'';
};
secretKeyFile = mkOption {
type = types.path;
description = ''
Path to a file containing the service's secret key
'';
};
};
config = mkIf cfg.enable {
services.paperless-ng = {
enable = true;
port = cfg.port;
passwordFile = pkgs.writeText "paperless-password-file.txt" config.my.secrets.paperless.adminPassword;
passwordFile = cfg.passwordFile;
extraConfig = {
# Postgres settings
PAPERLESS_DBHOST = "/run/postgresql";
@ -53,17 +66,17 @@ in
systemd.services = {
paperless-ng-server.serviceConfig = {
EnvironmentFile = secretKeyFile;
EnvironmentFile = cfg.secretKeyFile;
BindReadOnlyPaths = [ config.services.redis.servers.paperless.unixSocket ];
};
paperless-ng-consumer.serviceConfig = {
EnvironmentFile = secretKeyFile;
EnvironmentFile = cfg.secretKeyFile;
BindReadOnlyPaths = [ config.services.redis.servers.paperless.unixSocket ];
};
paperless-ng-web.serviceConfig = {
EnvironmentFile = secretKeyFile;
EnvironmentFile = cfg.secretKeyFile;
BindReadOnlyPaths = [ config.services.redis.servers.paperless.unixSocket ];
};
};