From 4cc2f41066d6c466f57a2d287af6f4cca7d5373a Mon Sep 17 00:00:00 2001
From: Antoine Martin <antoine@alarsyo.net>
Date: Fri, 11 Mar 2022 18:42:51 +0100
Subject: [PATCH] secrets: move nextcloud secrets to agenix

---
 hosts/poseidon/default.nix               |   1 +
 hosts/poseidon/secrets.nix               |   4 ++++
 modules/secrets/nextcloud/admin-pass.age | Bin 0 -> 396 bytes
 modules/secrets/secrets.nix              |   2 ++
 secrets/default.nix                      |   2 --
 secrets/nextcloud-admin-pass.secret      | Bin 87 -> 0 bytes
 secrets/nextcloud-admin-user.secret      | Bin 28 -> 0 bytes
 services/nextcloud.nix                   |  15 ++++++++++++---
 8 files changed, 19 insertions(+), 5 deletions(-)
 create mode 100644 modules/secrets/nextcloud/admin-pass.age
 delete mode 100644 secrets/nextcloud-admin-pass.secret
 delete mode 100644 secrets/nextcloud-admin-user.secret

diff --git a/hosts/poseidon/default.nix b/hosts/poseidon/default.nix
index 282e26d..4ad98ac 100644
--- a/hosts/poseidon/default.nix
+++ b/hosts/poseidon/default.nix
@@ -117,6 +117,7 @@ in
 
     nextcloud = {
       enable = true;
+      adminpassFile = config.age.secrets."nextcloud/admin-pass".path;
     };
 
     nuage = {
diff --git a/hosts/poseidon/secrets.nix b/hosts/poseidon/secrets.nix
index f058804..24785d6 100644
--- a/hosts/poseidon/secrets.nix
+++ b/hosts/poseidon/secrets.nix
@@ -17,6 +17,10 @@
             owner = "matrix-synapse";
           };
 
+          "nextcloud/admin-pass" = {
+            owner = "nextcloud";
+          };
+
           "restic-backup/poseidon-credentials" = {};
           "restic-backup/poseidon-password" = {};
 
diff --git a/modules/secrets/nextcloud/admin-pass.age b/modules/secrets/nextcloud/admin-pass.age
new file mode 100644
index 0000000000000000000000000000000000000000..e2c436e9048d506378309e018bd207be1dd97ec3
GIT binary patch
literal 396
zcmV;70dxLgXJsvAZewzJaCB*JZZ2<fXD@a!3N1b$b8~1dWn?lnH8D9LdNxIMI8h)(
zMt3uIQ+h{8Wo|<<ZCYkcG*~f9ac?(LZ&p`uP-S8?GfZtlNK7(SRBH-nD=SV@b!Ki%
zHEv9FRd#o9a5zI_X)|Y8Vpw`OFET_iF>)(HL{3O_X?F@OJ|I>kT`gyFWnpt=AR%-L
zVoo$nFH}`@SSw>uWJ7gDWpp-EIYM@9M0GS_IA%>_L}gJ#HbhcUa#u=GFGn+OGf`JZ
zIBzykYI-?LGHEtM3Qk6NVJm4vLri#1cT{*;RAx0}S7K#ZVM{bKb9qiRZ&+k_R|+jH
zEg()&c1%chZFoa4VKOp9LT4*(NOx5@Fi?6{T2ezRM@4yPGGke8V=_f^RSL6iZyj6A
z)r}_iePf-*9RLO6%b7O2AbZXERMucJ5JnoVB?=XcrAa*|RT5F^@yUK|*df6W)5?mV
q`@EwEPGF|EYF(7<F05%!04Mm|^y2A#8>O|NLM}Q8tZEw^gTb$0y^R0>

literal 0
HcmV?d00001

diff --git a/modules/secrets/secrets.nix b/modules/secrets/secrets.nix
index 4516497..e8215c1 100644
--- a/modules/secrets/secrets.nix
+++ b/modules/secrets/secrets.nix
@@ -17,6 +17,8 @@ in
 
   "matrix-synapse/secret-config.age".publicKeys = [ poseidon ];
 
+  "nextcloud/admin-pass.age".publicKeys = [ poseidon ];
+
   "restic-backup/boreal-password.age".publicKeys = [ alarsyo boreal ];
   "restic-backup/boreal-credentials.age".publicKeys = [ alarsyo boreal ];
   "restic-backup/poseidon-password.age".publicKeys = [ alarsyo poseidon ];
diff --git a/secrets/default.nix b/secrets/default.nix
index 726354d..d514361 100644
--- a/secrets/default.nix
+++ b/secrets/default.nix
@@ -11,8 +11,6 @@ in {
 
   config.my.secrets = {
     miniflux-admin-credentials = fileContents ./miniflux-admin-credentials.secret;
-    nextcloud-admin-pass = ./nextcloud-admin-pass.secret;
-    nextcloud-admin-user = fileContents ./nextcloud-admin-user.secret;
 
     paperless = import ./paperless { inherit lib; };
   };
diff --git a/secrets/nextcloud-admin-pass.secret b/secrets/nextcloud-admin-pass.secret
deleted file mode 100644
index 49f51ea3444c20ee5acd455fc986386c9c10a598..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 87
zcmV-d0I2@}M@dveQdv+`0Oz>h`m_yf09yG|T$~YwjrNvI#vdu?2Dij|7m&+xc2{PV
t7`N=gct*$YUc&F!12-^Fe^wZwUT3vM6}Q3WB9k0;GA+QIHLiie+BeejDBA!4

diff --git a/secrets/nextcloud-admin-user.secret b/secrets/nextcloud-admin-user.secret
deleted file mode 100644
index e653faf45a54d46c7c98d8c641b30d9a42b4507a..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 28
jcmZQ@_Y83kiVO&0$mq3WFFNr~|7$_K1&iDymi0;ig02aT

diff --git a/services/nextcloud.nix b/services/nextcloud.nix
index 89a6bf5..909bd95 100644
--- a/services/nextcloud.nix
+++ b/services/nextcloud.nix
@@ -6,6 +6,7 @@ let
   inherit (lib)
     mkEnableOption
     mkIf
+    mkOption
   ;
 
   cfg = config.my.services.nextcloud;
@@ -14,8 +15,16 @@ let
   dbName = "nextcloud";
 in
 {
-  options.my.services.nextcloud = {
+  options.my.services.nextcloud = let inherit (lib) types; in {
     enable = mkEnableOption "NextCloud";
+
+    adminpassFile = mkOption {
+      type = types.path;
+      description = ''
+        Path to a file containing the admin's password, must be readable by
+        'nextcloud' user.
+      '';
+    };
   };
 
   config = mkIf cfg.enable {
@@ -62,8 +71,8 @@ in
         dbname = dbName;
         dbhost = "/run/postgresql";
 
-        adminuser = my.secrets.nextcloud-admin-user;
-        adminpassFile = "${my.secrets.nextcloud-admin-pass}";
+        adminuser = "admin";
+        adminpassFile = cfg.adminpassFile;
       };
     };