alarsyo/nixos-config
alarsyo/nixos-config
1
1
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

secrets: move nextcloud secrets to agenix

Browse source
This commit is contained in:
Antoine Martin 2022-03-11 18:42:51 +01:00
parent 2908bbb887
commit 4cc2f41066
8 changed files with 19 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
hosts/poseidon/default.nix
View file

@ -117,6 +117,7 @@ in
nextcloud = { nextcloud = {
enable = true; enable = true;
adminpassFile = config.age.secrets."nextcloud/admin-pass".path;
}; };
nuage = { nuage = {

4
hosts/poseidon/secrets.nix
View file

@ -17,6 +17,10 @@
owner = "matrix-synapse"; owner = "matrix-synapse";
}; };
"nextcloud/admin-pass" = {
owner = "nextcloud";
};
"restic-backup/poseidon-credentials" = {}; "restic-backup/poseidon-credentials" = {};
"restic-backup/poseidon-password" = {}; "restic-backup/poseidon-password" = {};

BIN
modules/secrets/nextcloud/admin-pass.age Normal file
View file

Binary file not shown.

2
modules/secrets/secrets.nix
View file

@ -17,6 +17,8 @@ in
"matrix-synapse/secret-config.age".publicKeys = [ poseidon ]; "matrix-synapse/secret-config.age".publicKeys = [ poseidon ];
"nextcloud/admin-pass.age".publicKeys = [ poseidon ];
"restic-backup/boreal-password.age".publicKeys = [ alarsyo boreal ]; "restic-backup/boreal-password.age".publicKeys = [ alarsyo boreal ];
"restic-backup/boreal-credentials.age".publicKeys = [ alarsyo boreal ]; "restic-backup/boreal-credentials.age".publicKeys = [ alarsyo boreal ];
"restic-backup/poseidon-password.age".publicKeys = [ alarsyo poseidon ]; "restic-backup/poseidon-password.age".publicKeys = [ alarsyo poseidon ];

2
secrets/default.nix
View file

@ -11,8 +11,6 @@ in {
config.my.secrets = { config.my.secrets = {
miniflux-admin-credentials = fileContents ./miniflux-admin-credentials.secret; miniflux-admin-credentials = fileContents ./miniflux-admin-credentials.secret;
nextcloud-admin-pass = ./nextcloud-admin-pass.secret;
nextcloud-admin-user = fileContents ./nextcloud-admin-user.secret;
paperless = import ./paperless { inherit lib; }; paperless = import ./paperless { inherit lib; };
}; };

BIN
secrets/nextcloud-admin-pass.secret
View file

Binary file not shown.

BIN
secrets/nextcloud-admin-user.secret
View file

Binary file not shown.

15
services/nextcloud.nix
View file

@ -6,6 +6,7 @@ let
inherit (lib) inherit (lib)
mkEnableOption mkEnableOption
mkIf mkIf
mkOption
; ;
cfg = config.my.services.nextcloud; cfg = config.my.services.nextcloud;
@ -14,8 +15,16 @@ let
dbName = "nextcloud"; dbName = "nextcloud";
in in
{ {
options.my.services.nextcloud = { options.my.services.nextcloud = let inherit (lib) types; in {
enable = mkEnableOption "NextCloud"; enable = mkEnableOption "NextCloud";
adminpassFile = mkOption {
type = types.path;
description = ''
Path to a file containing the admin's password, must be readable by
'nextcloud' user.
'';
};
}; };
config = mkIf cfg.enable { config = mkIf cfg.enable {
@ -62,8 +71,8 @@ in
dbname = dbName; dbname = dbName;
dbhost = "/run/postgresql"; dbhost = "/run/postgresql";
adminuser = my.secrets.nextcloud-admin-user; adminuser = "admin";
adminpassFile = "${my.secrets.nextcloud-admin-pass}"; adminpassFile = cfg.adminpassFile;
}; };
}; };