secrets: move nextcloud secrets to agenix

hosts/poseidon/default.nix

@@ -117,6 +117,7 @@ in
 
     nextcloud = {
       enable = true;
+      adminpassFile = config.age.secrets."nextcloud/admin-pass".path;
     };
 
     nuage = {

hosts/poseidon/secrets.nix

@@ -17,6 +17,10 @@
             owner = "matrix-synapse";
           };
 
+          "nextcloud/admin-pass" = {
+            owner = "nextcloud";
+          };
+
           "restic-backup/poseidon-credentials" = {};
           "restic-backup/poseidon-password" = {};
 

modules/secrets/secrets.nix

@@ -17,6 +17,8 @@ in
 
   "matrix-synapse/secret-config.age".publicKeys = [ poseidon ];
 
+  "nextcloud/admin-pass.age".publicKeys = [ poseidon ];
+
   "restic-backup/boreal-password.age".publicKeys = [ alarsyo boreal ];
   "restic-backup/boreal-credentials.age".publicKeys = [ alarsyo boreal ];
   "restic-backup/poseidon-password.age".publicKeys = [ alarsyo poseidon ];

secrets/default.nix

@@ -11,8 +11,6 @@ in {
 
   config.my.secrets = {
     miniflux-admin-credentials = fileContents ./miniflux-admin-credentials.secret;
-    nextcloud-admin-pass = ./nextcloud-admin-pass.secret;
-    nextcloud-admin-user = fileContents ./nextcloud-admin-user.secret;
 
     paperless = import ./paperless { inherit lib; };
   };

services/nextcloud.nix

@@ -6,6 +6,7 @@ let
   inherit (lib)
     mkEnableOption
     mkIf
+    mkOption
   ;
 
   cfg = config.my.services.nextcloud;
@@ -14,8 +15,16 @@ let
   dbName = "nextcloud";
 in
 {
-  options.my.services.nextcloud = {
+  options.my.services.nextcloud = let inherit (lib) types; in {
     enable = mkEnableOption "NextCloud";
+
+    adminpassFile = mkOption {
+      type = types.path;
+      description = ''
+        Path to a file containing the admin's password, must be readable by
+        'nextcloud' user.
+      '';
+    };
   };
 
   config = mkIf cfg.enable {
@@ -62,8 +71,8 @@ in
         dbname = dbName;
         dbhost = "/run/postgresql";
 
-        adminuser = my.secrets.nextcloud-admin-user;
-        adminpassFile = "${my.secrets.nextcloud-admin-pass}";
+        adminuser = "admin";
+        adminpassFile = cfg.adminpassFile;
       };
     };