From aac06551a3981798d58dc6eeadb940d85a241d46 Mon Sep 17 00:00:00 2001
From: Antoine Martin <antoine@alarsyo.net>
Date: Fri, 17 Jan 2025 17:09:53 +0100
Subject: [PATCH] hades: secret config for mealie
---
hosts/hades/default.nix | 1 +
hosts/hades/secrets.nix | 4 ++++
modules/secrets/mealie/secret-config.age | Bin 0 -> 480 bytes
modules/secrets/secrets.nix | 2 ++
services/mealie.nix | 12 ++++++++++++
5 files changed, 19 insertions(+)
create mode 100644 modules/secrets/mealie/secret-config.age
diff --git a/hosts/hades/default.nix b/hosts/hades/default.nix
index f2a4158..2b84d21 100644
--- a/hosts/hades/default.nix
+++ b/hosts/hades/default.nix
@@ -84,6 +84,7 @@ in {
mealie = {
enable = true;
port = 8090;
+ credentialsFile = config.age.secrets."mealie/secret-config".path;
};
microbin = {
diff --git a/hosts/hades/secrets.nix b/hosts/hades/secrets.nix
index a5df603..d0887e2 100644
--- a/hosts/hades/secrets.nix
+++ b/hosts/hades/secrets.nix
@@ -22,6 +22,10 @@
owner = "matrix-synapse";
};
+ "mealie/secret-config" = {
+ owner = "mealie";
+ };
+
"microbin/secret-config" = {};
"miniflux/admin-credentials" = {};
diff --git a/modules/secrets/mealie/secret-config.age b/modules/secrets/mealie/secret-config.age
new file mode 100644
index 0000000000000000000000000000000000000000..13931f70f5f251f969c84a1d4e2340aae2ff467a
GIT binary patch
literal 480
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCU7HcI!%Dp$xWvrNv8
zG|3Ck(9aAv_BJyL%1tS(2+7RNjm)U<EjIG?&Ce-FwkXWY4CT@f*N@7|HFxz1@F}Y>
zD62{fD>p4oE6PkX^fgG#@ii++Gcd{x(+<h^&PKPbAi|>3C|$uk-=w_C)5#}4w5T$<
zAUwh;$g(uV!%x2=DB0Z4Gsh{{EW*dcs3^-dIFc(pF*QBI(%-VA+^;Y*vZO4^Ju<*M
zS-aFUDXl0qBHT5@IMJ&l&AiIp-GWP3S687z-_75%%CaD%wA9oqH!IoOAgb8Wt31#@
zHPlSoEXB~Wps1qEupqb!sD5QpQN*8PRz;`64!uA9*|pVSiNEKh`-e+zMk+_B#CdV7
zapgVIyZS{|BG<E|`TMu@O`R<=K`x&`H1<g8My}Eu+8VbCxVskc3z=92&(yjcwcd5d
z@iV)A++f+Z`4sc#sVfipIMr@qd6@K~)#nmVR<6~JS6vUaA15yUm?`Wa|BqRhdwXTk
z2g_!itWyga5B)E?bnntd2K&<IOF#Yy-~4UiX2uh(FDz5`Gv6%i^lUAd_U6mNUu$(N
PYro8UF<s|(xa}7Jk7vQw
literal 0
HcmV?d00001
diff --git a/modules/secrets/secrets.nix b/modules/secrets/secrets.nix
index 452effa..c918355 100644
--- a/modules/secrets/secrets.nix
+++ b/modules/secrets/secrets.nix
@@ -22,6 +22,8 @@ in {
"matrix-synapse/secret-config.age".publicKeys = [alarsyo hades];
+ "mealie/secret-config.age".publicKeys = [alarsyo hades];
+
"microbin/secret-config.age".publicKeys = [alarsyo hades];
"miniflux/admin-credentials.age".publicKeys = [alarsyo hades];
diff --git a/services/mealie.nix b/services/mealie.nix
index 61baefe..0be80e3 100644
--- a/services/mealie.nix
+++ b/services/mealie.nix
@@ -29,11 +29,23 @@ in {
example = 8080;
description = "Internal port for Mealie webapp";
};
+ credentialsFile = lib.mkOption {
+ type = types.nullOr types.path;
+ default = null;
+ example = "/run/secrets/mealie-credentials.env";
+ description = ''
+ File containing credentials used in mealie such as {env}`POSTGRES_PASSWORD`
+ or sensitive LDAP options.
+
+ Expects the format of an `EnvironmentFile=`, as described by {manpage}`systemd.exec(5)`.
+ '';
+ };
};
config = mkIf cfg.enable {
services.mealie = {
inherit listenAddress;
+ inherit (cfg) credentialsFile;
enable = true;
package = pkgs.unstable.mealie;