CCCHH/nix-infra
CCCHH/nix-infra
2
3
Fork 2
Code Issues 1 Pull requests 1 Wiki Activity

Switch the matrix hosts secret management from colmena to sops-nix

Browse source
This commit is contained in:
June 2024-05-26 02:58:15 +02:00
commit 154edc1972
Signed by: june
SSH key fingerprint: SHA256:o9EAq4Y9N9K0pBQeBTqhSDrND5E7oB+60ZNx0U1yPe0
6 changed files with 265 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

16
config/hosts/matrix/matrix-synapse.nix
View file

@ -44,20 +44,16 @@
};
extraConfigFiles = [
"/secrets/matrix-registration-shared-secret.secret"
"/run/secrets/matrix_registration_shared_secret"
];
};
systemd.services.matrix-synapse.serviceConfig.ReadWritePaths = [ config.services.matrix-synapse.settings.media_store_path ];
deployment.keys = {
"matrix-registration-shared-secret.secret" = {
keyCommand = [ "pass" "noc/vm-secrets/chaosknoten/matrix/registration-shared-secret" ];
destDir = "/secrets";
user = "matrix-synapse";
group = "matrix-synapse";
permissions = "0640";
uploadAt = "pre-activation";
};
sops.secrets."matrix_registration_shared_secret" = {
mode = "0440";
owner = "matrix-synapse";
group = "matrix-synapse";
restartUnits = [ "matrix-synapse.service" ];
};
}