about summary refs log tree commit diff
path: root/users/grfn/system
diff options
context:
space:
mode:
authorGriffin Smith <grfn@gws.fyi>2021-12-26T20·11-0500
committerclbot <clbot@tvl.fyi>2021-12-27T03·46+0000
commit169d7fb87436603207e79cdcc9b51d84eb11e39e (patch)
tree3ef4cb8c97d25b414494935d73e459c2e75a354f /users/grfn/system
parentef62e51b7bc390d3b046b2eb1af0b44a2e771cbe (diff)
feat(grfn/mugwump): Set up agenix r/3454
Start setting up agenix with secrets in //users/grfn/secrets for
mugwump, starting with my cloudflare API key which I use for the ddns
from my home apartment

Change-Id: Ida66cb91da3415357a512039d6c23402f0ae9388
Reviewed-on: https://cl.tvl.fyi/c/depot/+/4683
Reviewed-by: grfn <grfn@gws.fyi>
Autosubmit: grfn <grfn@gws.fyi>
Tested-by: BuildkiteCI
Diffstat (limited to 'users/grfn/system')
-rw-r--r--users/grfn/system/system/machines/mugwump.nix11
1 files changed, 9 insertions, 2 deletions
diff --git a/users/grfn/system/system/machines/mugwump.nix b/users/grfn/system/system/machines/mugwump.nix
index 9ef428c2399b..d4e61b74a4c6 100644
--- a/users/grfn/system/system/machines/mugwump.nix
+++ b/users/grfn/system/system/machines/mugwump.nix
@@ -8,6 +8,7 @@ with lib;
     (modulesPath + "/installer/scan/not-detected.nix")
     "${depot.path}/ops/modules/prometheus-fail2ban-exporter.nix"
     "${depot.path}/users/grfn/xanthous/server/module.nix"
+    "${depot.third_party.agenix.src}/modules/age.nix"
   ];
 
   networking.hostName = "mugwump";
@@ -64,6 +65,12 @@ with lib;
 
   nix.gc.dates = "monthly";
 
+  age.secrets = let
+    secret = name: depot.users.grfn.secrets."${name}.age";
+  in {
+    cloudflare.file = secret "cloudflare";
+  };
+
   services.depot.auto-deploy = {
     enable = true;
     interval = "1d";
@@ -132,7 +139,7 @@ with lib;
   };
 
   systemd.services.ddclient.serviceConfig = {
-    EnvironmentFile = "/etc/secrets/cloudflare.env";
+    EnvironmentFile = "/run/agenix/cloudflare";
     DynamicUser = lib.mkForce false;
     ExecStart = lib.mkForce (
       let runtimeDir =
@@ -149,7 +156,7 @@ with lib;
 
   security.acme.certs."metrics.gws.fyi" = {
     dnsProvider = "cloudflare";
-    credentialsFile = "/etc/secrets/cloudflare.env";
+    credentialsFile = "/run/agenix/cloudflare";
     webroot = mkForce null;
   };