From d4403638cf02d544d87a0ce9101ee5b18ff09d96 Mon Sep 17 00:00:00 2001
From: Vincent Ambo <mail@tazj.in>
Date: Fri, 10 Dec 2021 15:49:11 +0300
Subject: refactor(ops): Move irccat secret into agenix

The irccat module uses DynamicUser, so to grant permission to it a new
group has been added for irccat.

I have some vague memory of DynamicUser + Group not behaving as one
would expect, but we'll see what happens.

Change-Id: Iab9f6a3f1a53c4133b635458ce173250cc9a3fac
---
 ops/modules/irccat.nix | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

(limited to 'ops/modules/irccat.nix')

diff --git a/ops/modules/irccat.nix b/ops/modules/irccat.nix
index e4b30b73553e..9d3eea53c073 100644
--- a/ops/modules/irccat.nix
+++ b/ops/modules/irccat.nix
@@ -12,13 +12,13 @@ let
   # service launch.
   configJson = pkgs.writeText "irccat.json" (builtins.toJSON cfg.config);
   configMerge = pkgs.writeShellScript "merge-irccat-config" ''
-    if [ ! -f "/etc/secrets/irccat.json" ]; then
+    if [ ! -f "${cfg.secretsFile}" ]; then
       echo "irccat secrets file is missing"
       exit 1
     fi
 
     # jq's * is the recursive merge operator
-    ${pkgs.jq}/bin/jq -s '.[0] * .[1]' ${configJson} /etc/secrets/irccat.json \
+    ${pkgs.jq}/bin/jq -s '.[0] * .[1]' ${configJson} ${cfg.secretsFile} \
       > /var/lib/irccat/irccat.json
   '';
 in {
@@ -29,6 +29,12 @@ in {
       type = lib.types.attrs; # varying value types
       description = "Configuration structure (unchecked!)";
     };
+
+    secretsFile = lib.mkOption {
+      type = lib.types.str;
+      description = "Path to the secrets file to be merged";
+      default = "/run/agenix/irccat";
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -40,10 +46,14 @@ in {
 
       serviceConfig = {
         DynamicUser = true;
+        Group = "irccat";
         StateDirectory = "irccat";
         WorkingDirectory = "/var/lib/irccat";
         Restart = "always";
       };
     };
+
+    # Create a real group to grant access to secrets to.
+    users.groups.irccat = {};
   };
 }
-- 
cgit 1.4.1