nix

commit c4618fc603e8705a322de873275c4f082c9c79b5
parent 88f136b62180ab3ce6bcdf31de0929017a17330f
Author: mtmn <miro@haravara.org>
Date:   Sun, 26 Apr 2026 01:40:36 +0200

fix: store shirts in secrets

Diffstat:
M
hosts/nixaran/configuration.nix
 | 
0

M
modules/services/shirt-linkener.nix
 | 
11
+++++++----
M
secrets.nix
 | 
1
+
A
secrets/shirt-linkener-auth-token.age
 | 
0

4 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/hosts/nixaran/configuration.nix b/hosts/nixaran/configuration.nix
Binary files differ.
diff --git a/modules/services/shirt-linkener.nix b/modules/services/shirt-linkener.nix
@@ -43,8 +43,8 @@ in {
       type = lib.types.str;
     };
 
-    authToken = lib.mkOption {
-      type = lib.types.str;
+    authTokenFile = lib.mkOption {
+      type = lib.types.path;
     };
 
     domain = lib.mkOption {
@@ -63,7 +63,6 @@ in {
         HOST = cfg.host;
         ERL_EPMD_ADDRESS = "127.0.0.1";
         BASE_URL = cfg.baseUrl;
-        AUTH_TOKEN = cfg.authToken;
         DB_PATH = "/var/lib/shirt-linkener/shortener.db";
         RELEASE_COOKIE = "shirt-linkener-cookie";
         RELEASE_NODE = "shirt-linkener@localhost";
@@ -73,7 +72,11 @@ in {
 
       serviceConfig = {
         Type = "simple";
-        ExecStart = "${shirt-linkener}/bin/shortener start";
+        LoadCredential = "auth_token:${toString cfg.authTokenFile}";
+        ExecStart = pkgs.writeShellScript "shirt-linkener-start" ''
+          export AUTH_TOKEN=$(cat "$CREDENTIALS_DIRECTORY/auth_token")
+          exec ${shirt-linkener}/bin/shortener start
+        '';
         ExecStop = "${shirt-linkener}/bin/shortener stop";
         Restart = "always";
         RestartSec = "5s";
diff --git a/secrets.nix b/secrets.nix
@@ -19,4 +19,5 @@ in {
   "secrets/corpus.age".publicKeys = allKeys;
   "secrets/smtp-alerts-password.age".publicKeys = allKeys;
   "secrets/radicale-htpasswd.age".publicKeys = allKeys;
+  "secrets/shirt-linkener-auth-token.age".publicKeys = allKeys;
 }
diff --git a/secrets/shirt-linkener-auth-token.age b/secrets/shirt-linkener-auth-token.age
Binary files differ.