nico/dots
2
2
Fork 1
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

services: move all secrets into /media/secrets

Browse source 
moves all secrets into one centralised location in
/media/secrets and uses systemd-tmpfiles to set the
appropriate permissions for them
This commit is contained in:
Nico 2026-02-15 22:58:48 +11:00
parent 0dc8c93281
commit 93f912d548
Signed by: nico
SSH key fingerprint: SHA256:XuacYOrGqRxC3jVFjfLROn1CSvLz85Dec6N7O9Gwu/0
6 changed files with 35 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

7
modules/services/caddy.nix
View file

@ -33,6 +33,8 @@
security.acme = {
acceptTerms = true;
defaults.email = "hello@astolfo.org";
defaults.environmentFile = /media/secrets/acme;
defaults.profile = "shortlived";
certs."${config.homelab.domain}" = {
group = config.services.caddy.group;
@ -42,8 +44,11 @@
dnsProvider = "cloudflare";
dnsResolver = "1.1.1.1:53";
dnsPropagationCheck = true;
environmentFile = /var/lib/caddy/secret;
};
};
systemd.tmpfiles.rules = [
"f /media/secrets/acme 0400 acme acme"
];
};
}