nico/dots
2
2
Fork 1
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

services: move all secrets into /media/secrets

Browse source 
moves all secrets into one centralised location in
/media/secrets and uses systemd-tmpfiles to set the
appropriate permissions for them
This commit is contained in:
Nico 2026-02-15 22:58:48 +11:00
parent 0dc8c93281
commit 93f912d548
Signed by: nico
SSH key fingerprint: SHA256:XuacYOrGqRxC3jVFjfLROn1CSvLz85Dec6N7O9Gwu/0
6 changed files with 35 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

6
modules/services/miniflux.nix
View file

@ -10,7 +10,7 @@
# OAUTH2_CLIENT_ID = "<client ID>";
# OAUTH2_CLIENT_SECRET = "<client secret>";
# https://pocket-id.org/docs/client-examples/miniflux/
adminCredentialsFile = /var/lib/miniflux/oidc;
adminCredentialsFile = /media/secrets/miniflux;
config = {
LISTEN_ADDR = "0.0.0.0:8021";
@ -44,6 +44,10 @@
};
};
systemd.tmpfiles.rules = [
"f /media/secrets/miniflux 0400 root root"
];
services.caddy.virtualHosts."rss.${config.homelab.domain}" = {
useACMEHost = config.homelab.domain;
extraConfig = ''