danvics/selfhostblocks
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

pinchflat: use temp dir to store secret

Browse source
This commit is contained in:
ibizaman 2025-09-23 08:49:57 +02:00 committed by Pierre Penninckx
parent 5b31645afa
commit c6ad91fb35
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
modules/services/pinchflat.nix
View file

@ -123,14 +123,14 @@ in
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
systemd.tmpfiles.rules = [ systemd.tmpfiles.rules = [
"d '/etc/pinchflat' 0750 root root - -" "d '/run/pinchflat' 0750 root root - -"
]; ];
# Pinchflat relies on the global value so for now this is the only way to pass the option in. # Pinchflat relies on the global value so for now this is the only way to pass the option in.
time.timeZone = lib.mkDefault cfg.timeZone; time.timeZone = lib.mkDefault cfg.timeZone;
services.pinchflat = { services.pinchflat = {
inherit (cfg) enable port mediaDir; inherit (cfg) enable port mediaDir;
secretsFile = "/etc/pinchflat/secrets.env"; secretsFile = "/run/pinchflat/secrets.env";
extraConfig = { extraConfig = {
ENABLE_PROMETHEUS = true; ENABLE_PROMETHEUS = true;
# TZ = "as"; # I consider where you live to be sensible so it should be passed as a secret. # TZ = "as"; # I consider where you live to be sensible so it should be passed as a secret.
@ -148,7 +148,7 @@ in
SECRET_KEY_BASE.source = cfg.secretKeyBase.result.path; SECRET_KEY_BASE.source = cfg.secretKeyBase.result.path;
# TZ = cfg.secretKeyBase.result.path; # Uncomment when PR is merged. # TZ = cfg.secretKeyBase.result.path; # Uncomment when PR is merged.
}; };
resultPath = "/etc/pinchflat/secrets.env"; resultPath = "/run/pinchflat/secrets.env";
generator = shblib.toEnvVar; generator = shblib.toEnvVar;
}; };
serviceConfig.Type = "oneshot"; serviceConfig.Type = "oneshot";