858a07f613
The secret existed (secrets/forgejoToken.age, secrets.nix) but had no age.secrets declaration, so nothing exposed it at /run/agenix -- I had to decrypt it by hand with the blunix host key to use it for the calendar-web webhook setup. Wire it globally (owner drone, plain runtime path) like go-sendxmpp, so it's available on any host without that. Documented in secrets/README.md.
74 lines
1.5 KiB
Nix
74 lines
1.5 KiB
Nix
{ config, ... }: {
|
|
age.secrets.go-sendxmpp= {
|
|
file = ../../secrets/go-sendxmpp.age;
|
|
owner = "drone";
|
|
};
|
|
|
|
age.secrets.forgejoToken = {
|
|
file = ../../secrets/forgejoToken.age;
|
|
owner = "drone";
|
|
};
|
|
|
|
age.secrets.oidcForgejo= {
|
|
file = ../../secrets/oidcForgejo.age;
|
|
mode = "444";
|
|
# owner = "dex";
|
|
};
|
|
|
|
age.secrets.webdav= {
|
|
file = ../../secrets/webdav.age;
|
|
owner = "webdav";
|
|
};
|
|
|
|
age.secrets.oidcOauth2= {
|
|
file = ../../secrets/oidcOauth2.age;
|
|
};
|
|
|
|
age.secrets.oidcGTS= {
|
|
file = ../../secrets/oidcGTS.age;
|
|
owner = "gotosocial";
|
|
};
|
|
|
|
# GoToSocial needs the same OIDC secret in systemd EnvironmentFile format.
|
|
age.secrets.oidcGTSEnv = {
|
|
file = ../../secrets/oidcGTSEnv.age;
|
|
owner = "gotosocial";
|
|
};
|
|
|
|
age.secrets.oidcHeadscale= {
|
|
file = ../../secrets/oidcHeadscale.age;
|
|
owner = "headscale";
|
|
};
|
|
|
|
age.secrets.mailPW= {
|
|
file = ../../secrets/mailPW.age;
|
|
owner = "builder";
|
|
};
|
|
|
|
age.secrets.resticPW= {
|
|
file = ../../secrets/resticPW.age;
|
|
};
|
|
|
|
age.secrets.domain= {
|
|
file = ../../secrets/domain.age;
|
|
mode = "444";
|
|
};
|
|
|
|
|
|
age.secrets.bindPW= {
|
|
file = ../../secrets/bindPW.age;
|
|
owner = "prosody";
|
|
name = "${config.domain}.cfg.lua";
|
|
};
|
|
|
|
age.secrets.lldapAdmin= {
|
|
file = ../../secrets/lldapAdmin.age;
|
|
mode = "444";
|
|
};
|
|
|
|
age.secrets.traefik = {
|
|
file = ../../secrets/dns-challenge.age;
|
|
owner = "traefik";
|
|
path = "/var/lib/traefik/env";
|
|
};
|
|
}
|