Lillian-Violet/NixOS-Config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

set secret via systemd to avoid users entirely

Browse source
This commit is contained in:
Lillian Violet 2025-01-14 14:56:41 +01:00
parent 0fd416429e
commit 56690ad45f
2 changed files with 5 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

14
nixos/server/package-configs/mollysocket/default.nix
View file

@ -1,26 +1,16 @@
{config, ...}: let
mollySocketUser = "mollysocket";
in {
{config, ...}: {
sops.secrets."mollysocket-vapid-key".mode = "0440";
sops.secrets."mollysocket-vapid-key" = {
owner = mollySocketUser;
group = mollySocketUser;
};
services.mollysocket = {
enable = true;
environmentFile = config.sops.secrets."mollysocket-vapid-key".path;
settings = {
port = 4381;
vapid_key_file = config.sops.secrets."mollysocket-vapid-key".path;
allowed_endpoints = ["molly.gladtherescake.eu" "nextcloud.gladtherescake.eu"];
allowed_uuids = ["*"];
webserver = true;
};
};
systemd.services.mollysocket.serviceConfig = {
User = mollySocketUser;
Group = mollySocketUser;
};
services.nginx = {
virtualHosts = {
"molly.gladtherescake.eu" = {