From 374f2f364a3a5de5438dd310f6cb50490eae6f1e Mon Sep 17 00:00:00 2001 From: sefidel Date: Mon, 6 Feb 2023 18:16:38 +0900 Subject: feat: use sops for secret management --- nixos/cobalt/services/acme.nix | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) (limited to 'nixos/cobalt/services') diff --git a/nixos/cobalt/services/acme.nix b/nixos/cobalt/services/acme.nix index d28bfc7..58a5c77 100644 --- a/nixos/cobalt/services/acme.nix +++ b/nixos/cobalt/services/acme.nix @@ -1,7 +1,13 @@ +{ config, ... }: + let poorObfuscation = y: x: "${x}@${y}"; in { + sops.secrets.hetzner-dns-key = { + owner = "acme"; + }; + security.acme = { acceptTerms = true; defaults.email = poorObfuscation "sefidel.com" "postmaster"; @@ -14,7 +20,7 @@ in ]; dnsProvider = "hetzner"; dnsPropagationCheck = true; - credentialsFile = "/persist/secrets/hetzner.key"; + credentialsFile = config.sops.secrets.hetzner-dns-key.path; }; }; }; @@ -22,9 +28,4 @@ in environment.persistence."/persist".directories = [ "/var/lib/acme" ]; - - deployment.keys."hetzner.key" = { - keyCommand = [ "pass" "show" "server/hetzner-dns" ]; - destDir = "/persist/secrets"; - }; } -- cgit 1.4.1