jet/extremist-software
jet/extremist-software
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: migrate to agenix for secret management

Browse source
This commit is contained in:
Jet Pham 2026-03-05 15:10:30 -08:00
parent e7e8d154aa
commit 8e174ba500
No known key found for this signature in database
23 changed files with 234 additions and 120 deletions
Download patch file Download diff file Expand all files Collapse all files

18
modules/ntfy.nix
View file

@ -1,4 +1,4 @@
{ config, pkgs, ... }:
{ config, pkgs, lib, ... }:
{
services.ntfy-sh = {
@ -10,12 +10,22 @@
auth-file = "/var/lib/ntfy-sh/user.db";
auth-default-access = "deny-all";
enable-login = true;
auth-users = [
"jet:${config.mySecrets.ntfyAdminHash}:admin"
];
auth-access = [
"*:up*:write-only"
];
};
};
# Patch the generated config at runtime to inject the admin bcrypt hash
systemd.services.ntfy-sh = {
serviceConfig.RuntimeDirectory = "ntfy-sh";
serviceConfig.ExecStartPre = let
script = pkgs.writeShellScript "ntfy-patch-config" ''
cp /etc/ntfy/server.yml /run/ntfy-sh/server.yml
HASH=$(cat ${config.age.secrets.ntfy-admin-hash.path})
printf '\nauth-users:\n - "jet:%s:admin"\n' "$HASH" >> /run/ntfy-sh/server.yml
'';
in [ "+${script}" ];
serviceConfig.ExecStart = lib.mkForce "${pkgs.ntfy-sh}/bin/ntfy serve --config /run/ntfy-sh/server.yml";
};
}