From 96b949393cfa64f8b44e16d269d9148696e44299 Mon Sep 17 00:00:00 2001
From: Joe Mou <dev@mou.fo>
Date: Thu, 25 Apr 2024 12:58:55 -0400
Subject: elmo: Move secrets to /var/secrets

Clarifies that they are not managed by a distribution package.
---
 hostnix/elmo/dyndns.nix | 13 +++++++------
 hostnix/elmo/oidc.nix   |  4 ++--
 2 files changed, 9 insertions(+), 8 deletions(-)

(limited to 'hostnix')

diff --git a/hostnix/elmo/dyndns.nix b/hostnix/elmo/dyndns.nix
index a59c665..bb396e2 100644
--- a/hostnix/elmo/dyndns.nix
+++ b/hostnix/elmo/dyndns.nix
@@ -5,7 +5,7 @@
   # Based on https://nixos.org/manual/nixos/stable/index.html#module-security-acme-config-dns
   systemd.services.sig0-keygen = {
     unitConfig = {
-      ConditionPathExists = "!/var/lib/secrets/${config.networking.fqdn}.id";
+      ConditionPathExists = "!/var/secrets/${config.networking.fqdn}.id";
     };
     serviceConfig = {
       Type = "oneshot";
@@ -13,9 +13,10 @@
     path = [ pkgs.bind ];
     scriptArgs = config.networking.fqdn;
     script = ''
-      mkdir -p /var/lib/secrets
-      chmod 755 /var/lib/secrets
-      cd /var/lib/secrets
+      mkdir -p /var/secrets
+      chmod 750 /var/secrets
+      chown :wheel /var/secrets
+      cd /var/secrets
       dnssec-keygen -a RSASHA512 -b 2048 -n HOST -T KEY $1. > $1.id
     '';
   };
@@ -24,7 +25,7 @@
     requires = [ "network-online.target" ];
     after = [ "network-online.target" ];
     unitConfig = {
-      AssertPathExists = "/var/lib/secrets/${config.networking.fqdn}.id";
+      AssertPathExists = "/var/secrets/${config.networking.fqdn}.id";
       # Defer errors for ~45min, throttle e-mails to ~hourly.
       StartLimitIntervalSec = "1hr";
       StartLimitBurst = "45";
@@ -56,7 +57,7 @@
         exit 0
       fi
 
-      nsupdate -v -k /var/lib/secrets/`< /var/lib/secrets/$1.id`.private <<.
+      nsupdate -v -k /var/secrets/`< /var/secrets/$1.id`.private <<.
       update delete $RR. A
       update add $RR. 300 A $IP4
       update delete $RR. AAAA
diff --git a/hostnix/elmo/oidc.nix b/hostnix/elmo/oidc.nix
index 7648e8c..bff769e 100644
--- a/hostnix/elmo/oidc.nix
+++ b/hostnix/elmo/oidc.nix
@@ -3,7 +3,7 @@
 {
   services.keycloak = {
     enable = true;
-    database.passwordFile = "/var/lib/secrets/keycloak.dbpass";
+    database.passwordFile = "/var/secrets/keycloak.dbpass";
     settings = {
       hostname = "kc.elmo.mou.fo";
       http-host = "127.0.0.1";
@@ -41,7 +41,7 @@
     provider = "keycloak-oidc";
     clientID = "oauth2-proxy";
     # Sets OAUTH2_PROXY_COOKIE_SECRET and OAUTH2_PROXY_CLIENT_SECRET.
-    keyFile = "/var/lib/secrets/oauth2-proxy.env";
+    keyFile = "/var/secrets/oauth2-proxy.env";
     redirectURL = "https://kc.elmo.mou.fo/oauth2/callback";
     extraConfig = {
       "oidc-issuer-url" = "https://kc.elmo.mou.fo/realms/prod";
-- 
cgit v1.3.1