greg/nix-bitcoin
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

extract module 'deployment/nixops.nix', add option 'deployment.secretsDir'

Browse Source
This commit is contained in:
Erik Arvstedt
2020-02-26 17:11:19 +01:00
committed by Jonas Nick
parent 87d0286498
commit 0c0978c007
3 changed files with 40 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
examples/nixops/node.nix
View File

@@ -1,31 +1,13 @@
{
network.description = "Bitcoin Core node";
bitcoin-node =
{ config, pkgs, lib, ... }: {
imports = [ ../configuration.nix <nix-bitcoin/modules/nix-bitcoin.nix> ];
bitcoin-node = { config, pkgs, lib, ... }: {
imports = [
../configuration.nix
<nix-bitcoin/modules/nix-bitcoin.nix>
<nix-bitcoin/modules/deployment/nixops.nix>
];
deployment.keys = builtins.mapAttrs (n: v: {
keyFile = "${toString ../secrets}/${n}";
destDir = config.nix-bitcoin.secretsDir;
inherit (v) user group permissions;
}) config.nix-bitcoin.secrets;
# nixops makes the secrets directory accessible only for users with group 'key'.
# For compatibility with other deployment methods besides nixops, we forego the
# use of the 'key' group and make the secrets dir world-readable instead.
# This is safe because all containing files have their specific private
# permissions set.
systemd.services.allowSecretsDirAccess = {
requires = [ "keys.target" ];
after = [ "keys.target" ];
script = "chmod o+x ${config.nix-bitcoin.secretsDir}";
serviceConfig.Type = "oneshot";
};
systemd.targets.nix-bitcoin-secrets = {
requires = [ "allowSecretsDirAccess.service" ];
after = [ "allowSecretsDirAccess.service" ];
};
};
nix-bitcoin.deployment.secretsDir = toString ../secrets;
};
}