b1e13e9415
Each secret file to be deployed is now backed by one local file. This simplifies 'setup-secrets' and the secret definitions. Also, with the old format it was not possible to add new secrets to secrets.nix in a simple way. Old secrets are automatically converted to the new format when running nix-shell. Using the new option 'nix-bitcoin.secrets', secrets are now directly defined by the services that use them.
32 lines
1.1 KiB
Nix
32 lines
1.1 KiB
Nix
{
|
|
network.description = "Bitcoin Core node";
|
|
|
|
bitcoin-node =
|
|
{ config, pkgs, lib, ... }: {
|
|
imports = [ ../configuration.nix ];
|
|
|
|
deployment.keys = builtins.mapAttrs (n: v: {
|
|
keyFile = "${toString ../secrets}/${n}";
|
|
destDir = "/secrets/";
|
|
inherit (v) user group permissions;
|
|
}) config.nix-bitcoin.secrets;
|
|
|
|
# nixops makes the secrets directory accessible only for users with group 'key'.
|
|
# For compatibility with other deployment methods besides nixops, we forego the
|
|
# use of the 'key' group and make the secrets dir world-readable instead.
|
|
# This is safe because all containing files have their specific private
|
|
# permissions set.
|
|
systemd.services.allowSecretsDirAccess = {
|
|
requires = [ "keys.target" ];
|
|
after = [ "keys.target" ];
|
|
script = "chmod o+x /secrets";
|
|
serviceConfig.Type = "oneshot";
|
|
};
|
|
|
|
systemd.targets.nix-bitcoin-secrets = {
|
|
requires = [ "allowSecretsDirAccess.service" ];
|
|
after = [ "allowSecretsDirAccess.service" ];
|
|
};
|
|
};
|
|
}
|