Merge remote-tracking branch 'pnp/master'

1 files changed, 18 insertions, 14 deletions

diff --git a/makefu/2configs/bepasty-dual.nix b/makefu/2configs/bepasty-dual.nix
index fb90f4c9f..123ae3cf9 100644
--- a/makefu/2configs/bepasty-dual.nix
+++ b/makefu/2configs/bepasty-dual.nix
@@ -11,7 +11,11 @@
 #   bepasty-secret.nix     <- contains single string
 
 with lib;
-{
+let
+  sec = toString <secrets>;
+  # secKey is nothing worth protecting on a local machine
+  secKey = import <secrets/bepasty-secret.nix>;
+in {
 
   krebs.nginx.enable = mkDefault true;
   krebs.bepasty = {
@@ -24,28 +28,28 @@ with lib;
           server-names = [ "paste.retiolum" "paste.${config.krebs.build.host.name}" ];
         };
         defaultPermissions = "admin,list,create,read,delete";
-        secretKey = import <secrets/bepasty-secret.nix>;
+        secretKey = secKey;
       };
 
       external = {
         nginx = {
           server-names = [ "paste.krebsco.de" ];
           extraConfig = ''
-            ssl_session_cache    shared:SSL:1m;
-            ssl_session_timeout  10m;
-            ssl_certificate     /root/secrets/wildcard.krebsco.de.crt;
-            ssl_certificate_key /root/secrets/wildcard.krebsco.de.key;
-            ssl_verify_client off;
-            proxy_ssl_session_reuse off;
-            ssl_protocols        TLSv1 TLSv1.1 TLSv1.2;
-            ssl_ciphers RC4:HIGH:!aNULL:!MD5;
-            ssl_prefer_server_ciphers on;
-            if ($scheme = http){
-              return 301 https://$server_name$request_uri;
+          ssl_session_cache    shared:SSL:1m;
+          ssl_session_timeout  10m;
+          ssl_certificate     ${sec}/wildcard.krebsco.de.crt;
+          ssl_certificate_key ${sec}/wildcard.krebsco.de.key;
+          ssl_verify_client off;
+          proxy_ssl_session_reuse off;
+          ssl_protocols        TLSv1 TLSv1.1 TLSv1.2;
+          ssl_ciphers RC4:HIGH:!aNULL:!MD5;
+          ssl_prefer_server_ciphers on;
+          if ($scheme = http){
+            return 301 https://$server_name$request_uri;
           }'';
         };
         defaultPermissions = "read";
-        secretKey = import <secrets/bepasty-secret.nix>;
+        secretKey = secKey;
       };
     };
   };