diff options
| -rw-r--r-- | krebs/3modules/repo-sync.nix | 26 |
1 files changed, 10 insertions, 16 deletions
diff --git a/krebs/3modules/repo-sync.nix b/krebs/3modules/repo-sync.nix index 488cc4dd8..c4cfb9a49 100644 --- a/krebs/3modules/repo-sync.nix +++ b/krebs/3modules/repo-sync.nix @@ -122,13 +122,9 @@ let }; privateKeyFile = mkOption { - type = types.secret-file; - default = { - name = "repo-sync-key"; - path = "${cfg.stateDir}/ssh.priv"; - owner = cfg.user; - source-path = toString <secrets> + "/repo-sync.ssh.key"; - }; + type = types.absolute-pathname; + default = toString <secrets> + "/repo-sync.ssh.key"; + defaultText = "‹secrets/repo-sync.ssh.key›"; }; unitConfig = mkOption { @@ -144,7 +140,6 @@ let }; imp = { - krebs.secret.files.repo-sync-key = cfg.privateKeyFile; users.users.${cfg.user.name} = { inherit (cfg.user) home name uid; createHome = true; @@ -163,6 +158,10 @@ let } ) cfg.repos; + krebs.systemd.services = mapAttrs' (name: _: + nameValuePair "repo-sync-${name}" {} + ) cfg.repos; + systemd.services = mapAttrs' (name: repo: let repo-sync-config = pkgs.writeJSON "repo-sync-config-${name}.json" @@ -171,16 +170,10 @@ let }); in nameValuePair "repo-sync-${name}" { description = "repo-sync"; - after = [ - config.krebs.secret.files.repo-sync-key.service - "network.target" - ]; - partOf = [ - config.krebs.secret.files.repo-sync-key.service - ]; + after = [ "network.target" ]; environment = { - GIT_SSH_COMMAND = "${pkgs.openssh}/bin/ssh -i ${cfg.privateKeyFile.path}"; + GIT_SSH_COMMAND = "${pkgs.openssh}/bin/ssh -i $CREDENTIALS_DIRECTORY/ssh_key"; REPONAME = "${name}.git"; }; @@ -188,6 +181,7 @@ let serviceConfig = { Type = "simple"; PermissionsStartOnly = true; + LoadCredential = "ssh_key:${cfg.privateKeyFile}"; ExecStart = "${pkgs.repo-sync}/bin/repo-sync ${repo-sync-config}"; WorkingDirectory = cfg.stateDir; User = "repo-sync"; |