6 files changed, 8 insertions, 9 deletions
diff --git a/krebs/2configs/shack/gitlab-runner.nix b/krebs/2configs/shack/gitlab-runner.nix
index d525e7987..a27fe29ae 100644
--- a/krebs/2configs/shack/gitlab-runner.nix
+++ b/krebs/2configs/shack/gitlab-runner.nix
@@ -1,4 +1,4 @@
-{ pkgs,lib, ... }:
+{ config, lib, pkgs, ... }:
 {
   boot.kernel.sysctl."net.ipv4.ip_forward" = true;
   services.gitlab-runner = {
@@ -10,7 +10,7 @@
         # File should contain at least these two variables:
         # `CI_SERVER_URL`
         # `REGISTRATION_TOKEN`
-        registrationConfigFile = toString <secrets/shackspace-gitlab-ci>;
+        registrationConfigFile = "${config.krebs.secret.directory}/shackspace-gitlab-ci";
         dockerImage = "alpine";
         dockerVolumes = [
           "/nix/store:/nix/store:ro"
diff --git a/krebs/2configs/shack/grafana.nix b/krebs/2configs/shack/grafana.nix
index f42f1c4af..78ef29f97 100644
--- a/krebs/2configs/shack/grafana.nix
+++ b/krebs/2configs/shack/grafana.nix
@@ -1,7 +1,6 @@
-let
+{ config, ... }: let
   port = 3000;
 in {
-
   networking.firewall.allowedTCPPorts = [ port ]; # legacy
   services.nginx.virtualHosts."grafana.shack" = {
     locations."/" = {
@@ -25,6 +24,6 @@ in {
     users.allowOrgCreate = true;
     users.autoAssignOrg = true;
     auth.anonymous.enable = true;
-    security = import <secrets/grafana_security.nix>;
+    security = import "${config.krebs.secret.directory}/grafana_security.nix";
   };
 }
diff --git a/krebs/2configs/shack/muell_caller.nix b/krebs/2configs/shack/muell_caller.nix
index f3007dd1d..ea335f233 100644
--- a/krebs/2configs/shack/muell_caller.nix
+++ b/krebs/2configs/shack/muell_caller.nix
@@ -21,7 +21,7 @@ let
       install -m755 -D call.py  $out/bin/call-muell
     '';
   };
-  cfg = "${toString <secrets>}/tell.json";
+  cfg = "${config.krebs.secret.directory}/tell.json";
 in {
   systemd.services.call_muell = {
     description = "call muell";
diff --git a/krebs/2configs/shack/muell_mail.nix b/krebs/2configs/shack/muell_mail.nix
index 2a8c92e46..69bc33e46 100644
--- a/krebs/2configs/shack/muell_mail.nix
+++ b/krebs/2configs/shack/muell_mail.nix
@@ -9,7 +9,7 @@ let
       sha256 = "0hgchwam5ma96s2v6mx2jfkh833psadmisjbm3k3153rlxp46frx";
     }) { mkYarnPackage = pkgs.yarn2nix-moretea.mkYarnPackage; };
     home = "/var/lib/muell_mail";
-    cfg = toString <secrets/shack/muell_mail.js>;
+    cfg = "${config.krebs.secret.directory}/shack/muell_mail.js";
 in {
   users.users.muell_mail = {
     inherit home;
diff --git a/krebs/2configs/shack/prometheus/unifi.nix b/krebs/2configs/shack/prometheus/unifi.nix
index 34e47add9..1e42779f0 100644
--- a/krebs/2configs/shack/prometheus/unifi.nix
+++ b/krebs/2configs/shack/prometheus/unifi.nix
@@ -5,6 +5,6 @@
     unifiAddress = "https://unifi.shack:8443/";
     unifiInsecure = true;
     unifiUsername = "prometheus"; # needed manual login after setup to confirm the password
-    unifiPassword = lib.replaceStrings ["\n"] [""] (builtins.readFile <secrets/shack/unifi-prometheus-pw>);
+    unifiPassword = lib.replaceStrings ["\n"] [""] (builtins.readFile "${config.krebs.secret.directory}/shack/unifi-prometheus-pw");
   };
 }
diff --git a/krebs/2configs/shack/s3-power.nix b/krebs/2configs/shack/s3-power.nix
index d8033f1e2..e79d15d73 100644
--- a/krebs/2configs/shack/s3-power.nix
+++ b/krebs/2configs/shack/s3-power.nix
@@ -10,7 +10,7 @@ let
     }) { mkYarnPackage = pkgs.yarn2nix-moretea.mkYarnPackage; };
 
     home = "/var/lib/s3-power";
-    cfg = toString <secrets/shack/s3-power.json>;
+    cfg = "${config.krebs.secret.directory}/shack/s3-power.json";
 in {
   users.users.s3_power = {
     inherit home;