Skip to content

Commit a940a4f

Browse files
kiriwalawrenkiriwalawren
authored
change _secrets usage (#149)
1 parent 2bb4c58 commit a940a4f

20 files changed

Lines changed: 138 additions & 369 deletions

‎docs/examples/basic-setup.md‎

Lines changed: 21 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -54,16 +54,16 @@ This example shows a working media server configuration based on a real producti
5454
sonarr = {
5555
enable = true;
5656
config = {
57-
apiKey = {_secret = config.sops.secrets."sonarr/api_key".path;};
58-
hostConfig.password = {_secret = config.sops.secrets."sonarr/password".path;};
57+
apiKey._secret = config.sops.secrets."sonarr/api_key".path;
58+
hostConfig.password._secret = config.sops.secrets."sonarr/password".path;
5959
};
6060
};
6161
6262
radarr = {
6363
enable = true;
6464
config = {
65-
apiKey = {_secret = config.sops.secrets."radarr/api_key".path;};
66-
hostConfig.password = {_secret = config.sops.secrets."radarr/password".path;};
65+
apiKey._secret = config.sops.secrets."radarr/api_key".path;
66+
hostConfig.password._secret = config.sops.secrets."radarr/password".path;
6767
};
6868
};
6969
@@ -75,28 +75,28 @@ This example shows a working media server configuration based on a real producti
7575
lidarr = {
7676
enable = true;
7777
config = {
78-
apiKey = {_secret = config.sops.secrets."lidarr/api_key".path;};
79-
hostConfig.password = {_secret = config.sops.secrets."lidarr/password".path;};
78+
apiKey._secret = config.sops.secrets."lidarr/api_key".path;
79+
hostConfig.password._secret = config.sops.secrets."lidarr/password".path;
8080
};
8181
};
8282
8383
prowlarr = {
8484
enable = true;
8585
config = {
86-
apiKey = {_secret = config.sops.secrets."prowlarr/api_key".path;};
87-
hostConfig.password = {_secret = config.sops.secrets."prowlarr/password".path;};
86+
apiKey._secret = config.sops.secrets."prowlarr/api_key".path;
87+
hostConfig.password._secret = config.sops.secrets."prowlarr/password".path;
8888
indexers = [
8989
{
9090
name = "DrunkenSlug";
91-
apiKey = {_secret = config.sops.secrets."indexer-api-keys/DrunkenSlug".path;};
91+
apiKey._secret = config.sops.secrets."indexer-api-keys/DrunkenSlug".path;
9292
}
9393
{
9494
name = "NZBFinder";
95-
apiKey = {_secret = config.sops.secrets."indexer-api-keys/NZBFinder".path;};
95+
apiKey._secret = config.sops.secrets."indexer-api-keys/NZBFinder".path;
9696
}
9797
{
9898
name = "NzbPlanet";
99-
apiKey = {_secret = config.sops.secrets."indexer-api-keys/NzbPlanet".path;};
99+
apiKey._secret = config.sops.secrets."indexer-api-keys/NzbPlanet".path;
100100
}
101101
];
102102
};
@@ -107,18 +107,17 @@ This example shows a working media server configuration based on a real producti
107107
108108
settings = {
109109
misc = {
110-
api_key = {_secret = config.sops.secrets."sabnzbd/api_key".path;};
111-
nzb_key = {_secret = config.sops.secrets."sabnzbd/nzb_key".path;};
110+
api_key._secret = config.sops.secrets."sabnzbd/api_key".path;
111+
nzb_key._secret = config.sops.secrets."sabnzbd/nzb_key".path;
112112
};
113113
114114
servers = [
115115
{
116116
name = "Eweka";
117117
host = "sslreader.eweka.nl";
118118
port = 563;
119-
# Secrets use { _secret = /path; } syntax
120-
username = {_secret = config.sops.secrets."usenet/eweka/username".path;};
121-
password = {_secret = config.sops.secrets."usenet/eweka/password".path;};
119+
username._secret = config.sops.secrets."usenet/eweka/username".path;
120+
password._secret = config.sops.secrets."usenet/eweka/password".path;
122121
connections = 20;
123122
ssl = true;
124123
priority = 0;
@@ -128,8 +127,8 @@ This example shows a working media server configuration based on a real producti
128127
name = "NewsgroupDirect";
129128
host = "news.newsgroupdirect.com";
130129
port = 563;
131-
username = {_secret = config.sops.secrets."usenet/newsgroupdirect/username".path;};
132-
password = {_secret = config.sops.secrets."usenet/newsgroupdirect/password".path;};
130+
username._secret = config.sops.secrets."usenet/newsgroupdirect/username".path;
131+
password._secret = config.sops.secrets."usenet/newsgroupdirect/password".path;
133132
connections = 10;
134133
ssl = true;
135134
priority = 1;
@@ -142,24 +141,24 @@ This example shows a working media server configuration based on a real producti
142141
143142
jellyfin = {
144143
enable = true;
145-
apiKey = {_secret = config.sops.secrets."jellyfin/api_key".path;};
144+
apiKey._secret = config.sops.secrets."jellyfin/api_key".path;
146145
users = {
147146
admin = {
148147
mutable = false;
149148
policy.isAdministrator = true;
150-
password = {_secret = config.sops.secrets."jellyfin/alice_password".path;};
149+
password._secret = config.sops.secrets."jellyfin/alice_password".path;
151150
};
152151
};
153152
};
154153
155154
seerr = {
156155
enable = true;
157-
apiKey = {_secret = config.sops.secrets."seerr/api_key".path;};
156+
apiKey._secret = config.sops.secrets."seerr/api_key".path;
158157
};
159158
160159
mullvad = {
161160
enable = true;
162-
accountNumber = {_secret = config.sops.secrets.mullvad-account-number.path;};
161+
accountNumber._secret = config.sops.secrets.mullvad-account-number.path;
163162
location = ["us" "nyc"];
164163
dns = [
165164
"94.140.14.14"

‎modules/jellyfin/options/users.nix‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -464,9 +464,7 @@ in
464464
type = with types; attrsOf (submodule userOpts);
465465
example = {
466466
admin = {
467-
password = {
468-
_secret = "/run/secrets/jellyfin-admin-password";
469-
};
467+
password._secret = "/run/secrets/jellyfin-admin-password";
470468
policy = {
471469
isAdministrator = true;
472470
};

‎modules/seerr/default.nix‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -79,13 +79,11 @@ in
7979
systemd.tmpfiles.settings."10-seerr" = {
8080
"/run/seerr".d = {
8181
mode = "0755";
82-
inherit (cfg) user;
83-
inherit (cfg) group;
82+
inherit (cfg) user group;
8483
};
85-
"${cfg.dataDir}".d = {
84+
${cfg.dataDir}.d = {
8685
mode = "0755";
87-
inherit (cfg) user;
88-
inherit (cfg) group;
86+
inherit (cfg) user group;
8987
};
9088
};
9189

‎modules/seerr/options/radarr.nix‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -119,16 +119,12 @@ in
119119
'';
120120
example = {
121121
Radarr = {
122-
apiKey = {
123-
_secret = "/run/secrets/radarr-apikey";
124-
};
122+
apiKey._secret = "/run/secrets/radarr-apikey";
125123
activeProfileName = "HD-1080p";
126124
activeDirectory = "/movies";
127125
};
128126
"Radarr 4K" = {
129-
apiKey = {
130-
_secret = "/run/secrets/radarr-4k-apikey";
131-
};
127+
apiKey._secret = "/run/secrets/radarr-4k-apikey";
132128
activeProfileName = "UHD-2160p";
133129
activeDirectory = "/movies-4k";
134130
is4k = true;

‎modules/seerr/radarrService.nix‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,7 @@ let
2424
radarrName: radarrCfg:
2525
let
2626
jqRadarrSecrets = secrets.mkJqSecretArgs {
27-
apiKey = {
28-
_secret = "/run/credentials/seerr-radarr.service/radarr-${sanitizeName radarrName}-apikey";
29-
};
27+
apiKey._secret = "/run/credentials/seerr-radarr.service/radarr-${sanitizeName radarrName}-apikey";
3028
};
3129
in
3230
''

‎modules/seerr/sonarrService.nix‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,7 @@ let
2424
sonarrName: sonarrCfg:
2525
let
2626
jqSonarrSecrets = secrets.mkJqSecretArgs {
27-
apiKey = {
28-
_secret = "/run/credentials/seerr-sonarr.service/sonarr-${sanitizeName sonarrName}-apikey";
29-
};
27+
apiKey._secret = "/run/credentials/seerr-sonarr.service/sonarr-${sanitizeName sonarrName}-apikey";
3028
};
3129
in
3230
''

‎tests/unit-tests/default.nix‎

Lines changed: 22 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -49,13 +49,9 @@ in
4949
hostConfig = {
5050
port = 8989;
5151
username = "admin";
52-
password = {
53-
_secret = "/run/secrets/sonarr-pass";
54-
};
55-
};
56-
apiKey = {
57-
_secret = "/run/secrets/sonarr-api";
52+
password._secret = "/run/secrets/sonarr-pass";
5853
};
54+
apiKey._secret = "/run/secrets/sonarr-api";
5955
rootFolders = [ { path = "/media/tv"; } ];
6056
};
6157
};
@@ -82,13 +78,9 @@ in
8278
hostConfig = {
8379
port = 8990;
8480
username = "admin";
85-
password = {
86-
_secret = "/run/secrets/sonarr-pass";
87-
};
88-
};
89-
apiKey = {
90-
_secret = "/run/secrets/sonarr-api";
81+
password._secret = "/run/secrets/sonarr-pass";
9182
};
83+
apiKey._secret = "/run/secrets/sonarr-api";
9284
rootFolders = [ { path = "/media/anime"; } ];
9385
};
9486
};
@@ -117,13 +109,9 @@ in
117109
hostConfig = {
118110
port = 7878;
119111
username = "admin";
120-
password = {
121-
_secret = "/run/secrets/radarr-pass";
122-
};
123-
};
124-
apiKey = {
125-
_secret = "/run/secrets/radarr-api";
112+
password._secret = "/run/secrets/radarr-pass";
126113
};
114+
apiKey._secret = "/run/secrets/radarr-api";
127115
rootFolders = [ { path = "/media/movies"; } ];
128116
};
129117
};
@@ -149,19 +137,13 @@ in
149137
hostConfig = {
150138
port = 9696;
151139
username = "admin";
152-
password = {
153-
_secret = "/run/secrets/prowlarr-pass";
154-
};
155-
};
156-
apiKey = {
157-
_secret = "/run/secrets/prowlarr-api";
140+
password._secret = "/run/secrets/prowlarr-pass";
158141
};
142+
apiKey._secret = "/run/secrets/prowlarr-api";
159143
indexers = [
160144
{
161145
name = "1337x";
162-
apiKey = {
163-
_secret = "/run/secrets/1337x-api";
164-
};
146+
apiKey._secret = "/run/secrets/1337x-api";
165147
}
166148
];
167149
};
@@ -187,12 +169,8 @@ in
187169
downloadsDir = "/downloads/usenet";
188170
settings = {
189171
misc = {
190-
api_key = {
191-
_secret = pkgs.writeText "sabnzbd-apikey" "testapikey123456789abcdef";
192-
};
193-
nzb_key = {
194-
_secret = pkgs.writeText "sabnzbd-nzbkey" "testnzbkey123456789abcdef";
195-
};
172+
api_key._secret = pkgs.writeText "sabnzbd-apikey" "testapikey123456789abcdef";
173+
nzb_key._secret = pkgs.writeText "sabnzbd-nzbkey" "testnzbkey123456789abcdef";
196174
port = 8080;
197175
host = "127.0.0.1";
198176
url_base = "/sabnzbd";
@@ -205,12 +183,8 @@ in
205183
name = "TestServer";
206184
host = "news.example.com";
207185
port = 563;
208-
username = {
209-
_secret = pkgs.writeText "eweka-username" "testuser";
210-
};
211-
password = {
212-
_secret = pkgs.writeText "eweka-password" "testpass123";
213-
};
186+
username._secret = pkgs.writeText "eweka-username" "testuser";
187+
password._secret = pkgs.writeText "eweka-password" "testpass123";
214188
connections = 10;
215189
ssl = true;
216190
priority = 0;
@@ -251,9 +225,7 @@ in
251225
enable = true;
252226
seerr = {
253227
enable = true;
254-
apiKey = {
255-
_secret = "/run/secrets/seerr-api";
256-
};
228+
apiKey._secret = "/run/secrets/seerr-api";
257229
jellyfin = {
258230
adminUsername = "remoteadmin";
259231
adminPassword = "remotepassword";
@@ -294,13 +266,9 @@ in
294266
hostConfig = {
295267
port = 7878;
296268
username = "admin";
297-
password = {
298-
_secret = "/run/secrets/radarr-pass";
299-
};
300-
};
301-
apiKey = {
302-
_secret = "/run/secrets/radarr-api";
269+
password._secret = "/run/secrets/radarr-pass";
303270
};
271+
apiKey._secret = "/run/secrets/radarr-api";
304272
rootFolders = [ { path = "/media/movies"; } ];
305273
};
306274
};
@@ -312,13 +280,9 @@ in
312280
hostConfig = {
313281
port = 8989;
314282
username = "admin";
315-
password = {
316-
_secret = "/run/secrets/sonarr-pass";
317-
};
318-
};
319-
apiKey = {
320-
_secret = "/run/secrets/sonarr-api";
283+
password._secret = "/run/secrets/sonarr-pass";
321284
};
285+
apiKey._secret = "/run/secrets/sonarr-api";
322286
rootFolders = [ { path = "/media/shows"; } ];
323287
};
324288
};
@@ -330,13 +294,9 @@ in
330294
hostConfig = {
331295
port = 8990;
332296
username = "admin";
333-
password = {
334-
_secret = "/run/secrets/sonarr-anime-pass";
335-
};
336-
};
337-
apiKey = {
338-
_secret = "/run/secrets/sonarr-anime-api";
297+
password._secret = "/run/secrets/sonarr-anime-pass";
339298
};
299+
apiKey._secret = "/run/secrets/sonarr-anime-api";
340300
rootFolders = [ { path = "/media/anime"; } ];
341301
};
342302
};
@@ -348,13 +308,9 @@ in
348308
hostConfig = {
349309
port = 8686;
350310
username = "admin";
351-
password = {
352-
_secret = "/run/secrets/lidarr-pass";
353-
};
354-
};
355-
apiKey = {
356-
_secret = "/run/secrets/lidarr-api";
311+
password._secret = "/run/secrets/lidarr-pass";
357312
};
313+
apiKey._secret = "/run/secrets/lidarr-api";
358314
rootFolders = [ { path = "/media/music"; } ];
359315
};
360316
};

0 commit comments

Comments
 (0)