Configure website secrets as a nixpkgs option

Author: jhh

README.md

@@ -21,16 +21,10 @@ rclone -v sync s3://www.strykeforce.org/media/ ./media
 ```
 ## Server Management
 
-In production, look up the deployed derivation using `systemctl cat
-strykeforce-website` and run `manage.py` as user `strykeforce` with required
-environment variable set:
-
-```
-sudo -u strykeforce env \
-  DJANGO_SETTINGS_MODULE=website.settings.production \
-  TBA_READ_KEY= \
-  SECRET_KEY=<something> \
-  $NIX_STORE_PATH/bin/manage.py
+```sh
+# as root
+$ nix registry add strykeforce-manage "github:strykeforce/strykeforce.org"
+$ nix run strykeforce-manage
 ```
 
 

deploy/flake.nix

@@ -18,13 +18,14 @@
   };
 
   outputs =
-    { self
-    , agenix
-    , deploy-rs
-    , nixos-configs
-    , nixpkgs
-    , strykeforce
-    , ...
+    {
+      self,
+      agenix,
+      deploy-rs,
+      nixos-configs,
+      nixpkgs,
+      strykeforce,
+      ...
     }:
     let
       system = "x86_64-linux";
@@ -53,40 +54,43 @@
             ./rclone.nix
             agenix.nixosModules.default
             strykeforce.nixosModules.default
-            ({ config, pkgs, ... }: {
-              age.secrets.stryker_website_secrets = {
-                file = ./strykeforce_website_secrets.age;
-              };
+            (
+              { config, pkgs, ... }:
+              {
+                age.secrets.stryker_website_secrets = {
+                  file = ./strykeforce_website_secrets.age;
+                };
 
-              environment.systemPackages = with pkgs; [
-                goaccess
-                redli
-                strykeforce-manage
-              ];
+                environment.systemPackages = with pkgs; [
+                  goaccess
+                  redli
+                  strykeforce-manage
+                ];
 
-              strykeforce.services.website = {
-                inherit enable;
-                settingsModule = "website.settings.production";
-              };
+                strykeforce.services.website = {
+                  inherit enable;
+                  settingsModule = "website.settings.production";
+                  secrets = [ config.age.secrets.stryker_website_secrets.path ];
+                };
 
-              services.postgresql = {
-                inherit enable;
-                package = pkgs.postgresql_15;
-              };
+                services.postgresql = {
+                  inherit enable;
+                  package = pkgs.postgresql_15;
+                };
 
-              services.postgresqlBackup = {
-                inherit enable;
-                databases = [ "strykeforce" ];
-                pgdumpOptions = "--clean";
-              };
+                services.postgresqlBackup = {
+                  inherit enable;
+                  databases = [ "strykeforce" ];
+                  pgdumpOptions = "--clean";
+                };
 
-              security.acme.acceptTerms = true;
-              security.acme.defaults.email = "[email protected]";
-            })
+                security.acme.acceptTerms = true;
+                security.acme.defaults.email = "[email protected]";
+              }
+            )
           ];
         };
 
-
       deploy.nodes =
         let
           sshUser = "root";

lib/module.nix

@@ -26,6 +26,15 @@ in
       default = "website.settings.production";
     };
 
+    secrets = lib.mkOption {
+      type = with lib.types; listOf path;
+      description = ''
+        A list of files containing the various secrets. Should be in the format
+        expected by systemd's `EnvironmentFile` directory.
+      '';
+      default = [ ];
+    };
+
     allowedHosts = lib.mkOption {
       type = lib.types.str;
       default = "strykeforce.org www.strykeforce.org";
@@ -67,7 +76,7 @@ in
         preStart = "${website}/bin/strykeforce-manage migrate --no-input";
 
         serviceConfig = {
-          EnvironmentFile = "/run/agenix/stryker_website_secrets";
+          EnvironmentFile = cfg.secrets;
           ExecStart = "${website}/bin/gunicorn --workers=5 --bind=127.0.0.1:8000 website.wsgi";
           User = "strykeforce";
           Restart = "on-failure";