refactor(nixos): let navidrome service handle secrets

configs/nixos/guests/navidrome.nix

@@ -7,6 +7,8 @@ let
   serviceConfig = config.containers.navidrome.config.modules.services.navidrome;
   lastfmApiKeySecret = "services/navidrome/lastfm/api-key";
   lastfmSecretSecret = "services/navidrome/lastfm/secret";
+  lastfmApiKeyFile = "/run/secrets/${lastfmApiKeySecret}";
+  lastfmSecretFile = "/run/secrets/${lastfmSecretSecret}";
   hostSecrets = ../secrets + "/${config.networking.hostName}.yaml";
 in
 {
@@ -39,7 +41,10 @@ in
     ];
 
     guests.navidrome = {
-      interior.modules.services.navidrome.enable = true;
+      interior.modules.services.navidrome = {
+        enable = true;
+        inherit lastfmApiKeyFile lastfmSecretFile;
+      };
 
       mounts = {
         ${serviceConfig.dataDir} = {
@@ -54,8 +59,12 @@ in
           group = "storage";
           mode = "2770";
         };
-        ${"/run/secrets/navidrome.env"} = {
+        ${lastfmApiKeyFile} = {
-          file = config.sops.templates."navidrome.env".path;
+          file = config.sops.secrets.${lastfmApiKeySecret}.path;
+          readOnly = true;
+        };
+        ${lastfmSecretFile} = {
+          file = config.sops.secrets.${lastfmSecretSecret}.path;
           readOnly = true;
         };
       };
@@ -68,18 +77,18 @@ in
     };
 
     sops.secrets = {
-      ${lastfmApiKeySecret}.sopsFile = hostSecrets;
+      ${lastfmApiKeySecret} = {
-      ${lastfmSecretSecret}.sopsFile = hostSecrets;
+        sopsFile = hostSecrets;
-    };
+        owner = "root";
-
+        group = "storage";
-    sops.templates."navidrome.env" = {
+        mode = "0440";
-      owner = "root";
+      };
-      group = "storage";
+      ${lastfmSecretSecret} = {
-      mode = "0440";
+        sopsFile = hostSecrets;
-      content = ''
+        owner = "root";
-        ND_LASTFM_APIKEY=${config.sops.placeholder.${lastfmApiKeySecret}}
+        group = "storage";
-        ND_LASTFM_SECRET=${config.sops.placeholder.${lastfmSecretSecret}}
+        mode = "0440";
-      '';
+      };
     };
   };
 }

configs/nixos/modules/services/navidrome.nix

@@ -1,8 +1,23 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }:
+let
+  writeEnvironmentFile = pkgs.writeShellScript "navidrome-environment" ''
+    set -eu
+
+    umask 077
+    api_key="$(${pkgs.coreutils}/bin/tr -d '\n' < "$CREDENTIALS_DIRECTORY/lastfm-api-key")"
+    secret="$(${pkgs.coreutils}/bin/tr -d '\n' < "$CREDENTIALS_DIRECTORY/lastfm-secret")"
+
+    cat > /run/navidrome/navidrome.env <<EOF
+    ND_LASTFM_APIKEY=$api_key
+    ND_LASTFM_SECRET=$secret
+    EOF
+  '';
+in
 {
   options.modules.services.navidrome = {
     enable = lib.mkEnableOption "Navidrome";
@@ -20,6 +35,16 @@
       readOnly = true;
       description = "Guest path where Navidrome reads its library folder.";
     };
+
+    lastfmApiKeyFile = lib.mkOption {
+      type = lib.types.path;
+      description = "Runtime file containing the Navidrome Last.fm API key.";
+    };
+
+    lastfmSecretFile = lib.mkOption {
+      type = lib.types.path;
+      description = "Runtime file containing the Navidrome Last.fm secret.";
+    };
   };
 
   config = lib.mkMerge [
@@ -39,7 +64,7 @@
         enable = true;
         user = "navidrome";
         group = "storage";
-        environmentFile = "/run/secrets/navidrome.env";
+        environmentFile = "/run/navidrome/navidrome.env";
         openFirewall = true;
         settings = {
           Address = "0.0.0.0";
@@ -49,6 +74,14 @@
           EnableSharing = true;
         };
       };
+
+      systemd.services.navidrome.serviceConfig = {
+        ExecStartPre = writeEnvironmentFile;
+        LoadCredential = [
+          "lastfm-api-key:${config.modules.services.navidrome.lastfmApiKeyFile}"
+          "lastfm-secret:${config.modules.services.navidrome.lastfmSecretFile}"
+        ];
+      };
     })
   ];
 }