alexion/dev
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(nixos): inline RomM secret paths

Browse Source
This commit is contained in:
alexion
2026-10-19 23:23:57 -04:00
parent d2ad6ac701
commit 9887b67610
1 changed files with 17 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files

71
configs/nixos/guests/romm.nix
View File

@@ -8,6 +8,14 @@ let
environmentFile = "/run/secrets/romm.env";
rommUid = config.registry."stable-uid".${config.networking.hostName}.romm;
redisUid = config.registry."stable-uid".${config.networking.hostName}."redis-romm";
secrets = {
igdbClientId = "services/romm/igdb/client-id";
igdbClientSecret = "services/romm/igdb/client-secret";
retroAchievementsApiKey = "services/romm/retroachievements/api-key";
screenScraperUser = "services/romm/screenscraper/user";
screenScraperPassword = "services/romm/screenscraper/password";
steamGridDbApiKey = "services/romm/steamgriddb/api-key";
};
in
{
options.guests.romm = {
@@ -53,41 +61,6 @@ in
description = "Host path mounted as RomM's user assets.";
};
igdbClientIdSecret = lib.mkOption {
type = lib.types.str;
default = "services/romm/igdb/client-id";
description = "SOPS secret name containing RomM's IGDB client ID.";
};
igdbClientSecretSecret = lib.mkOption {
type = lib.types.str;
default = "services/romm/igdb/client-secret";
description = "SOPS secret name containing RomM's IGDB client secret.";
};
screenScraperUserSecret = lib.mkOption {
type = lib.types.str;
default = "services/romm/screenscraper/user";
description = "SOPS secret name containing RomM's ScreenScraper user name.";
};
screenScraperPasswordSecret = lib.mkOption {
type = lib.types.str;
default = "services/romm/screenscraper/password";
description = "SOPS secret name containing RomM's ScreenScraper password.";
};
retroAchievementsApiKeySecret = lib.mkOption {
type = lib.types.str;
default = "services/romm/retroachievements/api-key";
description = "SOPS secret name containing RomM's RetroAchievements API key.";
};
steamGridDbApiKeySecret = lib.mkOption {
type = lib.types.str;
default = "services/romm/steamgriddb/api-key";
description = "SOPS secret name containing RomM's SteamGridDB API key.";
};
};
config = lib.mkIf cfg.enable {
@@ -186,31 +159,21 @@ in
};
};
sops.secrets =
lib.genAttrs
[
cfg.igdbClientIdSecret
cfg.igdbClientSecretSecret
cfg.screenScraperUserSecret
cfg.screenScraperPasswordSecret
cfg.retroAchievementsApiKeySecret
cfg.steamGridDbApiKeySecret
]
(_: {
sopsFile = ../secrets + "/${config.networking.hostName}.yaml";
});
sops.secrets = lib.genAttrs (builtins.attrValues secrets) (_: {
sopsFile = ../secrets + "/${config.networking.hostName}.yaml";
});
sops.templates."romm.env" = {
owner = "root";
group = "storage";
mode = "0440";
content = ''
IGDB_CLIENT_ID=${config.sops.placeholder.${cfg.igdbClientIdSecret}}
IGDB_CLIENT_SECRET=${config.sops.placeholder.${cfg.igdbClientSecretSecret}}
SCREENSCRAPER_USER=${config.sops.placeholder.${cfg.screenScraperUserSecret}}
SCREENSCRAPER_PASSWORD=${config.sops.placeholder.${cfg.screenScraperPasswordSecret}}
RETROACHIEVEMENTS_API_KEY=${config.sops.placeholder.${cfg.retroAchievementsApiKeySecret}}
STEAMGRIDDB_API_KEY=${config.sops.placeholder.${cfg.steamGridDbApiKeySecret}}
IGDB_CLIENT_ID=${config.sops.placeholder.${secrets.igdbClientId}}
IGDB_CLIENT_SECRET=${config.sops.placeholder.${secrets.igdbClientSecret}}
SCREENSCRAPER_USER=${config.sops.placeholder.${secrets.screenScraperUser}}
SCREENSCRAPER_PASSWORD=${config.sops.placeholder.${secrets.screenScraperPassword}}
RETROACHIEVEMENTS_API_KEY=${config.sops.placeholder.${secrets.retroAchievementsApiKey}}
STEAMGRIDDB_API_KEY=${config.sops.placeholder.${secrets.steamGridDbApiKey}}
'';
};
};