alexion/dev
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(nixos): inline RomM secret paths

Browse Source
This commit is contained in:
alexion
2026-10-19 23:23:57 -04:00
parent d2ad6ac701
commit 9887b67610
1 changed files with 17 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files

71
configs/nixos/guests/romm.nix
View File

@@ -8,6 +8,14 @@ let
environmentFile = "/run/secrets/romm.env"; environmentFile = "/run/secrets/romm.env";
rommUid = config.registry."stable-uid".${config.networking.hostName}.romm; rommUid = config.registry."stable-uid".${config.networking.hostName}.romm;
redisUid = config.registry."stable-uid".${config.networking.hostName}."redis-romm"; redisUid = config.registry."stable-uid".${config.networking.hostName}."redis-romm";
secrets = {
igdbClientId = "services/romm/igdb/client-id";
igdbClientSecret = "services/romm/igdb/client-secret";
retroAchievementsApiKey = "services/romm/retroachievements/api-key";
screenScraperUser = "services/romm/screenscraper/user";
screenScraperPassword = "services/romm/screenscraper/password";
steamGridDbApiKey = "services/romm/steamgriddb/api-key";
};
in in
{ {
options.guests.romm = { options.guests.romm = {
@@ -53,41 +61,6 @@ in
description = "Host path mounted as RomM's user assets."; description = "Host path mounted as RomM's user assets.";
}; };
igdbClientIdSecret = lib.mkOption {
type = lib.types.str;
default = "services/romm/igdb/client-id";
description = "SOPS secret name containing RomM's IGDB client ID.";
};
igdbClientSecretSecret = lib.mkOption {
type = lib.types.str;
default = "services/romm/igdb/client-secret";
description = "SOPS secret name containing RomM's IGDB client secret.";
};
screenScraperUserSecret = lib.mkOption {
type = lib.types.str;
default = "services/romm/screenscraper/user";
description = "SOPS secret name containing RomM's ScreenScraper user name.";
};
screenScraperPasswordSecret = lib.mkOption {
type = lib.types.str;
default = "services/romm/screenscraper/password";
description = "SOPS secret name containing RomM's ScreenScraper password.";
};
retroAchievementsApiKeySecret = lib.mkOption {
type = lib.types.str;
default = "services/romm/retroachievements/api-key";
description = "SOPS secret name containing RomM's RetroAchievements API key.";
};
steamGridDbApiKeySecret = lib.mkOption {
type = lib.types.str;
default = "services/romm/steamgriddb/api-key";
description = "SOPS secret name containing RomM's SteamGridDB API key.";
};
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
@@ -186,31 +159,21 @@ in
}; };
}; };
sops.secrets = sops.secrets = lib.genAttrs (builtins.attrValues secrets) (_: {
lib.genAttrs sopsFile = ../secrets + "/${config.networking.hostName}.yaml";
[ });
cfg.igdbClientIdSecret
cfg.igdbClientSecretSecret
cfg.screenScraperUserSecret
cfg.screenScraperPasswordSecret
cfg.retroAchievementsApiKeySecret
cfg.steamGridDbApiKeySecret
]
(_: {
sopsFile = ../secrets + "/${config.networking.hostName}.yaml";
});
sops.templates."romm.env" = { sops.templates."romm.env" = {
owner = "root"; owner = "root";
group = "storage"; group = "storage";
mode = "0440"; mode = "0440";
content = '' content = ''
IGDB_CLIENT_ID=${config.sops.placeholder.${cfg.igdbClientIdSecret}} IGDB_CLIENT_ID=${config.sops.placeholder.${secrets.igdbClientId}}
IGDB_CLIENT_SECRET=${config.sops.placeholder.${cfg.igdbClientSecretSecret}} IGDB_CLIENT_SECRET=${config.sops.placeholder.${secrets.igdbClientSecret}}
SCREENSCRAPER_USER=${config.sops.placeholder.${cfg.screenScraperUserSecret}} SCREENSCRAPER_USER=${config.sops.placeholder.${secrets.screenScraperUser}}
SCREENSCRAPER_PASSWORD=${config.sops.placeholder.${cfg.screenScraperPasswordSecret}} SCREENSCRAPER_PASSWORD=${config.sops.placeholder.${secrets.screenScraperPassword}}
RETROACHIEVEMENTS_API_KEY=${config.sops.placeholder.${cfg.retroAchievementsApiKeySecret}} RETROACHIEVEMENTS_API_KEY=${config.sops.placeholder.${secrets.retroAchievementsApiKey}}
STEAMGRIDDB_API_KEY=${config.sops.placeholder.${cfg.steamGridDbApiKeySecret}} STEAMGRIDDB_API_KEY=${config.sops.placeholder.${secrets.steamGridDbApiKey}}
''; '';
}; };
}; };