refactor(nixos): simplify navidrome service config

configs/nixos/guests/navidrome.nix

@@ -5,11 +5,6 @@
 }:
 let
   serviceConfig = config.containers.navidrome.config.modules.services.navidrome;
-  lastfmApiKeySecret = "services/navidrome/lastfm/api-key";
-  lastfmSecretSecret = "services/navidrome/lastfm/secret";
-  lastfmApiKeyFile = "/run/secrets/${lastfmApiKeySecret}";
-  lastfmSecretFile = "/run/secrets/${lastfmSecretSecret}";
-  hostSecrets = ../secrets + "/${config.networking.hostName}.yaml";
 in
 {
   options.guests.navidrome = {
@@ -41,10 +36,7 @@ in
     ];
 
     guests.navidrome = {
-      interior.modules.services.navidrome = {
+      interior.modules.services.navidrome.enable = true;
-        enable = true;
-        inherit lastfmApiKeyFile lastfmSecretFile;
-      };
 
       mounts = {
         ${serviceConfig.dataDir} = {
@@ -59,14 +51,6 @@ in
           group = "storage";
           mode = "2770";
         };
-        ${lastfmApiKeyFile} = {
-          file = config.sops.secrets.${lastfmApiKeySecret}.path;
-          readOnly = true;
-        };
-        ${lastfmSecretFile} = {
-          file = config.sops.secrets.${lastfmSecretSecret}.path;
-          readOnly = true;
-        };
       };
 
       limits = {
@@ -76,19 +60,5 @@ in
       };
     };
 
-    sops.secrets = {
-      ${lastfmApiKeySecret} = {
-        sopsFile = hostSecrets;
-        owner = "root";
-        group = "storage";
-        mode = "0440";
-      };
-      ${lastfmSecretSecret} = {
-        sopsFile = hostSecrets;
-        owner = "root";
-        group = "storage";
-        mode = "0440";
-      };
-    };
   };
 }

configs/nixos/modules/services/navidrome.nix

@@ -1,28 +1,8 @@
 {
   config,
   lib,
-  pkgs,
   ...
 }:
-let
-  configScript = pkgs.writeShellScript "navidrome-config" ''
-    set -eu
-
-    umask 077
-    api_key="$(${pkgs.coreutils}/bin/tr -d '\n' < "$CREDENTIALS_DIRECTORY/lastfm-api-key")"
-    secret="$(${pkgs.coreutils}/bin/tr -d '\n' < "$CREDENTIALS_DIRECTORY/lastfm-secret")"
-
-    cat > /run/navidrome/navidrome.toml <<EOF
-    Address = "0.0.0.0"
-    Port = 4533
-    DataFolder = "${config.modules.services.navidrome.dataDir}"
-    MusicFolder = "${config.modules.services.navidrome.libraryDir}"
-    EnableSharing = true
-    LastFM.ApiKey = "$api_key"
-    LastFM.Secret = "$secret"
-    EOF
-  '';
-in
 {
   options.modules.services.navidrome = {
     enable = lib.mkEnableOption "Navidrome";
@@ -40,16 +20,6 @@ in
       readOnly = true;
       description = "Guest path where Navidrome reads its library folder.";
     };
-
-    lastfmApiKeyFile = lib.mkOption {
-      type = lib.types.path;
-      description = "Runtime file containing the Navidrome Last.fm API key.";
-    };
-
-    lastfmSecretFile = lib.mkOption {
-      type = lib.types.path;
-      description = "Runtime file containing the Navidrome Last.fm secret.";
-    };
   };
 
   config = lib.mkMerge [
@@ -65,31 +35,19 @@ in
         home = config.modules.services.navidrome.dataDir;
       };
 
-      systemd.services.navidrome = {
+      services.navidrome = {
-        description = "Navidrome media server";
+        enable = true;
-        after = [ "network.target" ];
+        user = "navidrome";
-        wantedBy = [ "multi-user.target" ];
+        group = "storage";
-        serviceConfig = {
+        openFirewall = true;
-          Type = "simple";
+        settings = {
-          User = "navidrome";
+          Address = "0.0.0.0";
-          Group = "storage";
+          Port = 4533;
-          WorkingDirectory = config.modules.services.navidrome.dataDir;
+          DataFolder = config.modules.services.navidrome.dataDir;
-          StateDirectory = "navidrome";
+          MusicFolder = config.modules.services.navidrome.libraryDir;
-          RuntimeDirectory = "navidrome";
+          EnableSharing = true;
-          RuntimeDirectoryMode = "0700";
-          LoadCredential = [
-            "lastfm-api-key:${config.modules.services.navidrome.lastfmApiKeyFile}"
-            "lastfm-secret:${config.modules.services.navidrome.lastfmSecretFile}"
-          ];
-          ExecStartPre = configScript;
-          ExecStart = "${lib.getExe pkgs.navidrome} --configfile /run/navidrome/navidrome.toml";
-          Restart = "on-failure";
-          NoNewPrivileges = true;
-          PrivateTmp = true;
         };
       };
-
-      networking.firewall.allowedTCPPorts = [ 4533 ];
     })
   ];
 }