From 75292c920c34b3b19564660833c51379a04a9861 Mon Sep 17 00:00:00 2001
From: DashieTM <fabio.lenherr@gmail.com>
Date: Sun, 4 Aug 2024 14:29:34 +0200
Subject: [PATCH] Add sops modules to server

---
 flake.nix                         |  1 +
 hardware/server/configuration.nix | 36 +++++++++++++++----------------
 2 files changed, 19 insertions(+), 18 deletions(-)

diff --git a/flake.nix b/flake.nix
index f392710..19ed068 100644
--- a/flake.nix
+++ b/flake.nix
@@ -75,6 +75,7 @@
             inherit inputs; pkgs = stable;
           };
           modules = [
+            inputs.sops-nix.nixosModules.sops
             ./hardware/server/configuration.nix
           ];
         };
diff --git a/hardware/server/configuration.nix b/hardware/server/configuration.nix
index 34c6bbe..22aaf25 100644
--- a/hardware/server/configuration.nix
+++ b/hardware/server/configuration.nix
@@ -1,11 +1,11 @@
 { config, pkgs, ... }:
 let
-  nextcloud_pw = (builtins.readFile config.sops.secrets.nextcloud_server.path);
-  forgejo_pw = (builtins.readFile config.sops.secrets.forgejo_server.path);
-  matrix_pw = (builtins.readFile config.sops.secrets.matrix_server.path);
-  mautrix_signal_pw = (builtins.readFile config.sops.secrets.mautrix_signal_server.path);
-  mautrix_whatsapp_pw = (builtins.readFile config.sops.secrets.mautrix_whatsapp_server.path);
-  mautrix_discord_pw = (builtins.readFile config.sops.secrets.mautrix_discord_server.path);
+  nextcloud_pw = (config.sops.secrets.nextcloud_server.path);
+  forgejo_pw = (config.sops.secrets.forgejo_server.path);
+  matrix_pw = (config.sops.secrets.matrix_server.path);
+  mautrix_signal_pw = (config.sops.secrets.mautrix_signal_server.path);
+  mautrix_whatsapp_pw = (config.sops.secrets.mautrix_whatsapp_server.path);
+  mautrix_discord_pw = (config.sops.secrets.mautrix_discord_server.path);
 
   fqdn = "matrix.${config.networking.domain}";
   baseUrl = "https://${fqdn}";
@@ -18,7 +18,7 @@ let
   '';
 in
 {
-  networking.hostName = "dashie";
+  networking.hostName = "server";
   networking.domain = "dashie.org";
   imports = [
     ./hardware-configuration.nix
@@ -78,7 +78,7 @@ in
     server_name = "matrix.dashie.org";
     database.name = "psycopg2";
     database.args.user = "matrix-synapse";
-    database.args.password = "${matrix_pw}";
+    database.args.passfile = "${matrix_pw}";
     public_baseurl = "https://matrix.dashie.org";
     enable_registration = true;
     enable_registration_without_verification = true;
@@ -105,7 +105,7 @@ in
       id = "whatsapp";
       database = {
         type = "postgres";
-        uri = "postgresql:///mautrix_whatsapp?host=/run/postgresql&sslmode=disable&user=mautrix_whatsapp&password=${mautrix_whatsapp_pw}";
+        uri = "postgresql:///mautrix_whatsapp?host=/run/postgresql&sslmode=disable&user=mautrix_whatsapp&passfile=${mautrix_whatsapp_pw}";
       };
     };
     bridge = {
@@ -126,7 +126,7 @@ in
       id = "signal";
       database = {
         type = "postgres";
-        uri = "postgresql:///mautrix_signal?host=/run/postgresql&sslmode=disable&user=mautrix_signal&password=${mautrix_signal_pw}";
+        uri = "postgresql:///mautrix_signal?host=/run/postgresql&sslmode=disable&user=mautrix_signal&passfile=${mautrix_signal_pw}";
       };
     };
     bridge = {
@@ -147,7 +147,7 @@ in
       id = "discord";
       database = {
         type = "postgres";
-        uri = "postgresql:///mautrix_discord?host=/run/postgresql&sslmode=disable&user=mautrix_discord&password=${mautrix_discord_pw}";
+        uri = "postgresql:///mautrix_discord?host=/run/postgresql&sslmode=disable&user=mautrix_discord&passfile=${mautrix_discord_pw}";
       };
     };
     bridge = {
@@ -237,7 +237,7 @@ in
   };
   services.forgejo = {
     enable = true;
-    database.passwordFile = ./dbpw/forgejo;
+    database.passwordFile = "${forgejo_pw}";
     settings = {
       server.DOMAIN = "git.dashie.org";
       server.SSH_PORT = 12008;
@@ -264,27 +264,27 @@ in
     '';
     initialScript = pkgs.writeText "backend-initScript" ''
       CREATE DATABASE nextcloud;
-            CREATE USER nextcloud WITH ENCRYPTED PASSWORD '${nextcloud_pw}';
+            CREATE USER nextcloud WITH ENCRYPTED PASSWORD pg_read_file(${nextcloud_pw});
             GRANT ALL PRIVILEGES ON DATABASE nextcloud TO nextcloud;
 
       CREATE DATABASE forgejo;
-            CREATE USER forgejo WITH ENCRYPTED PASSWORD '${forgejo_pw}';
+            CREATE USER forgejo WITH ENCRYPTED PASSWORD pg_read_file(${forgejo_pw});
             GRANT ALL PRIVILEGES ON DATABASE forgejo TO forgejo;
 
 
-      CREATE USER "matrix-synapse" WITH ENCRYPTED PASSWORD '${matrix_pw}'
+      CREATE USER "matrix-synapse" WITH ENCRYPTED PASSWORD pg_read_file(${matrix_pw})
       SELECT 'CREATE DATABASE "matrix-synapse" LOCALE "C" ENCODING UTF8 TEMPLATE template0 OWNER "matrix-synapse"'
       WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'matrix-synapse')\gexec
 
-      CREATE USER mautrix_whatsapp WITH ENCRYPTED PASSWORD '${mautrix_whatsapp_pw}'
+      CREATE USER mautrix_whatsapp WITH ENCRYPTED PASSWORD pg_read_file(${mautrix_whatsapp_pw})
       SELECT 'CREATE DATABASE "mautrix_whatsapp" LOCALE "C" ENCODING UTF8 TEMPLATE template0 OWNER "mautrix_whatsapp"'
       WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'mautrix_whatsapp')\gexec
 
-      CREATE USER mautrix_signal WITH ENCRYPTED PASSWORD '${mautrix_signal_pw}'
+      CREATE USER mautrix_signal WITH ENCRYPTED PASSWORD 'pg_read_file(${mautrix_signal_pw})
       SELECT 'CREATE DATABASE "mautrix_signal" LOCALE "C" ENCODING UTF8 TEMPLATE template0 OWNER "mautrix_signal"'
       WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'mautrix_signal')\gexec
 
-      CREATE USER mautrix_discord WITH ENCRYPTED PASSWORD '${mautrix_discord_pw}'
+      CREATE USER mautrix_discord WITH ENCRYPTED PASSWORD 'pg_read_file(${mautrix_discord_pw})
       SELECT 'CREATE DATABASE "mautrix_discord" LOCALE "C" ENCODING UTF8 TEMPLATE template0 OWNER "mautrix_discord"'
       WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'mautrix_discord')\gexec
     '';