blob: 8c2268fa04711a29a05d1161effd111751e9f0f3 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
|
{ ... }:
{
sops = {
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
defaultSopsFile = ../../secrets/credentials.json;
secrets = {
# FIXME: using mode 444 here is a hack so that spotifyd can cat the
# values out, but it obviously exposes the secrets to anyone that knows
# they are there. A better solution would be to override the spotifyd
# module to make the systemd service run the program with a group, and
# then give read priviledges to only that group.
# "spotify/password" = {
# mode = "444";
# };
# "spotify/username" = {
# mode = "444";
# };
"irc/libera-password" = { };
};
}; # end of sops
}
|
