61 lines
No EOL
1.7 KiB
Nix
61 lines
No EOL
1.7 KiB
Nix
{ config, lib, ... }:
|
|
with lib;
|
|
let
|
|
cfg = config.nyxs-nix.services.k3s;
|
|
in
|
|
{
|
|
sops = mkIf cfg.enable {
|
|
secrets = {
|
|
pg_pass = {
|
|
format = "json";
|
|
key = "pg-pass";
|
|
sopsFile = "${inputs.secrets}/cluster/authentik.json";
|
|
};
|
|
authentik_secret_key = {
|
|
format = "json";
|
|
key = "authentik-secret-key";
|
|
sopsFile = "${inputs.secrets}/cluster/authentik.json";
|
|
};
|
|
sso_client_id = {
|
|
format = "json";
|
|
key = "sso_client_id";
|
|
sopsFile = "${inputs.secrets}/cluster/vaultwarden.json";
|
|
};
|
|
sso_client_secret = {
|
|
format = "json";
|
|
key = "sso_client_secret";
|
|
sopsFile = "${inputs.secrets}/cluster/vaultwarden.json";
|
|
};
|
|
};
|
|
templates = {
|
|
"authentik-secrets.yaml" = {
|
|
content = ''
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: authentik-secrets
|
|
namespace: default
|
|
type: Opaque
|
|
stringData:
|
|
pg_pass: ${config.sops.placeholder."pg_pass"}
|
|
authentik_secret_key: ${config.sops.placeholder."authentik_secret_key"}
|
|
'';
|
|
path = "/var/lib/rancher/k3s/server/manifests/authentik-secrets.yaml";
|
|
};
|
|
"vaultwarden-secrets.yaml" = {
|
|
content = ''
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: vaultwarden-secrets
|
|
namespace: default
|
|
type: Opaque
|
|
stringData:
|
|
sso_client_id: ${config.sops.placeholder."sso_client_id"}
|
|
sso_client_secret: ${config.sops.placeholder."sso_client_secret"}
|
|
'';
|
|
path = "/var/lib/rancher/k3s/server/manifests/vaultwarden-secrets.yaml";
|
|
};
|
|
};
|
|
};
|
|
} |