69 lines
2.2 KiB
Nix
69 lines
2.2 KiB
Nix
|
{ secretsFile ? null, config ? null }:
|
||
|
|
let
|
||
|
|
secrets = import secretsFile;
|
||
|
|
secretsDir = "/secrets/";
|
||
|
|
secret = { text ? null, keyFile ? null, user, group ? user }: {
|
||
|
|
inherit text keyFile user group;
|
||
|
|
destDir = secretsDir;
|
||
|
|
permissions = "0440";
|
||
|
|
};
|
||
|
|
in rec {
|
||
|
|
allSecrets = {
|
||
|
|
bitcoin-rpcpassword = secret {
|
||
|
|
text = secrets.bitcoinrpcpassword;
|
||
|
|
user = "bitcoin";
|
||
|
|
group = "bitcoinrpc";
|
||
|
|
};
|
||
|
|
lnd-wallet-password = secret {
|
||
|
|
text = secrets.lnd-wallet-password;
|
||
|
|
user = "lnd";
|
||
|
|
};
|
||
|
|
lightning-charge-api-token = secret {
|
||
|
|
text = "API_TOKEN=" + secrets.lightning-charge-api-token;
|
||
|
|
user = "clightning";
|
||
|
|
};
|
||
|
|
# variable is called CHARGE_TOKEN instead of API_TOKEN
|
||
|
|
lightning-charge-api-token-for-nanopos = secret {
|
||
|
|
text = "CHARGE_TOKEN=" + secrets.lightning-charge-api-token;
|
||
|
|
user = "nanopos";
|
||
|
|
};
|
||
|
|
liquid-rpcpassword = secret {
|
||
|
|
text = secrets.liquidrpcpassword;
|
||
|
|
user = "liquid";
|
||
|
|
};
|
||
|
|
spark-wallet-login = secret {
|
||
|
|
text = "login=" + "spark-wallet:" + secrets.spark-wallet-password;
|
||
|
|
user = "clightning";
|
||
|
|
};
|
||
|
|
nginx_key = secret {
|
||
|
|
keyFile = toString ../../secrets/nginx.key;
|
||
|
|
user = "nginx";
|
||
|
|
group = "root";
|
||
|
|
};
|
||
|
|
nginx_cert = secret {
|
||
|
|
keyFile = toString ../../secrets/nginx.cert;
|
||
|
|
user = "nginx";
|
||
|
|
group = "root";
|
||
|
|
};
|
||
|
|
lnd_key = secret {
|
||
|
|
keyFile = toString ../../secrets/lnd.key;
|
||
|
|
user = "lnd";
|
||
|
|
};
|
||
|
|
lnd_cert = secret {
|
||
|
|
keyFile = toString ../../secrets/lnd.cert;
|
||
|
|
user = "lnd";
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
activeSecrets = let
|
||
|
|
secretsFor = service: attrs: if service.enable then attrs else {};
|
||
|
|
in with allSecrets;
|
||
|
|
(secretsFor config.services.bitcoind { inherit bitcoin-rpcpassword; })
|
||
|
|
// (secretsFor config.services.lnd { inherit lnd-wallet-password lnd_key lnd_cert; })
|
||
|
|
// (secretsFor config.services.lightning-charge { inherit lightning-charge-api-token; })
|
||
|
|
// (secretsFor config.services.nanopos { inherit lightning-charge-api-token-for-nanopos; })
|
||
|
|
// (secretsFor config.services.liquidd { inherit liquid-rpcpassword; })
|
||
|
|
// (secretsFor config.services.spark-wallet { inherit spark-wallet-login; })
|
||
|
|
// (secretsFor config.services.electrs { inherit nginx_key nginx_cert; });
|
||
|
|
}
|