nixos/knot: use types.secretFile for secret files

NixOS · Jun 6, 2022 · 67e17c7 · 67e17c7
1 parent fa226aa
commit 67e17c7
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/nixos/modules/services/networking/knot.nix b/nixos/modules/services/networking/knot.nix
@@ -48,7 +48,7 @@ in {
       };
 
       keyFiles = mkOption {
-        type = types.listOf types.path;
+        type = types.listOf types.secretFile;
         default = [];
         description = ''
           A list of files containing additional configuration

diff --git a/nixos/tests/knot.nix b/nixos/tests/knot.nix
@@ -29,12 +29,12 @@ let
     paths = [ exampleZone delegatedZone ];
   };
   # DO NOT USE pkgs.writeText IN PRODUCTION. This put secrets in the nix store!
-  tsigFile = pkgs.writeText "tsig.conf" ''
+  tsigFile = lib.types.secretFile.makeWorldReadable (pkgs.writeText "tsig.conf" ''
     key:
       - id: slave_key
         algorithm: hmac-sha256
         secret: zOYgOgnzx3TGe5J5I/0kxd7gTcxXhLYMEq3Ek3fY37s=
-  '';
+  '');
 in {
   name = "knot";
   meta = with pkgs.lib.maintainers; {