Add google oauth key to secrets

karpenoktem · May 7, 2023 · 193d7eb · 193d7eb
1 parent 781c878
commit 193d7eb
Show file tree

Hide file tree

Showing 4 changed files with 13 additions and 3 deletions.
diff --git a/nix/infra.nix b/nix/infra.nix
@@ -132,6 +132,18 @@ in rec {
     };
   };
 
+  production = { config, ... }: {
+    age.secrets = {
+      google-oauth-key.file = ../secrets/google-oauth-key.json.age;
+      google-oauth-key.owner = "giedo";
+      kn-env.file = ../secrets/production.age;
+    };
+
+    kn.settings = {
+      GOOGLE_OAUTH2_KEY = config.age.secrets.google-oauth-key.path;
+    };
+  };
+
   staging = { lib, ... }: {
     # nixos-rebuild switch --flake '.#staging' --target-host root@dev.kn.cx --build-host localhost
     imports = [ vipassana ./hetzner.nix ];

diff --git a/nix/services/kn/settings.nix b/nix/services/kn/settings.nix
@@ -30,9 +30,6 @@ in {
 
     STORAGE_ROOT = "/var/lib/kndjango/storage";
 
-    # TODO: Import sankhara:/home/infra/google-oauth-key.json into age-nix
-    GOOGLE_OAUTH2_KEY = pkgs.emptyFile;
-
     BASE_URL = SCHEME + "://" + DOMAINNAME;
     PHOTOS_CACHE_DIR = "/var/cache/fotos";
     MAILDOMAIN = DOMAINNAME;

diff --git a/secrets/google-oauth-key.json.age b/secrets/google-oauth-key.json.age
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
@@ -11,4 +11,5 @@ in with hosts; {
   "vm.age".publicKeys = allUsers ++ [ vm ];
   "staging.age".publicKeys = allUsers ++ [ staging ];
   "production.age".publicKeys = allUsers ++ [ production ];
+  "google-oauth-key.json.age".publicKeys = allUsers ++ [ production ];
 }