hydra-mirror: load credentials from agenix secret
Pierre Bourdon committed
Feb 20, 2024 at 23:51 UTC
584a6ab0ac5e5283fc73f1dbc18ec89485c860f7
1 file changed
+8
-3
modules/hydra-mirror.nix
+8
-3
@@ -1,4 +1,4 @@
1
-{ lib, pkgs, ... }:
1
+{ config, lib, pkgs, ... }:
2
3
let
4
channels = (import ../channels.nix).channels-with-urls;
@@ -14,8 +14,8 @@ let
14
script =
15
''
16
# FIXME: use IAM role.
17
- export AWS_ACCESS_KEY_ID=$(sed 's/aws_access_key_id=\(.*\)/\1/ ; t; d' ~/.aws/credentials)
18
- export AWS_SECRET_ACCESS_KEY=$(sed 's/aws_secret_access_key=\(.*\)/\1/ ; t; d' ~/.aws/credentials)
17
+ export AWS_ACCESS_KEY_ID=$(sed 's/aws_access_key_id=\(.*\)/\1/ ; t; d' ${config.age.secrets.hydra-mirror-aws-credentials.path})
18
+ export AWS_SECRET_ACCESS_KEY=$(sed 's/aws_secret_access_key=\(.*\)/\1/ ; t; d' ${config.age.secrets.hydra-mirror-aws-credentials.path})
19
exec mirror-nixos-branch ${channelName} https://hydra.nixos.org/job/${mainJob}/latest-finished
20
'';
21
serviceConfig = {
@@ -39,6 +39,11 @@ let
39
in
40
41
{
42
+ age.secrets.hydra-mirror-aws-credentials = {
43
+ file = ../delft/secrets/hydra-mirror-aws-credentials.age;
44
+ owner = "hydra-mirror";
45
+ };
46
+
47
users.users.hydra-mirror =
48
{ description = "Channel mirroring user";
49
home = "/home/hydra-mirror";