hydra-mirror: migrate from classic PAT
This shortly broke while we tried disabling classic PATs on the NixOS org on GitHub. With PATs being limited in lifetime we are going for an SSH key instead, which also limits us to Git operations and no API acccess.
Martin Weinelt committed
May 14, 2026 at 17:32 UTC
e0b57c7f7518c5f83d1d4c5464b8d7fece3a3f04
2 files changed
+4
-2
build/secrets/hydra-mirror-git-credentials.age
Binary files a/build/secrets/hydra-mirror-git-credentials.age and b/build/secrets/hydra-mirror-git-credentials.age differ
modules/hydra-mirror.nix
+4
-2
@@ -25,8 +25,8 @@ let
25
if ! [[ -e $dir ]]; then
26
git clone --bare https://github.com/NixOS/nixpkgs.git $dir
27
fi
28
- GIT_DIR=$dir git config credential.helper 'store --file=${config.age.secrets.hydra-mirror-git-credentials.path}'
28
GIT_DIR=$dir git config remote.origin.fetch '+refs/heads/*:refs/remotes/origin/*'
29
+ export GIT_SSH_COMMAND="ssh -i $CREDENTIALS_DIRECTORY/hydra-mirror-git-credentials -o IdentitiesOnly=yes"
30
31
# FIXME: use IAM role.
32
export AWS_ACCESS_KEY_ID=$(sed 's/aws_access_key_id=\(.*\)/\1/ ; t; d' ${config.age.secrets.hydra-mirror-aws-credentials.path})
@@ -39,6 +39,9 @@ let
39
User = "hydra-mirror";
40
# Allow the unit to use 80% of the system's RAM and 100% of the system's swap
41
MemoryHigh = "80%";
42
+ LoadCredential = [
43
+ "hydra-mirror-git-credentials:${config.age.secrets.hydra-mirror-git-credentials.path}"
44
+ ];
45
};
46
unitConfig = {
47
After = [ "networking.target" ];
@@ -60,7 +63,6 @@ in
63
64
age.secrets.hydra-mirror-git-credentials = {
65
file = ../build/secrets/hydra-mirror-git-credentials.age;
63
- owner = "hydra-mirror";
66
};
67
68
users.users.hydra-mirror = {