jan-leila/nix-config
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refactor: used a sops template for the mollysocket vapid key #22

Merged
jan-leila merged 3 commits from mollysocket-vapid-template into main 2026-07-26 21:29:08 -05:00
Conversation 0 Commits 3 Files changed 3 +18 -12
jan-leila commented 2026-07-26 21:02:03 -05:00
Owner
Copy link

The services/molly_socket sops secret is now just the raw VAPID private key (the bare 43-character output of 'mollysocket vapid gen') instead of a pre-formatted systemd environment file. A sops template (sops.templates, same mechanism the makemkv config uses) wraps it into MOLLY_VAPID_PRIVKEY=... at activation; the rendered file is root-owned under /run/secrets/rendered/ and never enters the nix store.

Post-deploy: set the secret value in defiant-services.yaml to the bare key (no MOLLY_VAPID_PRIVKEY= prefix), push the secrets repo, 'npins update secrets', then deploy defiant. The Molly linking procedure in the module header now sources /run/secrets/rendered/mollysocket.env instead of the raw secret path.

The services/molly_socket sops secret is now just the raw VAPID private key (the bare 43-character output of 'mollysocket vapid gen') instead of a pre-formatted systemd environment file. A sops template (sops.templates, same mechanism the makemkv config uses) wraps it into MOLLY_VAPID_PRIVKEY=... at activation; the rendered file is root-owned under /run/secrets/rendered/ and never enters the nix store. Post-deploy: set the secret value in defiant-services.yaml to the bare key (no MOLLY_VAPID_PRIVKEY= prefix), push the secrets repo, 'npins update secrets', then deploy defiant. The Molly linking procedure in the module header now sources /run/secrets/rendered/mollysocket.env instead of the raw secret path.
refactor: used a sops template for the mollysocket vapid key
All checks were successful
build PR #22: checks passed
c158ac6a87
feat: updated npins
Some checks are pending
build PR #22: queued
lint formatting fixes pushed
2309d8cff1
jan-leila scheduled this pull request to auto merge when all checks succeed 2026-07-26 21:13:17 -05:00
style: autoformat
All checks were successful
build PR #22: checks passed
24e28c69bb
jan-leila deleted branch mollysocket-vapid-template 2026-07-26 21:29:12 -05:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
jan-leila/nix-config!22
No description provided.