RoyDumblauskas/homelab-config
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

remove usernames from secret file, they're not used

Browse Source
This commit is contained in:
RoyDumblauskas
2026-05-20 00:00:37 -05:00
parent 802902bc39
commit 298d3f2fc5
3 changed files with 167 additions and 160 deletions
Download Patch File Download Diff File Expand all files Collapse all files
homelab-services/postgresql-db/flake.nix
+15 -6
View File
@@ -5,11 +5,20 @@
nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05"; nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
}; };
outputs = { self, nixpkgs, ...}: { outputs =
nixosModules.postgresql-db = {config, lib, pkgs, ...}: { self, nixpkgs, ... }:
{
nixosModules.postgresql-db =
{
config,
lib,
pkgs,
...
}:
let let
opts = config.services.postgresql-db; opts = config.services.postgresql-db;
in { in
{
options.services.postgresql-db = { options.services.postgresql-db = {
enable = lib.mkEnableOption "Postgres make DBs"; enable = lib.mkEnableOption "Postgres make DBs";
@@ -72,7 +81,9 @@
# Dev can be connected to via the LAN or Local # Dev can be connected to via the LAN or Local
${lib.concatStringsSep " " (map (db: "host ${db}_dev ${db}_devuser all md5\n") opts.databases)} ${lib.concatStringsSep " " (map (db: "host ${db}_dev ${db}_devuser all md5\n") opts.databases)}
# Prod can be connected via local machine # Prod can be connected via local machine
${lib.concatStringsSep " " (map (db: "host ${db} ${db}_produser 127.0.0.1/32 md5\n") opts.databases) } ${lib.concatStringsSep " " (
map (db: "host ${db} ${db}_produser 127.0.0.1/32 md5\n") opts.databases
)}
${lib.concatStringsSep " " (map (db: "host ${db} ${db}_produser ::1/128 md5\n") opts.databases)} ${lib.concatStringsSep " " (map (db: "host ${db} ${db}_produser ::1/128 md5\n") opts.databases)}
''; '';
}; };
@@ -97,9 +108,7 @@
for db in ${lib.escapeShellArgs opts.databases}; do for db in ${lib.escapeShellArgs opts.databases}; do
db_upper="''${db^^}" db_upper="''${db^^}"
user_var="PSQL_''${db_upper}_USER"
pass_var="PSQL_''${db_upper}_PASSWORD" pass_var="PSQL_''${db_upper}_PASSWORD"
dev_user_var="PSQL_''${db_upper}_DEV_USER"
dev_pass_var="PSQL_''${db_upper}_DEV_PASSWORD" dev_pass_var="PSQL_''${db_upper}_DEV_PASSWORD"
user_val="$db"_produser user_val="$db"_produser
nixos/configuration.nix
+2 -4
View File
@@ -135,8 +135,6 @@ in
# Fullstack sourcecode # Fullstack sourcecode
# Minio for backend storage # Minio for backend storage
# Should be able to decalre as a nixos module
# which builds container and pushes to k3s
services.minio-service = { services.minio-service = {
enable = true; enable = true;
@@ -161,11 +159,11 @@ in
}; };
}; };
# Postgresql/postgrest for row storage # Postgresql/postgrest for row storage (not on k3s)
services.postgresql-db = { services.postgresql-db = {
enable = true; enable = true;
dataDir = "/var/lib/postgresql"; dataDir = "/var/lib/postgresql";
port = 5431; port = 5432;
credentialsFile = config.sops.secrets."postgresql-credentials".path; credentialsFile = config.sops.secrets."postgresql-credentials".path;
databases = [ "rdblog" ]; databases = [ "rdblog" ];
}; };
nixos/secrets/psql.yaml
+4 -4
View File
@@ -1,4 +1,4 @@
credentials: ENC[AES256_GCM,data:c05URk3EnazNDMMOBPYlVWd3V6oOjTIPhBtrdf5HIKznPdygpzaCwv9MRn5c8DtzGPHV7/517v9pU1CW8+2guC2jVAHt7Wg+IM/4z+vHaxOzsB2n5UgPZaaeKAASA0O0thgABHLMiLZlQpPzO7qKlzvMfpTtWg==,iv:W7cnqmAyT1KvWkg5gzbVmTJ90EC+jbsDg96glISoAXc=,tag:1T2Sa/dYyYFfPPrLBrdUsg==,type:str] credentials: ENC[AES256_GCM,data:jOJNNcqcWdtUpc78wUcxFqKiRHwHdCE+OkhyGOjMaGcBsaBlHUT/WccApQZ1IVVPfRMAtakHYaVfXKeWH2Nz,iv:OQWH2Hb+a5rrWyut/drRLlJeF96SYm+WZVi1UYZS+zk=,tag:F0fATlif7rmIZuAGyiGv1g==,type:str]
sops: sops:
age: age:
- recipient: age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y - recipient: age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
@@ -37,7 +37,7 @@ sops:
ektNUE8xUmRsWEtyajNIYitEbWgyS0kKeKBcJV6/EQKhkbYeE+ALctucmOKV5hDD ektNUE8xUmRsWEtyajNIYitEbWgyS0kKeKBcJV6/EQKhkbYeE+ALctucmOKV5hDD
1WiDsujdVQkAp1WtBFc9KHexaEJ1DjKVOKsIIjj/YlmKz5P0S7Sm0w== 1WiDsujdVQkAp1WtBFc9KHexaEJ1DjKVOKsIIjj/YlmKz5P0S7Sm0w==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
lastmodified: "2025-11-19T05:03:49Z" lastmodified: "2026-05-20T04:59:28Z"
mac: ENC[AES256_GCM,data:uqhNCdl+we0UBjPFOBngA/2ywwXfIxpgXB9ozb7Vcy/sEZCoSob+VuEAzBQ/cbE5EuBlxoltg3Ve0r0xNNQQ5rZ+q6rfyRaSLrO1Xd3B5ITg6hLHLXIjFOGW6q15E2X1vKipnXGE11LZCsTEHCS1JCntLxMu+cTpIZbnVOx+KcY=,iv:6/H5fPHtyqvkkONF49AxLAjKVQpY+jcGm+4d+a2aa9U=,tag:hdoKyv64RpxnbQfd+S6FLg==,type:str] mac: ENC[AES256_GCM,data:AOz3ei4hxSjMT8Xpn3nDzLUzNFQcYDQPu5nUdamgq0e1Y8j9pV7dQNAO0tgAdMxnz3hDPLnF7lmdvI6XdOj/F4gpoc/jm+2LwG405vCKBUvtW03Tx1vq9gmE9xwXo+RK3m7m2Rf4LP+ZS1uThEgrd4nceze/Heimj5acKSAdch4=,iv:rYiBCZK17Gii8vSRpMhzty4dtjjVuunMjrrey+8264A=,tag:ZdpVWajiJUjwtDncVDUBmw==,type:str]
unencrypted_suffix: _unencrypted unencrypted_suffix: _unencrypted
version: 3.10.2 version: 3.12.1