remove usernames from secret file, they're not used

2026-05-20 00:00:37 -05:00
parent 802902bc39
commit 298d3f2fc5
3 changed files with 167 additions and 160 deletions
@@ -5,11 +5,20 @@
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
  };

-  outputs = { self, nixpkgs, ...}: {
-    nixosModules.postgresql-db = {config, lib, pkgs, ...}:
+  outputs =
+    { self, nixpkgs, ... }:
+    {
+      nixosModules.postgresql-db =
+        {
+          config,
+          lib,
+          pkgs,
+          ...
+        }:
        let
          opts = config.services.postgresql-db;
-    in {
+        in
+        {
          options.services.postgresql-db = {
            enable = lib.mkEnableOption "Postgres make DBs";

@@ -41,13 +50,13 @@

            databases = lib.mkOption {
              type = lib.types.listOf lib.types.str;
-          default = [];
+              default = [ ];
              description = "list of databases to bootstrap. Will expand into DB, and DB-DEV for each item. And each Database will recieve it's own user. The user credentials must be in the correct format in the credentials file.";
            };
          };

          config = lib.mkIf opts.enable {
-        users.groups.postgres = {};
+            users.groups.postgres = { };
            users.users.postgres = {
              isSystemUser = true;
              createHome = true;
@@ -70,10 +79,12 @@
                local all all peer

                # Dev can be connected to via the LAN or Local
-            ${lib.concatStringsSep " " (map (db: "host ${db}_dev ${db}_devuser all md5\n") opts.databases) }
+                ${lib.concatStringsSep " " (map (db: "host ${db}_dev ${db}_devuser all md5\n") opts.databases)}
                # Prod can be connected via local machine
-            ${lib.concatStringsSep " " (map (db: "host ${db} ${db}_produser 127.0.0.1/32 md5\n") opts.databases) }
-            ${lib.concatStringsSep " " (map (db: "host ${db} ${db}_produser ::1/128 md5\n") opts.databases) }
+                ${lib.concatStringsSep " " (
+                  map (db: "host ${db} ${db}_produser 127.0.0.1/32 md5\n") opts.databases
+                )}
+                ${lib.concatStringsSep " " (map (db: "host ${db} ${db}_produser ::1/128 md5\n") opts.databases)}
              '';
            };

@@ -97,9 +108,7 @@
                  for db in ${lib.escapeShellArgs opts.databases}; do
                    db_upper="''${db^^}"

-                user_var="PSQL_''${db_upper}_USER"
                    pass_var="PSQL_''${db_upper}_PASSWORD"
-                dev_user_var="PSQL_''${db_upper}_DEV_USER"
                    dev_pass_var="PSQL_''${db_upper}_DEV_PASSWORD"

                    user_val="$db"_produser
@@ -162,7 +171,7 @@
              };
            };

-          networking.firewall.allowedTCPPorts = lib.mkIf opts.enable [ opts.port] ;
+            networking.firewall.allowedTCPPorts = lib.mkIf opts.enable [ opts.port ];
          };
        };
    };
@@ -135,8 +135,6 @@ in
  # Fullstack sourcecode

  # Minio for backend storage
-  # Should be able to decalre as a nixos module
-  # which builds container and pushes to k3s
  services.minio-service = {
    enable = true;

@@ -161,11 +159,11 @@ in
    };
  };

-  # Postgresql/postgrest for row storage
+  # Postgresql/postgrest for row storage (not on k3s)
  services.postgresql-db = {
    enable = true;
    dataDir = "/var/lib/postgresql";
-    port = 5431;
+    port = 5432;
    credentialsFile = config.sops.secrets."postgresql-credentials".path;
    databases = [ "rdblog" ];
  };
@@ -1,4 +1,4 @@
-credentials: ENC[AES256_GCM,data:c05URk3EnazNDMMOBPYlVWd3V6oOjTIPhBtrdf5HIKznPdygpzaCwv9MRn5c8DtzGPHV7/517v9pU1CW8+2guC2jVAHt7Wg+IM/4z+vHaxOzsB2n5UgPZaaeKAASA0O0thgABHLMiLZlQpPzO7qKlzvMfpTtWg==,iv:W7cnqmAyT1KvWkg5gzbVmTJ90EC+jbsDg96glISoAXc=,tag:1T2Sa/dYyYFfPPrLBrdUsg==,type:str]
+credentials: ENC[AES256_GCM,data:jOJNNcqcWdtUpc78wUcxFqKiRHwHdCE+OkhyGOjMaGcBsaBlHUT/WccApQZ1IVVPfRMAtakHYaVfXKeWH2Nz,iv:OQWH2Hb+a5rrWyut/drRLlJeF96SYm+WZVi1UYZS+zk=,tag:F0fATlif7rmIZuAGyiGv1g==,type:str]
 sops:
    age:
        - recipient: age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
@@ -37,7 +37,7 @@ sops:
            ektNUE8xUmRsWEtyajNIYitEbWgyS0kKeKBcJV6/EQKhkbYeE+ALctucmOKV5hDD
            1WiDsujdVQkAp1WtBFc9KHexaEJ1DjKVOKsIIjj/YlmKz5P0S7Sm0w==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-11-19T05:03:49Z"
-    mac: ENC[AES256_GCM,data:uqhNCdl+we0UBjPFOBngA/2ywwXfIxpgXB9ozb7Vcy/sEZCoSob+VuEAzBQ/cbE5EuBlxoltg3Ve0r0xNNQQ5rZ+q6rfyRaSLrO1Xd3B5ITg6hLHLXIjFOGW6q15E2X1vKipnXGE11LZCsTEHCS1JCntLxMu+cTpIZbnVOx+KcY=,iv:6/H5fPHtyqvkkONF49AxLAjKVQpY+jcGm+4d+a2aa9U=,tag:hdoKyv64RpxnbQfd+S6FLg==,type:str]
+    lastmodified: "2026-05-20T04:59:28Z"
+    mac: ENC[AES256_GCM,data:AOz3ei4hxSjMT8Xpn3nDzLUzNFQcYDQPu5nUdamgq0e1Y8j9pV7dQNAO0tgAdMxnz3hDPLnF7lmdvI6XdOj/F4gpoc/jm+2LwG405vCKBUvtW03Tx1vq9gmE9xwXo+RK3m7m2Rf4LP+ZS1uThEgrd4nceze/Heimj5acKSAdch4=,iv:rYiBCZK17Gii8vSRpMhzty4dtjjVuunMjrrey+8264A=,tag:ZdpVWajiJUjwtDncVDUBmw==,type:str]
    unencrypted_suffix: _unencrypted
-    version: 3.10.2
+    version: 3.12.1