use environmentFile

homelab-services/minio-service/flake.nix

@@ -37,9 +37,9 @@
             description = "MinIO root username.";
           };
 
-          rootPasswordFile = lib.mkOption {
+          credentialsFile = lib.mkOption {
             type = lib.types.path;
-            description = "File containing MinIO root password.";
+            description = "File containing MinIO credentials.";
           };
 
           default-nginx = {
@@ -74,8 +74,7 @@
               User = "minio";
               Group = "minio";
               Environment = [
-                "MINIO_ACCESS_KEY=${opts.rootUser}"
+                "environmentFile = ${opts.credentialsFile}" 
-                "MINIO_SECRET_KEY_FILE=${opts.rootPasswordFile}"
               ];
               Restart = "always";
             };

nixos/configuration.nix

@@ -30,9 +30,9 @@
         key = "CF_API_KEY";
       };
 
-      "minio-root-pass" = {
+      "minio-credentials" = {
-        sopsFile = ./secrets/minio.json;
+        sopsFile = ./secrets/minio.yaml;
-        key = "minioPass";
+        key = "minioCredentials";
       };
     };
   };
@@ -82,7 +82,7 @@
 
     dataDir = "/data/minio";
     rootUser = "admin";
-    rootPasswordFile = config.sops.secrets."minio-root-pass".path;
+    rootPasswordFile = config.sops.secrets."minio-credentials".path;
 
     dataPort = 9000;     # S3 API access
     consolePort = 9001;  # Admin console access

nixos/secrets/minio.json

@@ -1,19 +0,0 @@
-{
-	"minioPass": "ENC[AES256_GCM,data:VAKfuKJhSvWzbP0i+u0=,iv:vRIYBsQQSkN8qfaIEM10cb5kZpVw+iDv5KTI9YKdSgE=,tag:1Mz8z58E1xzVMwuzMCu7hA==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age13ldedhh6ymava0d5dn54860a3f799gufknre9lfegegjt9ytes2qq5qgmr",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwMlp3RDZjbnoyRXdGcmxP\ndXE0QlpUY3pDRmhsN2E0RElDTmE3QnZuenkwCnRaS3ZVMTMrSVhxek9nMXVGcjlF\nVHpZL3M5azRqME85bjZxTHErVG9Ua1UKLS0tIDMxNi9nUWh3NnBxdnppWCtJcHdX\nZjgzMjVTbExsWlFqUmtvQzg5N3l6U0kKVHTwuX2w1bLhjW40hGJJDsRDPDJZFOF6\nEwgCioMVLgiK1Sp6ToFXZfuZe4LZrS691lpfpWQODaB8VsVky7bl+w==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age15w5qelqemnvytp38ywdwmflc6qmrqph3dwqmx3lrec5cm5d9nchq9pfe8s",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhaE1kM3FBZ2lMLzExYklt\nZUEyVkhBZWN0WnE5MFp6QWxaMjMxU0lnNDIwCjNVQ3k3Mk4xeVBrR2RKckZ5SkNP\nT096bGwrZDNjeVl6c0kwbjVKTGRWSTgKLS0tIGpudjdCZk1ib0l4UDdNTDZBenVw\ncFRkTmQ0WEhsd3d2bDcwTE41aENQNzgK90Ik/2nAT0NmSOjieheW9MxCp6n7rSt3\nbJpBQPFI9X19ZmnOsGPlEeBj4QH6L+UMOjTTZsSnAonGO4CoAMYk/Q==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-06-12T21:10:38Z",
-		"mac": "ENC[AES256_GCM,data:4ZUaRhq/C7bkI7+86u5yLjOlUctstt3H3TqbiSvhOYAg1rq2TnQJHW5so86Qz5IuJDs55wGx+owqAHoOyy70Y9cph2VrbUDyHEnztwmyEED8IB+vNl+ML7cQOZX+bLGDEyP9Hy4T9qTxil2pWI2idToPYCRrSFWcumrggXzme38=,iv:1trGrYZuRkaZeVRqSqARBsyQGfaV4MHfDk94+iiln7A=,tag:jNnmkCtCfCyhtB06aaSwbg==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}

nixos/secrets/minio.yaml

@@ -0,0 +1,25 @@
+minioCredentials: ENC[AES256_GCM,data:EvJAHkl8aGmmOJzKFVlXM9YYI9fHKZzCT6XMSo1A+IJf0ppQQ04AmT9sZ9+xiIT6OfaNQPjfmFYumQ==,iv:HVwic3oPEGZY8P61UDizto+A1LnjZibWL7Tgoxv9ivU=,tag:MOE8tKc7Z5cccFIwza/Sew==,type:str]
+sops:
+    age:
+        - recipient: age13ldedhh6ymava0d5dn54860a3f799gufknre9lfegegjt9ytes2qq5qgmr
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzczFKeUdmOTc4YWNOSmZI
+            b2hFS0NJNFd2T0RzdHB1T1g1b3VIZzNXMlRrCmFIWS96bmxoZWZsYVVzVGUwWVZs
+            MGZMNGZFM1RNNjNOb0RlcTE4cXZxNlEKLS0tIEEyRzRzTExWMWE4V1dWRGROWEhP
+            d05oUnZTVERpd1hEc2ZLVExEVHU5MWsKVZgJFT4hKh9Q3lQ2YK7qksPnm/z0hFIT
+            szMVld8phJ5L9fqSPweAiEuJAk9LPf1u5MLniIpvJ0jEkEq4boPQIw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age15w5qelqemnvytp38ywdwmflc6qmrqph3dwqmx3lrec5cm5d9nchq9pfe8s
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzZFJvQ01ERzlZb2c5U05q
+            SWplbHExY1RVWnlBa2FpM1ZJSEdZSnhVMW40CldYL1pjWUQxdEdlYXFBeENlbFZF
+            VjhjcWcycitXWDBjeEk4Rll0eERMYTAKLS0tIGJ3ZWhZekJmeTVTaml4NDl5MjFR
+            cmhUZUxNSitwSjJDRSticXkvRldtWFEKdyBb6PqMfIeE2BSjNAyYdaoAviaDzU6m
+            jRf2N7UV5RIdodxh+xwhBB0YO/bl64KWwPKKRagkMGBEwHGd4sMXuA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-06-12T23:59:06Z"
+    mac: ENC[AES256_GCM,data:r6DlZTLX6UwAjdIcWnVGCrkYVty60qK2Ukv0ArTs9haLI4PFO3T2DSIGMjWA/7AgRjoWxq6RUmUp91aPm3svrwhiyBWGgttucCm55K9lOb8vlQW7hwB3NenRO3G1bfp9zokjYJiYRyqSiUiUm2n4qTbvv7VQf0doVD926+sZbPA=,iv:n3PfoGh7NzR7XOWGvNFU6tukrzFIyTLOpL2B2+2uy9g=,tag:d202yCkUD7MKxZrkgIHGjQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.10.2