Move databases config to new secrets

[perso/Immae/Config/Nix.git] / nixops / modules / databases / postgresql.nix

diff --git a/nixops/modules/databases/postgresql.nix b/nixops/modules/databases/postgresql.nix
index 7e2f4e665fc861a3570b15b9e38f95e4b3c095c7..62e9e34889eddcec1b62150262a80a32f49a154b 100644 (file)
--- a/nixops/modules/databases/postgresql.nix
+++ b/nixops/modules/databases/postgresql.nix
@@ -77,9 +77,9 @@ in {
       '';
     };
 
-    deployment.keys = {
-      postgresql-pam = {
-        destDir = "/run/keys/postgresql";
+    mySecrets.keys = [
+      {
+        dest = "postgresql/pam";
         permissions = "0400";
         group = "postgres";
         user = "postgres";
@@ -91,9 +91,9 @@ in {
           pam_filter ${filter}
           ssl start_tls
         '';
-      };
-      postgresql-pam_replication = {
-        destDir = "/run/keys/postgresql";
+      }
+      {
+        dest = "postgresql/pam_replication";
         permissions = "0400";
         group = "postgres";
         user = "postgres";
@@ -105,8 +105,8 @@ in {
           pam_login_attribute cn
           ssl start_tls
         '';
-      };
-    };
+      }
+    ];
 
     security.pam.services = let
       pam_ldap = "${pkgs.pam_ldap}/lib/security/pam_ldap.so";
@@ -114,15 +114,15 @@ in {
       {
         name = "postgresql";
         text = ''
-          auth    required ${pam_ldap} config=/run/keys/postgresql/postgresql-pam
-          account required ${pam_ldap} config=/run/keys/postgresql/postgresql-pam
+          auth    required ${pam_ldap} config=/var/secrets/postgresql/pam
+          account required ${pam_ldap} config=/var/secrets/postgresql/pam
           '';
       }
       {
         name = "postgresql_replication";
         text = ''
-          auth    required ${pam_ldap} config=/run/keys/postgresql/postgresql-pam_replication
-          account required ${pam_ldap} config=/run/keys/postgresql/postgresql-pam_replication
+          auth    required ${pam_ldap} config=/var/secrets/postgresql/pam_replication
+          account required ${pam_ldap} config=/var/secrets/postgresql/pam_replication
           '';
       }
     ];