Use attrs for secrets instead of lists

[perso/Immae/Config/Nix.git] / modules / private / ejabberd / default.nix

diff --git a/modules/private/ejabberd/default.nix b/modules/private/ejabberd/default.nix
index 5e717f4dc01b07ce9ed8ede8694f1c482cb53d8c..4d86a648ada0d460d4e56670d1bd8ef3aaac3904 100644 (file)
--- a/modules/private/ejabberd/default.nix
+++ b/modules/private/ejabberd/default.nix
@@ -19,6 +19,7 @@ in
         user = "ejabberd";
         group = "ejabberd";
         domain = "eldiron.immae.eu";
+        keyType = "rsa4096";
         postRun = ''
           systemctl restart ejabberd.service
           '';
@@ -36,9 +37,8 @@ in
     systemd.services.ejabberd.postStop = ''
       rm /var/log/ejabberd/erl_crash*.dump
       '';
-    secrets.keys = [
-      {
-        dest = "ejabberd/psql.yml";
+    secrets.keys = {
+      "ejabberd/psql.yml" = {
         permissions = "0400";
         user = "ejabberd";
         group = "ejabberd";
@@ -49,16 +49,15 @@ in
           sql_username: "${config.myEnv.jabber.postgresql.user}"
           sql_password: "${config.myEnv.jabber.postgresql.password}"
           '';
-      }
-      {
-        dest = "ejabberd/host.yml";
+      };
+      "ejabberd/host.yml" = {
         permissions = "0400";
         user = "ejabberd";
         group = "ejabberd";
         text = ''
           host_config:
             "immae.fr":
-              domain_certfile: "${config.security.acme.directory}/ejabberd/full.pem"
+              domain_certfile: "${config.security.acme.certs.ejabberd.directory}/full.pem"
               auth_method: [ldap]
               ldap_servers: ["${config.myEnv.jabber.ldap.host}"]
               ldap_encrypt: tls
@@ -66,12 +65,12 @@ in
               ldap_password: "${config.myEnv.jabber.ldap.password}"
               ldap_base: "${config.myEnv.jabber.ldap.base}"
               ldap_uids:
-                - "uid": "%u"
-                - "immaeXmppUid": "%u"
+                uid: "%u"
+                immaeXmppUid: "%u"
               ldap_filter: "${config.myEnv.jabber.ldap.filter}"
           '';
-      }
-    ];
+      };
+    };
     users.users.ejabberd.extraGroups = [ "keys" ];
     services.ejabberd = {
       package = pkgs.ejabberd.override { withPgsql = true; };
@@ -81,7 +80,7 @@ in
         ERLANG_NODE=ejabberd@localhost
       '';
       configFile = pkgs.runCommand "ejabberd.yml" {
-        certificatePrivateKeyAndFullChain = "${config.security.acme.directory}/ejabberd/full.pem";
+        certificatePrivateKeyAndFullChain = "${config.security.acme.certs.ejabberd.directory}/full.pem";
         certificateCA = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
         sql_config_file = config.secrets.fullPaths."ejabberd/psql.yml";
         host_config_file = config.secrets.fullPaths."ejabberd/host.yml";