From: Ismaël Bouya <ismael.bouya@normalesup.org>
Date: Fri, 29 Jan 2021 15:33:03 +0000 (+0100)
Subject: Remove netdata stream key from the store
X-Git-Url: https://git.immae.eu/?p=perso%2FImmae%2FConfig%2FNix.git;a=commitdiff_plain;h=0e3747095920c0dcfeee74ebe6f280b0defc02c5

Remove netdata stream key from the store
---

diff --git a/modules/private/system/monitoring-1.nix b/modules/private/system/monitoring-1.nix
index 188162a..2198d09 100644
--- a/modules/private/system/monitoring-1.nix
+++ b/modules/private/system/monitoring-1.nix
@@ -42,13 +42,24 @@
   services.netdata.config.web."allow netdata.conf from" = "fd*";
   services.netdata.config.web."allow management from" = "fd*";
   networking.firewall.allowedTCPPorts = [ 19999 ];
-  environment.etc."netdata/stream.conf".text = builtins.concatStringsSep "\n" (pkgs.lib.mapAttrsToList (_: key: ''
-    [${key}]
-        enabled = yes
-        default history = 3600
-        default memory = ram
-        health enabled by default = auto
-  '') config.myEnv.monitoring.netdata_keys);
+  environment.etc."netdata/stream.conf".source = "/var/secrets/netdata-stream.conf";
+
+  secrets.keys = [
+    {
+      dest = "netdata-stream.conf";
+      user = config.services.netdata.user;
+      group = config.services.netdata.group;
+      permissions = "0400";
+      text = builtins.concatStringsSep "\n" (pkgs.lib.mapAttrsToList (_: key: ''
+        [${key}]
+            enabled = yes
+            default history = 3600
+            default memory = ram
+            health enabled by default = auto
+      '') config.myEnv.monitoring.netdata_keys);
+    }
+  ];
+  users.users."${config.services.netdata.user}".extraGroups = [ "keys" ];
   # This value determines the NixOS release with which your system is
   # to be compatible, in order to avoid breaking some software such as
   # database servers. You should change this only after NixOS release
diff --git a/nixops/secrets b/nixops/secrets
index 252f7ed..3c9ed73 160000
--- a/nixops/secrets
+++ b/nixops/secrets
@@ -1 +1 @@
-Subproject commit 252f7ed22d97d82902ff2d9fedccc525d67cabcb
+Subproject commit 3c9ed734ef4d9bc58d7f0b79d86253a8163d06f0