selfprivacy-nixos-config/files.nix

47 lines
1.5 KiB
Nix
Raw Normal View History

nixos-config-source: { config, pkgs, ... }:
2021-11-15 10:02:05 +00:00
let
cfg = config.selfprivacy;
dnsCredentialsTemplates = {
DIGITALOCEAN = "DO_AUTH_TOKEN=REPLACEME";
CLOUDFLARE = ''
CF_API_KEY=REPLACEME
CLOUDFLARE_DNS_API_TOKEN=REPLACEME
CLOUDFLARE_ZONE_API_TOKEN=REPLACEME
'';
DESEC = "DESEC_TOKEN=REPLACEME";
};
dnsCredentialsTemplate = dnsCredentialsTemplates.${cfg.dns.provider};
2021-11-15 10:02:05 +00:00
in
{
systemd.tmpfiles.rules =
let
2022-06-09 19:52:54 +00:00
domain = builtins.replaceStrings [ "\n" "\"" "\\" "%" ] [ "\\n" "\\\"" "\\\\" "%%" ] cfg.domain;
2021-11-15 10:02:05 +00:00
in
[
"f+ /var/domain 0444 selfprivacy-api selfprivacy-api - ${domain}"
2021-11-15 10:02:05 +00:00
];
system.activationScripts =
let
jq = "${pkgs.jq}/bin/jq";
sed = "${pkgs.gnused}/bin/sed";
in
{
nixos-lustrate = ''
rm -rf /old-root
'';
selfprivacy-nixos-configuration-source = ''
rm -rf /etc/nixos/{*,.[!.]*}
cp -r --no-preserve=all ${nixos-config-source}/ -T /etc/nixos/
'';
cloudflareCredentials = ''
mkdir -p /var/lib/cloudflare
chmod 0440 /var/lib/cloudflare
chown nginx:acmereceivers /var/lib/cloudflare
echo '${dnsCredentialsTemplate}' > /var/lib/cloudflare/Credentials.ini
${sed} -i "s/REPLACEME/$(cat /etc/selfprivacy/secrets.json | ${jq} -r '.dns.apiKey')/g" /var/lib/cloudflare/Credentials.ini
chmod 0440 /var/lib/cloudflare/Credentials.ini
chown nginx:acmereceivers /var/lib/cloudflare/Credentials.ini
'';
};
2021-11-15 10:02:05 +00:00
}