switch to pass for key management

modules/containers/katzencafe-wiki.nix

@@ -86,12 +86,12 @@
     # NOTE: for some reason, i ahd to manually chown +r the password file for mediawiki to work.
     # i should figure out why to make this work when setting up new instances...
     "katzenwikiPwFile" = {
-      keyCommand = [ "cat" "/home/jade/keys-tmp/katzenwiki-passwordFile" ];
+      keyCommand = [ "pass" "wikis/katzenwiki/password" ];
       destDir = "/katzenwiki";
       name = "passwordFile";
     };
     "katzenwikiKeycloakClientSecret" = {
-      keyCommand = [ "cat" "/home/jade/keys-tmp/katzenwiki-keycloak-secret" ];
+      keyCommand = [ "pass" "wikis/katzenwiki/keycloak-secret" ];
       destDir = "/katzenwiki";
       name = "keycloakClientSecret";
       permissions = "0604";

modules/containers/nextcloud.nix

@@ -56,7 +56,7 @@
   };
   deployment.keys = {
     "nextcloud-admin-pass" = {
-      keyCommand = [ "cat" "/home/jade/keys-tmp/nextcloud-admin-pass" ];
+      keyCommand = [ "pass" "nextcloud/admin-password" ];
       destDir = "/nextcloud/secret";
       permissions = "0604";
     };

modules/containers/penpot.nix

@@ -84,7 +84,7 @@
   };
   deployment.keys = {
     "penpot-secrets" = {
-      keyCommand = [ "cat" "/home/jade/keys-tmp/penpot-secrets" ];
+      keyCommand = [ "pass" "penpot/envfile" ];
       destDir = "/var/lib/secrets";
     };
   };

modules/containers/phtanumb-wiki.nix

@@ -109,11 +109,11 @@
   };
   deployment.keys = {
     "passwordFile" = {
-      keyCommand = [ "cat" "/home/jade/keys-tmp/phtanumb-wiki-passwordFile" ];
+      keyCommand = [ "pass" "wikis/phtanumb/password" ];
       destDir = "/phtanum-b/wiki";
     };
     "keycloakClientSecret" = {
-      keyCommand = [ "cat" "/home/jade/keys-tmp/phtanumb-wiki-keycloak-secret" ];
+      keyCommand = [ "pass" "wikis/phtanumb/keycloak-secret" ];
       destDir = "/phtanum-b/wiki";
       permissions = "0604";
     };

modules/forgejo.nix

@@ -42,7 +42,7 @@
   };
   deployment.keys = {
     "noreply-mail-pw-plain" = {
-      keyCommand = [ "cat" "/home/jade/keys-tmp/noreply-mail-pw-plain" ];
+      keyCommand = [ "pass" "mailpws/plain/noreply" ];
       destDir = "/var/lib/secrets";
       permissions = "0604";
     };

modules/keycloak.nix

@@ -29,7 +29,7 @@
     };
   };
   deployment.keys."keycloakDbPw" = {
-    keyCommand = [ "cat" "/home/jade/keys-tmp/keycloak-db" ];
+    keyCommand = [ "pass" "keycloak/db-pass" ];
     destDir = "/var/lib/secrets";
   };
 }

modules/mailserver.nix

@@ -19,11 +19,11 @@
   };
   deployment.keys = {
     "admin-mail-pw" = {
-      keyCommand = [ "cat" "/home/jade/keys-tmp/admin-mail-pw" ];
+      keyCommand = [ "pass" "mailpws/hashes/admin" ];
       destDir = "/var/lib/secrets";
     };
     "noreply-mail-pw" = {
-      keyCommand = [ "cat" "/home/jade/keys-tmp/noreply-mail-pw" ];
+      keyCommand = [ "pass" "mailpws/hashes/noreply" ];
       destDir = "/var/lib/secrets";
     };
   };

modules/proxy.nix

@@ -177,13 +177,6 @@
           add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
           '';
       };
-      "hc-vault.katzen.cafe" = {
-        forceSSL = true;
-        enableACME = true;
-        locations."/" = {
-          proxyPass = "http://127.0.0.1:8200";
-        };
-      };
     };
   };
 }