hedgedoc: persists session secret

flake.nix

@@ -397,6 +397,9 @@
         hedgedoc = nixosSystem' {
           modules = [
             self.nixosModules.microvm
+            {
+              sops.defaultSopsFile = "${secrets}/hosts/hedgedoc/secrets.yaml";
+            }
             ./hosts/containers/hedgedoc
           ];
         };

hosts/containers/hedgedoc/default.nix

@@ -33,6 +33,7 @@
         };
         defaultPermission = "freely";
         domain = "codimd.c3d2.de";
+        sessionSecret = "$sessionSecret";
         useSSL = true;
       };
     };
@@ -74,4 +75,11 @@
       package = pkgs.postgresql_14;
     };
   };
+
+  sops = {
+    age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+    secrets = {
+      "hedgedoc".owner = config.systemd.services.hedgedoc.serviceConfig.User;
+    };
+  };
 }