sdrweb: use a sops passwordFile for heliwatch

flake.lock

@@ -278,11 +278,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1695426234,
-        "narHash": "sha256-fPLVqhGt9G72MrKrnal31ovp2NXpy4PT6uGV9+BYxtk=",
+        "lastModified": 1712974579,
+        "narHash": "sha256-nEGN+onff81EuGmscFOBQDkmThujvKn3MlJKpJ6p5us=",
         "ref": "refs/heads/master",
-        "rev": "bb82574d4a36b743b8678e23a0cd3c8b0eaf1821",
-        "revCount": 68,
+        "rev": "ade76b343fce28dedd3973a44f4e4eff5b16bc57",
+        "revCount": 71,
         "type": "git",
         "url": "https://gitea.c3d2.de/astro/heliwatch.git"
       },

hosts/sdrweb/default.nix

@@ -1,4 +1,4 @@
-{ hostRegistry, pkgs, ... }:
+{ hostRegistry, config, pkgs, ... }:
 {
   microvm = {
     mem = 2048;
@@ -60,7 +60,7 @@
     heliwatch = {
       enable = true;
       jid = "astrobot@jabber.c3d2.de";
-      inherit (pkgs.mucbot) password;
+      passwordFile = config.sops.secrets."heliwatch/passwordFile".path;
       muc = "luftraum@chat.c3d2.de/Hubschraubereinsatz";
     };
 
@@ -95,5 +95,8 @@
     openwebrx.enable = true;
   };
 
-  sops.defaultSopsFile = ./secrets.yaml;
+  sops = {
+    defaultSopsFile = ./secrets.yaml;
+    secrets."heliwatch/passwordFile".owner = "heliwatch";
+  };
 }

hosts/sdrweb/secrets.yaml

@@ -2,6 +2,8 @@ restic:
     password: ENC[AES256_GCM,data:rF82Jo3uXFuTGfMNEkrWmJKTg4W0tSEp4RhWU91Us8E=,iv:6lNjPlSZoRhVNwhkiUUOyi9PyxsFCNeA6syNUPaJIa8=,tag:UTX8Vve6Zj3Un+A0uTihpg==,type:str]
     repositories:
         server9: ENC[AES256_GCM,data:ok/fhJJ7ABH6YfnP1o2DWpH8vbPwST8/7RwsASiQrWdkvyaC4jC4fAie1XofN8GcoC/55b56UbdnH8htdq2ulUVuIfsWHTUeVHbgIB60cum4+QfK/IxNBeV7J7A/7xjlubU=,iv:FAIZ+bhCojiQLVq8WTb/5NFkcV+kqcg6cxiv0wu1Dng=,tag:YB7OzI8jdYx0odqkTXGfFw==,type:str]
+heliwatch:
+    passwordFile: ENC[AES256_GCM,data:RovkihQU9uq1Iw==,iv:GZ/NBBsEi4KUydyMDC8TrktWKa/nDUP4JU5M78v6Y5c=,tag:FySsAVsocDer0X5znGrF/A==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -26,8 +28,8 @@ sops:
             T01GdFR0MWxwQkpuSjB3R21xdDZXR0UKGHXjDM1KiL8O+MV/TR0ZDTi14Aovklws
             qMIUH/4Sc8+HaMKGrwQYOzdUzLT+n4bsmYsz9H149y8MIpSxADsHJQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-12-11T23:44:29Z"
-    mac: ENC[AES256_GCM,data:i+aEE8xV3C4KaIVcTSW/Ynfebe/3XMnJRBQsHqw6vp3mb/bIoZOTu+CeRzdnRJR7gp8sR5wbNnqlKLzp0HNE3voBEf9oGdDZPdQuW2brAWsTiw9z271CAM+SKj/5K83xm6u8Qv7c1U67G/1Fn085lmr7FaFIZrto37j9p6d+v2w=,iv:W0wWlLOo1Ym2wqk7EJItWL4KRrJ/jmaynmzsxPraRL8=,tag:qrFOcgSIiXIbFp5uSY6AAg==,type:str]
+    lastmodified: "2024-04-13T02:21:09Z"
+    mac: ENC[AES256_GCM,data:m0BfbJbOQG5odFNxEQcnNFqbvcoGRi1QWZSl0AomFK0efP2JgDQrOEcsp1+LsBbuO1e+zndSEekGhqCpdJf3ZEXitPJYLjHUdVpSnONAh5LIQpe4QqmbLsGq7KxP1iWm9IscUplQxiJy5xRkA1AbmqDnh1e8NS/5Fk0YBz3b++M=,iv:hoMP3yruykzI6WpmMu6sF6oamKM/bftJALd9+LD3ZUM=,tag:rJnYnIN5J1UoHBZyPHgW9g==,type:str]
     pgp:
         - created_at: "2023-12-11T23:40:37Z"
           enc: |-