c3d2/nix-config
c3d2
/
nix-config
24
7
Fork 3
Code Issues 12 Pull Requests 2 Releases Wiki Activity

Restrict secrets

This commit is contained in:
Sandro - 2022-12-05 01:57:19 +01:00
parent 2a0920904b
commit 58c4f8bec5
Signed by: sandro
GPG Key ID: 3AF5A43A3EECC2E5
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
hosts/hydra/hydra.nix
View File

@ -152,7 +152,11 @@ in
sops = {
defaultSopsFile = ./secrets.yaml;
secrets."nix-serve/secretKey".mode = "0444";
secrets."nix-serve/secretKey" = {
mode = "440";
owner = config.users.users.hydra-queue-runner.name;
inherit (config.users.users.hydra-queue-runner) group;
};
};
systemd.services = {
@ -185,4 +189,7 @@ in
MemorySwapMax = "64G";
};
};
# allow reading nix-serve secret
users.users.harmonia.extraGroups = [ "hydra" ];
}