Harald Hoyer
01f42c0851
Wire up restartUnits on secrets whose consumers cache them in memory (daemons read at startup), so sops-nix restarts the affected unit on activation when the decrypted content changes: - firefly: app_key → phpfpm-firefly-iii; auto_import_secret + access_token → phpfpm-firefly-iii-data-importer - searx: secret_key → uwsgi - opencode: web password → opencode-serve - mail: sasl_passwd → postfix - forgejo: gitea_dbpass → forgejo; runner-token → gitea-runner-default Secrets read on demand by oneshots/timers (firefly sparda_pin, ntfy token, restic backup creds, acme dns creds, wg conf) are left as-is.
42 lines
812 B
Nix
42 lines
812 B
Nix
{ pkgs, config, ... }:
|
|
{
|
|
sops.secrets."searx/secret_key" = {
|
|
sopsFile = ../../../.secrets/sgx/searx.yaml;
|
|
restartUnits = [ "uwsgi.service" ];
|
|
};
|
|
|
|
services.searx = {
|
|
enable = true;
|
|
configureNginx = true;
|
|
domain = "search.hoyer.world";
|
|
uwsgiConfig = {
|
|
http = ":8081";
|
|
};
|
|
settings = {
|
|
server = {
|
|
secret_key = config.sops.secrets."searx/secret_key".path;
|
|
};
|
|
search.formats = [
|
|
"html"
|
|
"json"
|
|
"rss"
|
|
];
|
|
};
|
|
};
|
|
|
|
services.nginx.virtualHosts = {
|
|
"search.hoyer.world" = {
|
|
enableACME = false;
|
|
useACMEHost = "search.hoyer.world";
|
|
forceSSL = true;
|
|
};
|
|
};
|
|
|
|
security.acme.certs = {
|
|
"internal.hoyer.world" = {
|
|
extraDomainNames = [
|
|
"search.hoyer.world"
|
|
];
|
|
};
|
|
};
|
|
}
|