jalr/nixos-configuration
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix handling of secrets

Browse source
This commit is contained in:
Jakob Lechner 2024-11-08 18:11:29 +01:00
parent 27309cea2c
commit e573cde83f
1 changed files with 7 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

22
hosts/iron/services/esphome/default.nix
View file

@ -2,9 +2,6 @@ args@{ lib, pkgs, config, custom-utils, ... }:
let
ports = import ../../ports.nix args;
cfg = config.services.esphome;
devices = [
./yeelight-meteorite.yaml
];
cfgdir = pkgs.stdenvNoCC.mkDerivation {
name = "esphome-config";
src = ./devices;
@ -22,6 +19,7 @@ in
{
sops.secrets.esphome = {
sopsFile = ../../secrets.yaml;
restartUnits = [ config.systemd.services.esphome.name ];
};
services.esphome = {
@ -29,11 +27,6 @@ in
address = "127.0.0.1";
port = ports.esphome.tcp;
package = pkgs.esphome;
#package = pkgs.esphome.overrideAttrs (attrs: {
# makeWrapperArgs = attrs.makeWrapperArgs ++ [
# "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ pkgs.stdenv.cc.cc.lib ]}"
# ];
#});
};
systemd.services.esphome = {
@ -41,13 +34,13 @@ in
"PLATFORMIO_CORE_DIR" = lib.mkForce "/tmp/.platformio";
};
serviceConfig = {
BindPaths = [
"/var/lib/esphome"
"/var/lib/private/esphome"
];
BindReadOnlyPaths = [
"/nix/store"
"${cfgdir}"
cfgdir
"%d/secrets.yaml:/var/lib/esphome/secrets.yaml"
];
BindPaths = [
"/var/lib/esphome"
];
DeviceAllow = [
"char-ttyACM rw"
@ -55,8 +48,7 @@ in
"char-ttyUSB rw"
];
ExecStartPre = [
"${pkgs.rsync}/bin/rsync -a --delete --exclude=.esphome --exclude=.platformio --exclude=.gitignore '${cfgdir}/' '/var/lib/esphome/'"
"${pkgs.coreutils}/bin/ln -snf '%d/secrets.yaml' '/var/lib/esphome/secrets.yaml'"
"${pkgs.rsync}/bin/rsync -a --delete --checksum --exclude secrets.yaml --exclude=.esphome --exclude=.platformio --exclude=.gitignore '${cfgdir}/' '/var/lib/esphome/'"
];
LoadCredential = "secrets.yaml:${config.sops.secrets.esphome.path}";
PrivateTmp = true;