From 355e696c43c76cc7d116c7f87bdad9ea5f864d7f Mon Sep 17 00:00:00 2001 From: rope Date: Sat, 15 Aug 2026 12:19:21 +0100 Subject: [PATCH] router-ui: read the Forgejo token via LoadCredential Service runs as router-ui; /var/secrets is root-only 0600. Co-Authored-By: Claude Opus 5 --- services/router-ui.nix | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/services/router-ui.nix b/services/router-ui.nix index dcea633..00b3d36 100644 --- a/services/router-ui.nix +++ b/services/router-ui.nix @@ -121,7 +121,10 @@ in FORGEJO_API = "https://forg.gregersen.it/api/v1"; FORGEJO_REPO = "rope/nixos"; FORGEJO_BRANCH = "main"; - FORGEJO_TOKEN_FILE = "/var/secrets/forgejo-router-token"; + # systemd reads the real file as root and drops a copy in the unit's + # credentials dir, owned by the service user. Keeps /var/secrets + # uniformly root-only 0600 like every other secret on this box. + FORGEJO_TOKEN_FILE = "%d/forgejo-token"; WAN_IF = "eno1"; LAN_IF = "eth0"; LAN_PREFIX = "10.0.0."; @@ -141,6 +144,9 @@ in User = "router-ui"; Group = "router-ui"; StateDirectory = "router-ui"; + # Note: the unit refuses to start if this file is missing. That's the + # loud failure we want — without it the UI can't read or write config. + LoadCredential = [ "forgejo-token:/var/secrets/forgejo-router-token" ]; Restart = "on-failure"; RestartSec = 5; # Reads /var/secrets/forgejo-router-token, so it can't be fully locked