rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

router-ui: read the Forgejo token via LoadCredential

Browse source 
Service runs as router-ui; /var/secrets is root-only 0600.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
rope 2026-08-15 12:19:21 +01:00
parent 2f1e14495b
commit 355e696c43
1 changed files with 7 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
services/router-ui.nix
View file

@ -121,7 +121,10 @@ in
FORGEJO_API = "https://forg.gregersen.it/api/v1"; FORGEJO_API = "https://forg.gregersen.it/api/v1";
FORGEJO_REPO = "rope/nixos"; FORGEJO_REPO = "rope/nixos";
FORGEJO_BRANCH = "main"; FORGEJO_BRANCH = "main";
FORGEJO_TOKEN_FILE = "/var/secrets/forgejo-router-token"; # systemd reads the real file as root and drops a copy in the unit's
# credentials dir, owned by the service user. Keeps /var/secrets
# uniformly root-only 0600 like every other secret on this box.
FORGEJO_TOKEN_FILE = "%d/forgejo-token";
WAN_IF = "eno1"; WAN_IF = "eno1";
LAN_IF = "eth0"; LAN_IF = "eth0";
LAN_PREFIX = "10.0.0."; LAN_PREFIX = "10.0.0.";
@ -141,6 +144,9 @@ in
User = "router-ui"; User = "router-ui";
Group = "router-ui"; Group = "router-ui";
StateDirectory = "router-ui"; StateDirectory = "router-ui";
# Note: the unit refuses to start if this file is missing. That's the
# loud failure we want — without it the UI can't read or write config.
LoadCredential = [ "forgejo-token:/var/secrets/forgejo-router-token" ];
Restart = "on-failure"; Restart = "on-failure";
RestartSec = 5; RestartSec = 5;
# Reads /var/secrets/forgejo-router-token, so it can't be fully locked # Reads /var/secrets/forgejo-router-token, so it can't be fully locked