Allow media server to fetch private Loupe flake

services/prebuild.nix

@@ -12,6 +12,36 @@
 { config, lib, pkgs, ... }:
 
 let
+  loupeCredential = pkgs.writeShellScript "forgejo-loupe-credential" ''
+    [ "''${1:-}" = get ] || exit 0
+    protocol= host= path=
+    while IFS='=' read -r key value; do
+      case "$key" in
+        protocol) protocol=$value ;;
+        host) host=$value ;;
+        path) path=$value ;;
+      esac
+    done
+    [ "$protocol" = https ] && [ "$host" = forg.gregersen.it ] || exit 0
+    case "$path" in
+      lazzexus/Loupe|lazzexus/Loupe.git) ;;
+      *) exit 0 ;;
+    esac
+
+    # Prefer a dedicated token. The router token can work too when it has
+    # read access to the private Loupe repository. Neither enters the store.
+    secret=/var/secrets/forgejo-loupe-token
+    [ -f "$secret" ] || secret=/var/secrets/forgejo-router-token
+    [ -f "$secret" ] || exit 0
+    if [ -r "$secret" ]; then
+      token=$(${pkgs.coreutils}/bin/cat "$secret")
+    else
+      token=$(/run/wrappers/bin/sudo -n ${pkgs.coreutils}/bin/cat "$secret") || exit 0
+    fi
+    [ -n "$token" ] || exit 0
+    printf 'username=rope\npassword=%s\n' "$token"
+  '';
+
   mkService = host: {
     description = "Pre-build the ${host} system closure";
     after = [ "network-online.target" ];
@@ -47,6 +77,17 @@ let
 in
 {
   config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
+    # Nix's git+https input fetch uses Git outside the build sandbox. Both the
+    # root prebuild timer and fred's SSH-triggered rebuilds read credentials at
+    # fetch time, without putting a private token in flake.lock or /nix/store.
+    programs.git = {
+      enable = true;
+      config.credential = {
+        useHttpPath = true;
+        "https://forg.gregersen.it".helper = "${loupeCredential}";
+      };
+    };
+
     systemd.services = {
       prebuild-macbook = mkService "FredOS-Macbook";
       prebuild-gaming = mkService "FredOS-Gaming";