Unverified Commit 40171764 authored by oddlama's avatar oddlama
Browse files

nixos/actual: allow specifying secretus using genJqSecretsReplacementSnippet

parent 5f36f3ef

nixos/modules/services/web-apps/actual.nix

+13 −3
Original line number Diff line number Diff line
@@ -2,6 +2,7 @@ 
  lib,

  pkgs,

  config,

  utils,

  ...

}:

let
@@ -16,7 +17,6 @@ let 
    ;



  cfg = config.services.actual;

  configFile = formatType.generate "config.json" cfg.settings;

  dataDir = "/var/lib/actual";



  formatType = pkgs.formats.json { };
@@ -34,7 +34,10 @@ in 


    settings = mkOption {

      default = { };

      description = "Server settings, refer to [the documentation](https://actualbudget.org/docs/config/) for available options.";

      description = ''

        Server settings, refer to [the documentation](https://actualbudget.org/docs/config/) for available options.

        You can specify secret values in this configuration by setting `somevalue._secret = "/path/to/file"` instead of setting `somevalue` directly.

      '';

      type = types.submodule {

        freeformType = formatType.type;
@@ -68,13 +71,20 @@ in 
      description = "Actual server, a local-first personal finance app";

      after = [ "network.target" ];

      wantedBy = [ "multi-user.target" ];

      environment.ACTUAL_CONFIG_PATH = configFile;

      environment.ACTUAL_CONFIG_PATH = "/run/actual/config.json";



      preStart = ''

        # Generate config including secret values.

        ${utils.genJqSecretsReplacementSnippet cfg.settings "/run/actual/config.json"}

      '';



      serviceConfig = {

        ExecStart = getExe cfg.package;

        DynamicUser = true;

        User = "actual";

        Group = "actual";

        StateDirectory = "actual";

        RuntimeDirectory = "actual";

        WorkingDirectory = dataDir;

        LimitNOFILE = "1048576";

        PrivateTmp = true;