From 341e3a0e1c27f2acf0aaffce1b5cdaf1e544b3d2 Mon Sep 17 00:00:00 2001 From: yukkop Date: Fri, 5 Jun 2026 12:42:55 +0000 Subject: [PATCH] feat: atticd to S3 --- nixos/module/hectic/service/attic.nix | 58 ++++++++++++++------------ nixos/system/hectic-lab/attic.nix | 15 +++++-- nixos/system/hectic-lab/hectic-lab.nix | 1 + sus/hectic-lab.yaml | 12 ++---- 4 files changed, 49 insertions(+), 37 deletions(-) diff --git a/nixos/module/hectic/service/attic.nix b/nixos/module/hectic/service/attic.nix index 702fd4d0..9f6d6d4f 100644 --- a/nixos/module/hectic/service/attic.nix +++ b/nixos/module/hectic/service/attic.nix @@ -1,11 +1,9 @@ { ... }: { - pkgs, lib, config, ... }: let cfg = config.hectic.services.attic; - environmentFile = "/var/lib/atticd/credentials.env"; in { options.hectic.services.attic = { enable = lib.mkEnableOption "Attic binary cache server"; @@ -27,40 +25,48 @@ in { description = "Local port atticd binds to behind the reverse proxy."; }; - }; - - config = lib.mkIf cfg.enable { - systemd.services.atticd-credentials = { - description = "Generate persistent atticd credentials"; - before = [ "atticd.service" ]; - wantedBy = [ "atticd.service" ]; - serviceConfig = { - Type = "oneshot"; - StateDirectory = "atticd"; - UMask = "0077"; - }; - script = '' - if [ -s ${environmentFile} ]; then - exit 0 - fi - - install -m 0700 -d /var/lib/atticd - secret="$(${lib.getExe pkgs.openssl} genrsa -traditional 4096 | ${pkgs.coreutils}/bin/base64 -w0)" - cat > ${environmentFile} <