Adopts secret-based environment configs

- Generates Cloudflare configuration at build time
- Replaces static environment files with secret-driven configuration for containers
- Unifies environment settings for authentik and komodo

hosts/common/optional/acme/default.nix

@@ -1,9 +1,16 @@
 {
-  config,
-  lib,
   pkgs,
+  config,
   ...
 }:
+let
+  cloudflare = pkgs.writeTextFile {
+    name = "cloudflare.ini";
+    text = ''
+      CF_DNS_API_TOKEN=${config.secretsSpec.api.cloudflare}
+    '';
+  };
+in
 {
 
   # letsencrypt
@@ -12,7 +19,7 @@
     defaults = {
       email = "chris@toph.cc";
       dnsProvider = "cloudflare";
-      environmentFile = ./cloudflare.ini;
+      environmentFile = cloudflare;
     };
     certs = {
       "goldenlemon.cc" = {

hosts/common/optional/containers/authentik/default.nix

@@ -4,14 +4,13 @@
 let
   # Only available in the Komodo LXC
   DockerStorage = "/mnt/DockerStorage/komodo/stacks/authentik";
+  env = config.secretsSpec.docker.authentik;
 in
 {
   # Containers
   virtualisation.oci-containers.containers."authentik-postgresql" = {
     image = "docker.io/library/postgres:16-alpine";
-    environmentFiles = [
+    environment = env;
-      ./authentik.env
-    ];
     volumes = [
       "${DockerStorage}/database:/var/lib/postgresql/data:rw"
     ];
@@ -48,9 +47,7 @@ in
   };
   virtualisation.oci-containers.containers."authentik-redis" = {
     image = "docker.io/library/redis:alpine";
-    environmentFiles = [
+    environment = env;
-      ./authentik.env
-    ];
     volumes = [
       "${DockerStorage}/redis:/data:rw"
     ];
@@ -94,9 +91,7 @@ in
   };
   virtualisation.oci-containers.containers."authentik-server" = {
     image = "ghcr.io/goauthentik/server:2024.12.2";
-    environmentFiles = [
+    environment = env;
-      ./authentik.env
-    ];
     volumes = [
       "${DockerStorage}/custom-templates:/templates:rw"
       "${DockerStorage}/media:/media:rw"
@@ -138,9 +133,7 @@ in
   };
   virtualisation.oci-containers.containers."authentik-worker" = {
     image = "ghcr.io/goauthentik/server:2024.12.2";
-    environmentFiles = [
+    environment = env;
-      ./authentik.env
-    ];
     volumes = [
       "${DockerStorage}/certs:/certs:rw"
       "${DockerStorage}/media:/media:rw"

hosts/common/optional/containers/komodo/default.nix

@@ -8,14 +8,13 @@
 let
   # Only available in the Komodo LXC
   DockerStorage = "/mnt/DockerStorage/komodo";
+  env = config.secretsSpec.docker.komodo;
 in
 {
   # Containers
   virtualisation.oci-containers.containers."komodo-core" = {
     image = "ghcr.io/moghtech/komodo-core:latest";
-    environmentFiles = [
+    environment = env;
-      ./komodo.env
-    ];
     volumes = [
       "${DockerStorage}/cache:/repo-cache:rw"
     ];
@@ -61,9 +60,7 @@ in
 
   virtualisation.oci-containers.containers."komodo-mongo" = {
     image = "mongo";
-    environmentFiles = [
+    environment = env;
-      ./komodo.env
-    ];
     volumes = [
       "${DockerStorage}/mongo/config:/data/configdb:rw"
       "${DockerStorage}/mongo/data:/data/db:rw"
@@ -110,9 +107,7 @@ in
 
   virtualisation.oci-containers.containers."komodo-periphery" = {
     image = "ghcr.io/moghtech/komodo-periphery:latest";
-    environmentFiles = [
+    environment = env;
-      ./komodo.env
-    ];
     volumes = [
       "/proc:/proc:rw"
       "/var/run/docker.sock:/var/run/docker.sock:rw"