vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

read grafana's datasource key from the store into /run, seeding an empty store from the old file

Browse source
This commit is contained in:
atlas 2026-10-30 16:08:35 +01:00
commit 204abb1d0e
1 changed files with 236 additions and 69 deletions
Download patch file Download diff file Expand all files Collapse all files

5
nix/module-eval/grafana.nix
View file

@ -268,8 +268,9 @@ let
guest = m.containers.swarm-grafana.config;
earlier = "/var/lib/nixos-containers/swarm-grafana/var/lib/grafana-secret/secret_key";
in
lib.hasInfix "bao kv put -cas=0 secret/swarm/services/swarm-grafana/secret-key value=-" unit.script
&& lib.hasInfix "tr -d '\\n' < ${earlier}" unit.script
lib.hasInfix "bao kv put -cas=0 \"\$leaf\" value=-" unit.script
&& lib.hasInfix "grafana_secret_key secret/swarm/services/swarm-grafana/secret-key ${earlier} openssl rand -hex 32" unit.script
&& lib.length (lib.splitString earlier unit.script) == 2
&& lib.hasInfix "atomic_write_secret 0400 196:0 /run/swarm-grafana-secrets/secret-key" unit.script
&& lib.elem "container@swarm-grafana.service" unit.before
&& unit.environment.BAO_CLIENT_CERT == "/etc/pki/bao-grafana-oidc.pem"