From b9f8e595b78982e7d312153d26ac5fb8cfcabde5 Mon Sep 17 00:00:00 2001
From: "Ricardo (XenGi) Band" <email@ricardo.band>
Date: Fri, 31 Jul 2026 19:53:52 +0200
Subject: [PATCH] adapt secrets

---
 flake.nix | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/flake.nix b/flake.nix
index aa0caea..c03d5d2 100644
--- a/flake.nix
+++ b/flake.nix
@@ -238,29 +238,35 @@
           { environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
           {
             age.secrets = {
-              forgejo-internal-token = {
-                file = ./secrets/forgejo-internal-token.age;
-                mode = "440";
+              postgres-forgejo = {
+                file = ./secrets/postgres-forgejo.age;
                 owner = "forgejo";
                 group = "forgejo";
+                mode = "0400";
+              };
+              forgejo-internal-token = {
+                file = ./secrets/forgejo-internal-token.age;
+                owner = "forgejo";
+                group = "forgejo";
+                mode = "0440";
               };
               forgejo-secret-key = {
                 file = ./secrets/forgejo-secret-key.age;
-                mode = "440";
                 owner = "forgejo";
                 group = "forgejo";
+                mode = "0440";
               };
               forgejo-runner-token-snowden = {
                 file = ./secrets/forgejo-runner-token-snowden.age;
-                mode = "444";
                 owner = "root";
                 group = "root";
+                mode = "0444";
               };
               forgejo-runner-token-snowden-env = {
                 file = ./secrets/forgejo-runner-token-snowden-env.age;
-                mode = "444";
                 owner = "root";
                 group = "root";
+                mode = "0444";
               };
             };
           }