From b9f8e595b78982e7d312153d26ac5fb8cfcabde5 Mon Sep 17 00:00:00 2001
From: "Ricardo (XenGi) Band" <email@ricardo.band>
Date: Fri, 31 Jul 2026 19:53:52 +0200
Subject: [PATCH 1/2] adapt secrets

---
 flake.nix | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/flake.nix b/flake.nix
index aa0caea..c03d5d2 100644
--- a/flake.nix
+++ b/flake.nix
@@ -238,29 +238,35 @@
           { environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
           {
             age.secrets = {
-              forgejo-internal-token = {
-                file = ./secrets/forgejo-internal-token.age;
-                mode = "440";
+              postgres-forgejo = {
+                file = ./secrets/postgres-forgejo.age;
                 owner = "forgejo";
                 group = "forgejo";
+                mode = "0400";
+              };
+              forgejo-internal-token = {
+                file = ./secrets/forgejo-internal-token.age;
+                owner = "forgejo";
+                group = "forgejo";
+                mode = "0440";
               };
               forgejo-secret-key = {
                 file = ./secrets/forgejo-secret-key.age;
-                mode = "440";
                 owner = "forgejo";
                 group = "forgejo";
+                mode = "0440";
               };
               forgejo-runner-token-snowden = {
                 file = ./secrets/forgejo-runner-token-snowden.age;
-                mode = "444";
                 owner = "root";
                 group = "root";
+                mode = "0444";
               };
               forgejo-runner-token-snowden-env = {
                 file = ./secrets/forgejo-runner-token-snowden-env.age;
-                mode = "444";
                 owner = "root";
                 group = "root";
+                mode = "0444";
               };
             };
           }

From 6622d5ee88f973a04e95381e2e03eacdde25df60 Mon Sep 17 00:00:00 2001
From: "Ricardo (XenGi) Band" <email@ricardo.band>
Date: Fri, 31 Jul 2026 19:54:44 +0200
Subject: [PATCH 2/2] fix path

---
 hosts/git/forgejo.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hosts/git/forgejo.nix b/hosts/git/forgejo.nix
index 1a78101..c358b1d 100644
--- a/hosts/git/forgejo.nix
+++ b/hosts/git/forgejo.nix
@@ -51,7 +51,7 @@ in
         createDatabase = false;
         host = "sql.${config.networking.domain}";
         name = "git";
-        passwordFile = config.age.secrets.postgresql_forgejo.path;
+        passwordFile = config.age.secrets.postgresql-forgejo.path;
         port = 5432;
         user = "git";
         type = "postgres";