Make access and secret keys parameters

deployment/flake-part.nix

@@ -80,7 +80,13 @@ in
           fediversity = {
             enable = true;
             domain = "fedi101.abundos.eu";
-            pixelfed.enable = true;
+            pixelfed = {
+              enable = true;
+
+              ## NOTE: Only ever used for testing anyway.
+              s3AccessKey = "GKb5615457d44214411e673b7b";
+              s3SecretKey = "5be6799a88ca9b9d813d1a806b64f15efa49482dbe15339ddfaf7f19cf434987";
+            };
           };
         };
 
@@ -88,7 +94,13 @@ in
           fediversity = {
             enable = true;
             domain = "fedi102.abundos.eu";
-            mastodon.enable = true;
+            mastodon = {
+              enable = true;
+
+              ## NOTE: Only ever used for testing anyway.
+              s3AccessKey = "GK3515373e4c851ebaad366558";
+              s3SecretKey = "7d37d093435a41f2aab8f13c19ba067d9776c90215f56614adad6ece597dbb34";
+            };
 
             temp.cores = 1; # FIXME: should come from NixOps4 eventually
           };
@@ -102,9 +114,11 @@ in
               domain = "fedi103.abundos.eu";
               peertube = {
                 enable = true;
-                secretsFile = pkgs.writeText "secret" ''
+
-                  574e093907d1157ac0f8e760a6deb1035402003af5763135bae9cbd6abe32b24
+                ## NOTE: Only ever used for testing anyway.
-                '';
+                secretsFile = pkgs.writeText "secret" "574e093907d1157ac0f8e760a6deb1035402003af5763135bae9cbd6abe32b24";
+                s3AccessKey = "GK1f9feea9960f6f95ff404c9b";
+                s3SecretKey = "7295c4201966a02c2c3d25b5cea4a5ff782966a2415e3a196f91924631191395";
               };
             };
           }

services/fediversity/garage/default.nix

@@ -83,13 +83,13 @@ let
   ensureKeyScriptFn =
     key:
     {
-      id,
+      s3AccessKey,
-      secret,
+      s3SecretKey,
       ensureAccess,
     }:
     ''
       ## FIXME: Check whether the key exist and skip this step if that is the case. Get rid of this `|| :`
-      garage key import --yes -n ${escapeShellArg key} ${escapeShellArg id} ${escapeShellArg secret} || :
+      garage key import --yes -n ${escapeShellArg key} ${escapeShellArg s3AccessKey} ${escapeShellArg s3SecretKey} || :
       ${concatMapAttrs (ensureAccessScriptFn key) ensureAccess}
     '';
 

services/fediversity/garage/options.nix

@@ -45,8 +45,8 @@ in
         types.submodule {
           # TODO: these should be managed as secrets, not in the nix store
           options = {
-            id = mkOption { type = types.str; };
+            s3AccessKey = mkOption { type = types.str; };
-            secret = mkOption { type = types.str; };
+            s3SecretKey = mkOption { type = types.str; };
             # TODO: assert at least one of these is true
             # NOTE: this currently needs to be done at the top level module
             ensureAccess = mkOption {

services/fediversity/mastodon/default.nix

@@ -1,10 +1,3 @@
-let
-  snakeoil_key = {
-    id = "GK3515373e4c851ebaad366558";
-    secret = "7d37d093435a41f2aab8f13c19ba067d9776c90215f56614adad6ece597dbb34";
-  };
-in
-
 { config, lib, ... }:
 
 {
@@ -24,9 +17,10 @@ in
           };
         };
       };
+
       ensureKeys = {
         mastodon = {
-          inherit (snakeoil_key) id secret;
+          inherit (config.fediversity.mastodon) s3AccessKey s3SecretKey;
           ensureAccess = {
             mastodon = {
               read = true;
@@ -37,6 +31,7 @@ in
         };
       };
     };
+
     services.mastodon = {
       extraConfig = rec {
         S3_ENABLED = "true";
@@ -46,8 +41,8 @@ in
         S3_BUCKET = "mastodon";
         # use <S3_BUCKET>.<S3_ENDPOINT>
         S3_OVERRIDE_PATH_STLE = "true";
-        AWS_ACCESS_KEY_ID = snakeoil_key.id;
+        AWS_ACCESS_KEY_ID = config.fediversity.mastodon.s3AccessKey;
-        AWS_SECRET_ACCESS_KEY = snakeoil_key.secret;
+        AWS_SECRET_ACCESS_KEY = config.fediversity.mastodon.s3SecretKey;
         S3_PROTOCOL = "http";
         S3_ALIAS_HOST = "${S3_BUCKET}.${config.fediversity.garage.web.rootDomain}";
         # SEE: the last section in https://docs.joinmastodon.org/admin/optional/object-storage/

services/fediversity/mastodon/options.nix

@@ -9,6 +9,23 @@ in
   options.fediversity.mastodon = {
     enable = mkEnableOption "Enable a Mastodon server on the machine";
 
+    s3AccessKey = mkOption {
+      type = types.str;
+      description = ''
+        S3 access key
+
+        In AWS CLI, this would be AWS_ACCESS_KEY_ID.
+      '';
+    };
+
+    s3SecretKey = mkOption {
+      description = ''
+        S3 secret key
+
+        In AWS CLI, this would be AWS_SECRET_ACCESS_KEY.
+      '';
+    };
+
     domain = mkOption {
       type = types.str;
       description = "Internal option — change at your own risk";

services/fediversity/peertube/default.nix

@@ -1,10 +1,3 @@
-let
-  snakeoil_key = {
-    id = "GK1f9feea9960f6f95ff404c9b";
-    secret = "7295c4201966a02c2c3d25b5cea4a5ff782966a2415e3a196f91924631191395";
-  };
-in
-
 { config, lib, ... }:
 
 {
@@ -43,9 +36,10 @@ in
           };
         };
       };
+
       ensureKeys = {
         peertube = {
-          inherit (snakeoil_key) id secret;
+          inherit (config.fediversity.peertube) s3AccessKey s3SecretKey;
           ensureAccess = {
             peertube-videos = {
               read = true;
@@ -104,8 +98,8 @@ in
       serviceEnvironmentFile = "/etc/peertube-env";
     };
     environment.etc.peertube-env.text = ''
-      AWS_ACCESS_KEY_ID=${snakeoil_key.id}
+      AWS_ACCESS_KEY_ID=${config.fediversity.peertube.s3AccessKey}
-      AWS_SECRET_ACCESS_KEY=${snakeoil_key.secret}
+      AWS_SECRET_ACCESS_KEY=${config.fediversity.peertube.s3SecretKey}
     '';
 
     ## Proxying through Nginx

services/fediversity/peertube/options.nix

@@ -9,6 +9,23 @@ in
   options.fediversity.peertube = {
     enable = mkEnableOption "Enable a PeerTube server on the machine";
 
+    s3AccessKey = mkOption {
+      type = types.str;
+      description = ''
+        S3 access key
+
+        In AWS CLI, this would be AWS_ACCESS_KEY_ID.
+      '';
+    };
+
+    s3SecretKey = mkOption {
+      description = ''
+        S3 secret key
+
+        In AWS CLI, this would be AWS_SECRET_ACCESS_KEY.
+      '';
+    };
+
     domain = mkOption {
       type = types.str;
       description = "Internal option — change at your own risk";

services/fediversity/pixelfed/default.nix

@@ -1,10 +1,3 @@
-let
-  snakeoil_key = {
-    id = "GKb5615457d44214411e673b7b";
-    secret = "5be6799a88ca9b9d813d1a806b64f15efa49482dbe15339ddfaf7f19cf434987";
-  };
-in
-
 {
   config,
   lib,
@@ -12,10 +5,14 @@ in
   ...
 }:
 
+let
+  inherit (lib) mkIf;
+
+in
 {
   imports = [ ./options.nix ];
 
-  config = lib.mkIf (config.fediversity.enable && config.fediversity.pixelfed.enable) {
+  config = mkIf (config.fediversity.enable && config.fediversity.pixelfed.enable) {
     fediversity.garage = {
       ensureBuckets = {
         pixelfed = {
@@ -29,9 +26,10 @@ in
           };
         };
       };
+
       ensureKeys = {
         pixelfed = {
-          inherit (snakeoil_key) id secret;
+          inherit (config.fediversity.pixelfed) s3AccessKey s3SecretKey;
           ensureAccess = {
             pixelfed = {
               read = true;
@@ -70,11 +68,10 @@ in
       ## `fediversity.openRegistration` option.
       OPEN_REGISTRATION = true;
 
-      # DANGEROUSLY_SET_FILESYSTEM_DRIVER = "s3";
       FILESYSTEM_CLOUD = "s3";
       PF_ENABLE_CLOUD = true;
-      AWS_ACCESS_KEY_ID = snakeoil_key.id;
+      AWS_ACCESS_KEY_ID = config.fediversity.pixelfed.s3AccessKey;
-      AWS_SECRET_ACCESS_KEY = snakeoil_key.secret;
+      AWS_SECRET_ACCESS_KEY = config.fediversity.pixelfed.s3SecretKey;
       AWS_DEFAULT_REGION = "garage";
       AWS_URL = config.fediversity.garage.web.urlForBucket "pixelfed";
       AWS_BUCKET = "pixelfed";

services/fediversity/pixelfed/options.nix

@@ -9,6 +9,23 @@ in
   options.fediversity.pixelfed = {
     enable = mkEnableOption "Enable a Pixelfed server on the machine";
 
+    s3AccessKey = mkOption {
+      type = types.str;
+      description = ''
+        S3 access key
+
+        In AWS CLI, this would be AWS_ACCESS_KEY_ID.
+      '';
+    };
+
+    s3SecretKey = mkOption {
+      description = ''
+        S3 secret key
+
+        In AWS CLI, this would be AWS_SECRET_ACCESS_KEY.
+      '';
+    };
+
     domain = mkOption {
       type = types.str;
       description = "Internal option — change at your own risk";