none like _file somehow?

machines/dev/fedi203/woodpecker.nix

@@ -10,6 +10,29 @@
     defaults.email = "something@fediversity.eu";
   };
 
+  age.secrets = {
+    woodpecker-gitea-client = {
+      owner = "woodpecker-server";
+      group = "woodpecker-server";
+      mode = "440";
+    };
+    woodpecker-gitea-secret = {
+      owner = "woodpecker-server";
+      group = "woodpecker-server";
+      mode = "440";
+    };
+    woodpecker-agent-exec = {
+      owner = "woodpecker-agent-exec";
+      group = "woodpecker-agent-exec";
+      mode = "440";
+    };
+    woodpecker-agent-container = {
+      owner = "woodpecker-agent-docker";
+      group = "woodpecker-agent-docker";
+      mode = "440";
+    };
+  };
+
   # needs `sudo generate-vars`
   vars.settings.on-machine.enable = true;
 
@@ -108,6 +131,27 @@
         '';
       in
       {
+        # https://woodpecker-ci.org/docs/administration/configuration/server
+        "woodpecker-server.conf" = {
+          secret = true;
+          template = pkgs.writeText "woodpecker-server.conf" ''
+            WOODPECKER_DATABASE_DRIVER=sqlite3
+            WOODPECKER_DISABLE_USER_AGENT_REGISTRATION=false
+            WOODPECKER_OPEN=false
+            WOODPECKER_ADMIN=kiara,fricklerhandwerk,niols
+            WOODPECKER_HOST=https://woodpecker.fediversity.eu
+            WOODPECKER_GITEA=true
+            WOODPECKER_GITEA_URL=https://git.fediversity.eu
+            WOODPECKER_GITEA_CLIENT=${config.vars.generators.woodpecker.files.woodpecker-gitea-client.placeholder}
+            WOODPECKER_GITEA_SECRET=${config.vars.generators.woodpecker.files.woodpecker-gitea-secret.placeholder}
+            WOODPECKER_AGENT_SECRET=${config.vars.generators.woodpecker-agent-secret.files.my-secret.placeholder}
+            WOODPECKER_GRPC_SECRET=${config.vars.generators.woodpecker-rpc-secret.files.rpc-secret.placeholder}
+            WOODPECKER_LOG_LEVEL=info
+            WOODPECKER_DEFAULT_CLONE_PLUGIN=docker.io/woodpeckerci/plugin-git
+            WOODPECKER_SERVER_ADDR=:8000
+            WOODPECKER_GRPC_ADDR=:9000
+          '';
+        };
 
         # https://woodpecker-ci.org/docs/administration/configuration/backends/local#environment-variables
         "woodpecker-agent-exec.conf" = {
@@ -166,29 +210,7 @@
 
     woodpecker-server = {
       enable = true;
-
-      # https://woodpecker-ci.org/docs/administration/configuration/server
-      environment = {
-        WOODPECKER_DATABASE_DRIVER = "sqlite3";
-        WOODPECKER_DISABLE_USER_AGENT_REGISTRATION = "false";
-
-        WOODPECKER_OPEN = "false";
-        WOODPECKER_ADMIN = "kiara,fricklerhandwerk,niols";
-        WOODPECKER_HOST = "https://woodpecker.fediversity.eu";
-
-        WOODPECKER_GITEA = "true";
-        WOODPECKER_GITEA_URL = "https://git.fediversity.eu";
-        WOODPECKER_GITEA_CLIENT_FILE = config.age.secrets.woodpecker-gitea-client.path;
-        WOODPECKER_GITEA_SECRET_FILE = config.age.secrets.woodpecker-gitea-secret.path;
-
-        WOODPECKER_AGENT_SECRET_FILE = config.vars.generators.woodpecker-agent-secret.files.my-secret.path;
-        WOODPECKER_GRPC_SECRET_FILE = config.vars.generators.woodpecker-rpc-secret.files.rpc-secret.path;
-
-        WOODPECKER_LOG_LEVEL = "info";
-        WOODPECKER_DEFAULT_CLONE_PLUGIN = "docker.io/woodpeckerci/plugin-git";
-        WOODPECKER_SERVER_ADDR = ":8000";
-        WOODPECKER_GRPC_ADDR = ":9000";
-      };
+      environmentFile = config.vars.generators."templates".files."woodpecker-server.conf".path;
     };
 
     # https://woodpecker-ci.org/docs/administration/configuration/agent