Nextcloud: Difference between revisions

Raboof (talk | contribs)
Maintenance: options to carry over, link to ACME DNS Challenge docs
Raboof (talk | contribs)
Secrets management: don't recommend putting secrets in environment.etc
Line 208: Line 208:
Do not suply passwords, hashes or keys via the settings option, since they will be copied into the world-readable Nix store. Instead reference a JSON file containing secrets using the <code>secretFile</code> option.
Do not suply passwords, hashes or keys via the settings option, since they will be copied into the world-readable Nix store. Instead reference a JSON file containing secrets using the <code>secretFile</code> option.


<syntaxHighlight lang="nix">
<syntaxhighlight lang="nix">
services.nextcloud = {
services.nextcloud = {
   [...]
   [...]
   secretFile = "/etc/nextcloud-secrets.json";
   secretFile = "/etc/nextcloud-secrets.json";
};
};
 
</syntaxhighlight>
environment.etc."nextcloud-secrets.json".text = ''
  {
    "passwordsalt": "12345678910",
    "secret": "12345678910",
    "instanceid": "10987654321",
    "redis": {
      "password": "secret"
    }
  }
'';
</syntaxHighlight>


Consider using a  [[Comparison of secret managing schemes|secret management tool]] instead of referencing an unencrypted local secrets file.
Consider using a  [[Comparison of secret managing schemes|secret management tool]] instead of referencing an unencrypted local secrets file.