From 9c71adbeb55d14bb7463b5d0fa3d273249f70a8b Mon Sep 17 00:00:00 2001
From: uku <hi@uku.moe>
Date: Sun, 12 Jul 2026 22:53:39 +0200
Subject: [PATCH] nixos/tests/matrix-authentication-service: use
 extraConfigFiles

nixos/tests/matrix-authentication-service: use extraConfigFiles
---
 .../matrix/matrix-authentication-service.nix  | 25 ++++++++++++-------
 1 file changed, 16 insertions(+), 9 deletions(-)

diff --git a/nixos/tests/matrix/matrix-authentication-service.nix b/nixos/tests/matrix/matrix-authentication-service.nix
index 9194b1fc56cd..19900b5a9c18 100644
--- a/nixos/tests/matrix/matrix-authentication-service.nix
+++ b/nixos/tests/matrix/matrix-authentication-service.nix
@@ -189,11 +189,26 @@ in
       { nodes, ... }:
       let
         bundle = mkBundle masDomain;
+
+        extraConfig = pkgs.writeText "masExtraConfig.yml" (
+          builtins.toJSON {
+            secrets = {
+              encryption_file = "/var/lib/matrix-authentication-service/encryption";
+              keys = [
+                {
+                  kid = "rsa-4096";
+                  key_file = "/var/lib/matrix-authentication-service/key_rsa_4096";
+                }
+              ];
+            };
+          }
+        );
       in
       {
         services.matrix-authentication-service = {
           enable = true;
           createDatabase = true;
+          extraConfigFiles = [ (toString extraConfig) ];
           settings = {
             http = {
               public_base = "https://${masDomain}:8080/";
@@ -223,15 +238,7 @@ in
               secret_file = "/var/lib/matrix-authentication-service/matrix_secret";
             };
             database.uri = "postgresql:///matrix-authentication-service?host=/run/postgresql&user=matrix-authentication-service";
-            secrets = {
-              encryption_file = "/var/lib/matrix-authentication-service/encryption";
-              keys = [
-                {
-                  kid = "rsa-4096";
-                  key_file = "/var/lib/matrix-authentication-service/key_rsa_4096";
-                }
-              ];
-            };
+            # secrets is defined in extraConfigFiles
             policy.data.client_registration.allow_insecure_uris = true;
             upstream_oauth2.providers = [
               {