gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/oink: update service options to pass secrets via file (#457573)

Browse Source
This commit is contained in:
Felix Bühler
2025-11-10 19:55:10 +00:00
committed by GitHub
parent d66143a3c4 34870c3974
commit bfc202f8fe
2 changed files with 30 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/release-notes/rl-2511.section.md
+2
View File
@@ -225,6 +225,8 @@
- `rocmPackages.triton` has been removed in favor of `python3Packages.triton`.
- `oink` service no longer accepts `settings.apiKey` and `settings.secretApiKey` options as these have been replaced by `apiKeyFile` and `secretApiKeyFile`.
- `linpinyin`, which is used for Chinese character input, has migrated from the unmaintained BDB database format to the newer KyotoCabinet database format. If you want to migrate your user input statistics you can consider using [bdbtokyotodb](https://codeberg.org/raboof/bdbtokyotodb).
- `go-mockery` has been updated to v3. For migration instructions see the [upstream documentation](https://vektra.github.io/mockery/latest/v3/). If v2 is still required `go-mockery_v2` has been added but will be removed on or before 2029-12-31 in-line with its [upstream support lifecycle](https://vektra.github.io/mockery/)
nixos/modules/services/networking/oink.nix
+28 -9
View File
@@ -20,15 +20,17 @@ in
options.services.oink = {
enable = lib.mkEnableOption "Oink, a dynamic DNS client for Porkbun";
package = lib.mkPackageOption pkgs "oink" { };
apiKeyFile = lib.mkOption {
type = lib.types.path;
example = "/run/keys/oink-api-key";
description = "Path to a file containing the API key to use when modifying DNS records.";
};
secretApiKeyFile = lib.mkOption {
type = lib.types.path;
example = "/run/keys/oink-secret-api-key";
description = "Path to a file containing the secret API key to use when modifying DNS records.";
};
settings = {
apiKey = lib.mkOption {
type = lib.types.str;
description = "API key to use when modifying DNS records.";
};
secretApiKey = lib.mkOption {
type = lib.types.str;
description = "Secret API key to use when modifying DNS records.";
};
interval = lib.mkOption {
# https://github.com/rlado/oink/blob/v1.1.1/src/main.go#L364
type = lib.types.ints.between 60 172800; # 48 hours
@@ -79,12 +81,29 @@ in
};
};
imports = [
(lib.mkRemovedOptionModule [ "services" "oink" "settings" "apiKey" ] ''
This option has been removed because it would make the API key world-readable.
Use {option}`apiKeyFile` instead.
If you insist on keeping the API key world-readable, you can use `oink.apiKeyFile = pkgs.writeText "api-key" "secret";`.
'')
(lib.mkRemovedOptionModule [ "services" "oink" "settings" "secretApiKey" ] ''
This option has been removed because it would make the API key world-readable.
Use {option}`secretApiKeyFile` instead.
If you insist on keeping the API key world-readable, you can use `oink.secretApiKeyFile = pkgs.writeText "secret-api-key" "secret";`.
'')
];
config = lib.mkIf cfg.enable {
systemd.services.oink = {
description = "Dynamic DNS client for Porkbun";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
script = "${cfg.package}/bin/oink -c ${oinkConfig}";
script =
lib.optionalString (cfg.apiKeyFile != null) "OINK_OVERRIDE_APIKEY=\"$(cat ${cfg.apiKeyFile})\" "
+ lib.optionalString (
cfg.secretApiKeyFile != null
) "OINK_OVERRIDE_SECRETAPIKEY=\"$(cat ${cfg.secretApiKeyFile})\" "
+ "${cfg.package}/bin/oink -c ${oinkConfig}";
serviceConfig = {
Restart = "on-failure";
RestartSec = "10";