From a76fb62b56901021617972f49d828256b0b2e5c4 Mon Sep 17 00:00:00 2001
From: Defelo <mail@defelo.de>
Date: Tue, 24 Mar 2026 10:24:44 +0100
Subject: [PATCH] nixos/radicle-ci-broker: load private key from radicle-node
 service

---
 .../services/continuous-integration/radicle/ci-broker.nix  | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/continuous-integration/radicle/ci-broker.nix b/nixos/modules/services/continuous-integration/radicle/ci-broker.nix
index d2616ba32b28..aab0967e5b51 100644
--- a/nixos/modules/services/continuous-integration/radicle/ci-broker.nix
+++ b/nixos/modules/services/continuous-integration/radicle/ci-broker.nix
@@ -204,7 +204,12 @@ in
           RuntimeDirectory = "radicle-ci-broker";
           WorkingDirectory = "/run/radicle-ci-broker";
 
-          BindReadOnlyPaths = config.systemd.services.radicle-node.serviceConfig.BindReadOnlyPaths;
+          ImportCredential = config.systemd.services.radicle-node.serviceConfig.ImportCredential or [ ];
+          LoadCredential = config.systemd.services.radicle-node.serviceConfig.LoadCredential or [ ];
+
+          BindReadOnlyPaths = config.systemd.services.radicle-node.serviceConfig.BindReadOnlyPaths ++ [
+            "/run/credentials/radicle-ci-broker.service/xyz.radicle.node.secret:/var/lib/radicle/keys/radicle"
+          ];
           ReadWritePaths = [ RAD_HOME ];
 
           ExecStart = "${lib.getExe' cfg.package "cib"} --config ${configFile} process-events";