From 3da843c3ffbd93dc9d4f4d272e0793fffdb6af1f Mon Sep 17 00:00:00 2001 From: Simon Gardling Date: Tue, 5 May 2026 12:40:11 -0400 Subject: [PATCH] fix secrets --- modules/server-age-secrets.nix | 10 ++++++++++ secrets/secrets.nix | Bin 3675 -> 3724 bytes secrets/server/livekit-keys.age | Bin 0 -> 295 bytes secrets/server/livekit_keys | Bin 84 -> 0 bytes services/matrix/livekit.nix | 8 +++----- 5 files changed, 13 insertions(+), 5 deletions(-) create mode 100644 secrets/server/livekit-keys.age delete mode 100644 secrets/server/livekit_keys diff --git a/modules/server-age-secrets.nix b/modules/server-age-secrets.nix index 0f09962..3cb5c09 100644 --- a/modules/server-age-secrets.nix +++ b/modules/server-age-secrets.nix @@ -217,5 +217,15 @@ owner = "firefly-iii-data-importer"; group = "caddy"; }; + + # LiveKit + lk-jwt-service shared signing keys (`: ` per + # nixpkgs services.livekit.keyFile docs). systemd reads via LoadCredential + # before dropping privileges, so root-only is correct for both consumers. + livekit-keys = { + file = ../secrets/server/livekit-keys.age; + mode = "0400"; + owner = "root"; + group = "root"; + }; }; } diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 1b3cfb51245827912ea9b698a79e70b6f38975eb..84d796bf34569375de2498a0847451c569345df8 100644 GIT binary patch literal 3724 zcmZQ@_Y83kiVO&0c);f?Tr{Oeb;Fmm-A_IFJB`E_zJ0}WMnpU9SflEahA`%PqC)!H z!VEve8=pF`uafUrjiy8RWv#9Cvwo*C3jYjXj*YtBq~qZ~uYW_uk-c6QOd6`Q9XGa} zu{?8Vk<)I`btiA0te9+adiR@`Uk>b;#L~)O&LU)Wq5Eb3vLK5^AEYWS>o#q8z_*O8 zA)ft*eE!QhRvJ@}@rhrl|Gpw_>8_rIW)lVS<$V|%x8B@-OYB!~ilv{O^A7H2mu&7S zTJlV49({e&-Z<4Se;g^n z%&lD?bU>;*;e7D#cY7tywkIu0*!%KWgVF5kiAr95Gprk?DDM|JBrdLbcZz=EBw+zD z{#~jiUUOtZ_>WE(apGU;nl(lCc*_Q{eaBT)lQwbR{kbh9_L>RaYPZTceth#^Ax%|6U1M9qRPVbLaaH+KGj)oykJ&hTy)7=bC@%`-{^Rve zw|II?ORYxGr|dkh?$bh1PcHt|me|m_z2AzVC~OhSqWtX-a$2^CpR&F5zRqMu^2G4! z<$KMloBe&B7ao|ok86wdO{qfb_pVx^r$US?_K2+0|T&H{{r2b+M&4%bxPRl;ML{%&mQ_0UvhSPUgp8EbHS(8+&>w1 zvORs2)6n{zh3Q)EkyrC1LT;_lYp%5)naclhp=PWIEHCb%#>iriJ>bTWkTHRtMunv=VY zR9@+XFaD=#^7$P5OR*jgi87@^)jZzchtKo9Dz}-p(*K(-d-)^rJDV2UuUQ?F@pV&K z%g@zEb_pc%WWS#G+1ScA;m_P6s|gD~Fr?=txJF8E$ak|jvG2zEgxASeRx)wV*`KrL z;P*tf?Pl*b7w!Ty8T*?wOV*ez;)&w86uh`3@`~Eh4D2m*F)-v|bq~nh-M?1`#Gix%Vo%y@F^U{w?zmh%n zcr(}K+5gw?3)t>H*?r?B4SD%Mj;NOKScW^+yEngl)pVNSgqqyja<&MWXwRw9N5aCk zYA)jYzR~dU#Z5iZ2_IutFDXu)>YBBG|Ky@+Pmg)N`}{>;b<&53DdKCM{gx}(cf0uD zgk7^v-fQ13^7v#?O=?)C&Y?St&ba5zdD$kh{pp%ag@6RNocxrko+9>;P{%*H!E2o) zSWjQy@p_+DZ(X4H(zS2hX6O{nQjJ_Q`@i`g?vPyHH>*pvm4j^et+zVT_OEue`Zt!Z zkL=zgnG5YdcayENZRzn9aW~H`YiFOc;>r34|9T%BeqG?kqI6MSzP#>t=DGsG#BZVV z!Y}y0k8^Bu(hx~l@_Ejz3WxHmmpAszI@u}Dx+3SN7W@r!RN~&P_`rOhUP+ov)P{>! z_uM(Xc&om#a&_CBPesa;qxe=!o0{AfHu-I!=etNXV5!{&6LqtL`IdP zy+$o=hw`!O&u(0+e9Q4t^7j%s)^z)_XV2QCjrW-~C$L;KuXSyR zSK4Sh?Zx*y;tB2t?sHaZ{mYd+bN|i0#nlRG@$s5FcjX3J>f2`+&o0dCJ;(K9g0xZ4 z(K#`9oIZVBT`FZS-S!`t57uFvOb=6_Yd{W)~CRLT8VgF?fn zLgs!;p0*q1eKIMZ6&CX^FnPU~xS{c_hKTUxA9S7;DyY?E@+sM0Flvu>X}EZK#n0q> zo_Qvm!ioD>jMjaB0=nEDZa?`(?AyX2~YoFyEWY=P&=)c_LCQYt{J@9cybpY5AVLKEGKD zYOQ_t&VTj(iL7N4@2a%whIzkuUqngBh#%V!bSKV)Q}I%HOw4&XR_AwdPxzO9>fc!% zo*c_zXnbMMgmWiXh!dQ(&5p0e`9`KQe1*M~>i z{_B}he16kX)4C0jKaa=Qab7*c*f1wa^tG@eOWl^1AHCh-1+S*<(^C2Qf#JD0KZNAMGB@8xu1UOth}ajMPq00tp6=9V&`j#@a)asWx*$?F;k9nZqc=w z)`wPaar(C>w)(k8Vae+Qb8Wj+jx3Ft!zU!haX zH0Gbo^S#g?otD)2{N;hgTbY6 zy~K5~m)9uR;?AU3l0Orc#zrhpW>h~F6Lj;@oFA^7yGpb@Z7zSg5f}S-!{Wb;%cU1j znk@d$#4nJ4*^(Uv4O_c1oaP@0^qj}P^jmRM;cxElEcI_{2TpCsV!m}^(YiqH93Kztrxvda8Tkme$ARA6g!;r^TOFNzFKv=`a>Rr^ zoW-={=GS>Uj`E3Fvu3SrleAL0wMX@6)@(0+hHm4D%LSZmqxU^=x~Q#CRwy=4@J-&4 zw{L{!drUY#LE=NwhJ*UG>-$@mTI_jf-d$r@{6X}|VTO?Dt;a4qyuNvh{Y-K1r`vVy ztJUTf$1XdvL}TIPi;E1;oVm6}bJfYWn|U-IO}pXU;4ZdH#lYV*HgmE7@3EqX^6LIf z4{w$*w?+Ejh?(^47t7(Tl@DvrPWI}#e^T(rR&=>d*^zgPo30)F)8g8vB^{tzX7J=tvs1H| z>3yA4yZQ&QUyVfT#bs_uf3V7_@Msd-^vRSl^k8_RsRXU@QqLPbqLG0I+d_Cp}6hEZX5r!MJyRiTDRWxU!UGOiBsfy zvQEXU`RWzFOf*{h`)7St`0pd&wtnqB+x4MuqpRN7Gc47As3zmLC{JOh)t~#9YnLo* z){j%o4E9QvjQ@G%%B9XL%P#0?6se#7uGo^Kvru!3v0QxGVOan(7Ek58fG=9amd}NO)xKDjy|U|tHo7n zvsvLjpY6dNCmGCkMx3)u7w@ZfC{1X|+!xUFa7{{($sqwn-jatay`1hdVHqq&w|j@q^9k?ob}D@yEH0xwTD zoma~aaaTUFZh7Pm*UIDrf#;rzxaogpbltV4c;`wv^S5)KmT=BiGG21b!~ET2ON*4r zS^4_RoqlD)zhVzB*>Sk`cqyOM<;5+*=MLmHhkd!(-)B&C`o%hH|B0GeEPLO+RXO$h zpWJ45dv|U&U1{67e+6o}44GM`b!9W_hPm7;zL6Beb9GtqX7;qx!L`l5g5PaFqR4g4 zzI)q!OU+f)w+}K|R_@z+?eMAUx<3Ea9T)BVOOEGs{bKM=`M!DU*=?S`TTk_*XkEO- zJNMnWH*vEhuPUURTNLQ@LYX(ERNRi|>zgYs3szhHwR)1vvCjF>?4EL;d-rn{Qyn`V ztGX;n{FAoy_T66%Q{s3;-rn50wA_ literal 3675 zcmZQ@_Y83kiVO&0NbaBYxaEM|yqM2&#hl!q|CUXzn#O%6MAo6$X*&1Ha}O^3p46zC zTffZF(yHHX_k?K&`pXVZC{RAl`_)5VZ((J$ji=iQpWnYtpE9Z#_3ocBlbs{whnrQn z^Q!AFdbJDvLo)ByglV2QGwFJ0>8UFVf0*p>%UCFVum0B^e(8ht9FwY4&(l_RS-fk`9i{&}`zM&K)Smrj z`YiJ>;^eb!yr)+9B=oIxSS0_3H_u>ZA(Mw&{e~B3 z!^KK=ul%nusr_om=hWYR$|dh&WFv!5d|29L$a6Jc?kn@@F1Afmk-M%B| zX^-`!l4XStpWPJiZZx(_V@;ZTv~~i^$LShxGUgv)j+D@~i%42$UEOE7{jt!#S?kvJ zy0o9xUVG3`boNWHg)wUxp1#RowO#13oz=ZqPO+7a3KJvyvn^DXX5HfR zW<38w+CQvkh2fGJjx%2$n|b3$@{O|wjl5MU|3-5cCC{}s2za;3{E+OcgAp>C>sahV z4onvBZ`9_wzU#HP{8X;{)^>|dG`AMCEEhN*eAec}HRs=4kFU;j?cQ-baDh@x_=TO) zR|O64FpG07{#j94+Oqi5@y54v!{irNzB=z>ymZP()+=`+t{&Z-V49RwB_0!^eRd+Z z`P=1+A9e<39uGF%S~}M7TVA8J9&TO63YdZ#qm!=Z*HlY9qE2Y&F7#%PHyDP9X0MoS~35O z7iqW`Wd60ZJDcSn)!44LW%ebPtKu`=Bq!T9R@I%GEww^VtG|lDC^g4ZQmcD&Q_9Yt zPQO$xEpbfQKK({o*_Jr}`U|Dm7uQ@gp15~X&0hW=1wtLh0_VdW_-_5**Z5SSVd+KY z=wr;czUrmz-JACPZ2R+sEpLC%bNpA-zUqK?*u95G+LvpoS3bQa&(r%-=T*(?Xa6Fe z-!ebO&KfkS!bQT{ACR- z44tekIb-J<*LaHuPk*iDZGI#4q}Q6guY&!CfcVxYQq9_j*_Ky5mK58xN%Brzzpeki z#aAbZPPt`tT)xu$N-bkd-2Q7qAFPgD*YAq_FPnQd+Oh2rYcS{4S!W|Ro2Z%2ijCvA z-6T`}c5~qCb^LEy3az{YhGrKhtyDLD_mQKV zOI?=NL0o6r#>llhA3r=l?UjNH|I2+|GjCUYkakMA+E)3jh&^L_T{3fB`11dDU#9-- zILA{p#kax4`TCyAv)4Wh4q4>Qyufaz)0I6PdNp^luvB^e00*c&n(}3>ZVM7w^MD^^4PYH%4u$bZo>86-O&fDe2WkLHJVdbNicap}}_%x!pSDQIFg^IQOtKEHeW z9(!xw+*1rw?<{z}(__lhb+2xDvv%HQuU6ma^fH6#^%~aMlS>#{&+TVB!TspAVo!p> zG_8hZsoY||kJiupuxWpB|MYoRmY-&t$yLrNy7=2N$>lpW|FOSVwqWbTT+LfyJWJM# z8dPpv;<4!R*T2svMu^68@y?lgTwAN4?80^P4dQyg{6DXH*A=>)-RadobH#~!12P0w z8MmL_w_fwQZnVB@cXVL4{4V=>x8}{WDcZp!bF*+RhemH!;Oekl>N4vXE*^3@ZoXRo zw8fM#^{m$86<^(!tgF+Pnt8bWYqE*wty?=>&5pJHXP5F--||njWAUmj>^$$>@;2O@ zmd$W$ujQ||&yCNeOn$L@=CY+VXFFQ+($AIrQJ6n3aCiuq9_=(4r7xg}gJlEZ9_WI*)h0e)r`_`tjN-qmb zk}UpQEH0XxIo&2=$NVQ#gk5A$ZL)dY(3l;~7cWyBWO#=E%+FV6XYAned7iWCR7%#d zf96YaNf;q-}3g?yF|6z;|>Kdf5*?8Z!aYd*;$i~Nq*)rr&3sr`D_ z{ZGQFyH#Y$#>lsCmNrcI>h^9{;DQhB2U(^sVST=@Ro_-?>XObW4|DC`we+`L<$l<) z?>t-L;X8S2PMY6{pJ|!-Uzu@#uet0baMJ3TdGoFazI)Z(5a`0j`Lt-I1Qw6y%VYpnJ(IM`fz zJ)G`pXj;EgRz3uD%;QF`{kl24)YQmHPUtH=g~}^rn;tM2VZXR>%@=0yMd&3!#k#wsXTa%1w}*~Tl1ZPw*{nE6nI zW9id%hfb!Qnya07>ewx%ZB<{?t$4ESuS_Zq_t&0w-|XGFjrV0GAC>LvP&M;v_4Mvt zknI}HXiyT{*l^zLdVxg#tH6?le+55(5$ljRyrc3m+dcJ9mQStx_BdHYUY%iSGc9&j zGiPgpRCORnfwkBCgsA>V=f_Dqd$U^_CV%*y>>T+kf0f9@riPXUimQ6$rm0-y4VztD z?;;oTSmdjTqK2d7iHX8)n)cixXPGhMN7@w*al z3+9VI6atLb9_Ziwy!m~EbN!!JH7jSl6bp0aCvwUPuiO*L={kZrelIyyf4!BN&f@9pH1+$H8*d(eTz>V7Q=kjnd+y_j;H?*+E$HtRUf4s_euh`aU`uoee@SuWX z;}gtrW`{XX8_3^V^>5yBS;g2mk^OO!h4+^xo@{e?%^g+dU?^``_;A+D2hWfEF?h8o z>inTgQ*#QGbj5T|GUmqG$ej5jKmX?OQ~Y1ELaWrzC*=IgcvAgJa!R{robK7rmv3s? zvNb=~HF)ph=a=v`cm0|QC3_#u>clO-n{s(R3iZz0q`tfIQqvKM$?dr+zt*3ST(8A- zVs=tR%EL=*&Y!UmwhjpmmAWkuR`aM=tnbpi+~xasD=p}0P4D94U}#A`8e03cBsluv z_Sj9)3qF@N*LW_{zT4jw)yC0v)7K#0@n_Zjq66#aF8=A!?DKN%v9!tW=6L!Y_PTq) z;`Q9yQMTn*mu$*;(WLUjbDtB3OpW*qi}`Uz5gGR#jbU5qfo!+@?*K7*D p96OQAvij?-uNz$tGu2u%9Etp$5c213;GNdId5@nK8%}M>1pwm^`EY@n5ZF2YAUu{(_Mf2EOJ152oYKVJ!EL*#6 zTGQJVCi)e<4Y3bH)V6-|jy8R|BfjhzgO=lOdpm=q)ps*~X|;cheItAF>bK{WQj4cL z9SPK(y~$!$|E*b{s_eI^9Z|Fus~s~w!Rw3e4;&f*uhO(vS=pHMigxQQ)4 zW8-%b6<I?kW@A$je>z6Jce3m#pZ_=aOyx`12s=I}DB`vL-~FK6C; z;W0t9h&xNO;_vn7WtC1Mm#t+qMu`a@Zke5JWjs+_C~ehX5@n-Io?n1 Gvj70k*N>+F literal 0 HcmV?d00001 diff --git a/secrets/server/livekit_keys b/secrets/server/livekit_keys deleted file mode 100644 index 0d894e9e1f2bd3044482cee6855dac2d5fb21985..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 84 zcmZQ@_Y83kiVO&0h)bDsVfG@i_IMs%3!zgrHfudMt%&X8?vppO{rKzAszWyMi}D)m r7X6rcqAJhewVksUXL#A7Py3H?p7UFn`!3kP=uSb#r^(ZQ^9ld})~+T& diff --git a/services/matrix/livekit.nix b/services/matrix/livekit.nix index 99a5208..cdbb310 100644 --- a/services/matrix/livekit.nix +++ b/services/matrix/livekit.nix @@ -1,14 +1,12 @@ { + config, service_configs, ... }: -let - keyFile = ../../secrets/server/livekit_keys; -in { services.livekit = { enable = true; - inherit keyFile; + keyFile = config.age.secrets.livekit-keys.path; openFirewall = true; settings = { @@ -34,7 +32,7 @@ in services.lk-jwt-service = { enable = true; - inherit keyFile; + keyFile = config.age.secrets.livekit-keys.path; livekitUrl = "wss://${service_configs.livekit.domain}"; port = service_configs.ports.private.lk_jwt.port; };