darman/homelab
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat(mercury): pihole web password from sops via FTLCONF env override

Browse Source 
pihole.toml is nix-managed read-only so 'pihole setpassword' fails. pihole-FTL
reads FTLCONF_* env vars (override the toml) — render an env file from the sops
secret pihole_webpassword and feed it via EnvironmentFile. Password stays out of
repo/store. VERIFIED in VM: FTLCONF_webserver_api_password -> API login works.
This commit is contained in:
erik
2026-07-13 22:40:12 +02:00
parent 750821f43a
commit 22a3eee85b
2 changed files with 28 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/mercury/configuration.nix
+14 -3
View File
@@ -24,11 +24,22 @@
# VERIFY with `ip route` on the Pi — assuming the router is .1.
networking.defaultGateway = { address = "10.0.0.1"; interface = "eth0"; };
# Resolvers for the Pi's OWN lookups (not the LAN service). Kept public so the
# host resolves during boot without depending on its own AdGuard/unbound.
# host resolves during boot without depending on its own pihole/unbound.
networking.nameservers = [ "1.1.1.1" "9.9.9.9" ];
# DNS adblock + DHCP (AdGuard) and the recursive resolver (unbound) come from
# the imported service modules. AdGuard forwards to unbound at 127.0.0.1:5335.
# DNS adblock + DHCP (pihole) and the recursive resolver (unbound) come from
# the imported service modules. pihole forwards to unbound at 127.0.0.1:5335.
# ---- pihole web admin password (from sops) ----
# pihole.toml is nix-managed read-only, so `pihole setpassword` can't write it.
# Instead pihole-FTL reads FTLCONF_* env vars (they override the toml). Render
# an env file from the sops secret and feed it to the service — password stays
# out of the repo and the nix store.
sops.secrets.pihole_webpassword = { };
sops.templates."pihole-ftl.env".content =
"FTLCONF_webserver_api_password=${config.sops.placeholder.pihole_webpassword}";
systemd.services.pihole-ftl.serviceConfig.EnvironmentFile =
config.sops.templates."pihole-ftl.env".path;
# Do not modify after first flash.
system.stateVersion = "26.05";