Fixes in secrets and services.

Mostly fixes connection to mysql and the unix-socket auth for it.

7 files changed, 20 insertions, 14 deletions

diff --git a/hosts/omega-relay/firewall.nix b/hosts/omega-relay/firewall.nix
index 360e7da..553730e 100644
--- a/hosts/omega-relay/firewall.nix
+++ b/hosts/omega-relay/firewall.nix
@@ -1,4 +1,4 @@
-{ ... }:
+{ config,... }:
 let
   baseTCP = [
     20
@@ -20,6 +20,7 @@ let
   ];
 
   secureTCP = [
+    # config.wilkuu.services.mysql.port
   ];
 
   secureUDP = [
@@ -54,6 +55,7 @@ in
       "veth*"
       "vnet*"
       "virbr*"
+      "lo"
     ];
 
   };
diff --git a/secrets/omega-relay/freshrss.yaml b/secrets/omega-relay/freshrss.yaml
index d6ad4b6..e2c07fb 100644
--- a/secrets/omega-relay/freshrss.yaml
+++ b/secrets/omega-relay/freshrss.yaml
@@ -1,6 +1,6 @@
 fresh-rss:
     admin_password: ENC[AES256_GCM,data:aAKl2jCR4w==,iv:xYQXINEeywuyg8+guhS+kv79L/crXLquJp+k6l4vUkI=,tag:4UA4D9jcYtIGHh1FHBv7Nw==,type:str]
-    db_password: ENC[AES256_GCM,data:Ov79Vw1I8A==,iv:T7oJEszUQoNyK8xxSg9jUEEmGlAVHTm98idrcLBWC3E=,tag:dow8CF+HwZFDh7PjF1dSUg==,type:str]
+    db_pass: ENC[AES256_GCM,data:Sx53LIP7pQ==,iv:qWX7dMQ/8j00rxdRs9Gj//enxe6SMBqjIizX/xkFS4w=,tag:JFktb8O7DJSuNrsbe9bnWQ==,type:str]
 sops:
     age:
         - recipient: age1hsxrd9shau86k7zz9wfdeplldyg5c2al6umnr7rn6tf7ewus64uswufr0a
@@ -21,7 +21,7 @@ sops:
             alBWOE94TnA2ZnFEOHg2dElDS0ZuZ3MKem45+6LBH4GXrZpbAn9RUrbF/8A8Ecyd
             oOjFC7bRxEDSbq1bU9LV4PurnjIFXJjrZbFlIZkiqQz8IfievsKY/w==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-01-25T12:43:00Z"
-    mac: ENC[AES256_GCM,data:SzUHVvZ9eDMMuXFSsmqxEPvpbLDd+b0x8c9vkypCduLyoi7W2kvM4hT/F5hWbdDcCcI262BETceMq19a3hkH9H0I2U8zxnYkPZuPjCI53v9Rb4tQkhrSc35afHijcVOsQmfqoP/olvESdNi+Db1ghkay8C3Dl7/SJ+J6chClmFs=,iv:ayViaJ5Ammcqi2mmf1y6W2BcLcheoMwlPN7CHEFaXYc=,tag:harswwEu4WVISwz6KyxDdg==,type:str]
+    lastmodified: "2026-01-25T14:55:26Z"
+    mac: ENC[AES256_GCM,data:8++RevhtJBSX10DrrQO1sB8iqysw1MZGdkifmD4kZ1u2WwEQrWGtEk+W4Vnfhik8OyTFHjcLOmEdJ4Ksn+yrWDm1w+Dvw9/nPGQbS5ARp4sLp7likDn++F+uM0MI2UREIAxxys5QkcUWSF3/Ct6T9JHklKU82yWjRYjIAuLYY0M=,iv:+9zPYgRtHax95taB4ix3MwyB0cqIhzbbDb90fMGa97o=,tag:KjOM9/pOKKGZC3RqsKO38w==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.11.0
diff --git a/services/freshrss.nix b/services/freshrss.nix
index acb1770..2cabe68 100644
--- a/services/freshrss.nix
+++ b/services/freshrss.nix
@@ -54,6 +54,7 @@ in
         enableACME = cfg.doACME;
       };
 
+      systemd.services.freshrss.after = ["mysql.service"];
       wilkuu.services.mysql = {
         enable = true;
         users."freshrss" = {
@@ -80,7 +81,7 @@ in
         virtualHost = cfg.domain;
         database = {
           passFile = config.sops.secrets."fresh-rss/db_pass".path;
-          host = "localhost";
+          host = "127.0.0.1";
           port = config.wilkuu.services.mysql.port;
           name = "freshrss";
           user = "freshrss";
diff --git a/services/mysql.nix b/services/mysql.nix
index 92db5f7..445751a 100644
--- a/services/mysql.nix
+++ b/services/mysql.nix
@@ -35,10 +35,10 @@ let
     name:
     ''
       -- Clauses for user ${name}
-      ALTER USER IF EXISTS '${name}'@'localhost' IDENTIFIED BY unix_socket'; 
-      CREATE USER IF NOT EXISTS '${name}'@'localhost' IDENTIFIED BY unix_socket';  
+      ALTER USER IF EXISTS '${name}'@'localhost' IDENTIFIED VIA unix_socket; 
+      CREATE USER IF NOT EXISTS '${name}'@'localhost' IDENTIFIED VIA unix_socket;  
     ''
-    + (lib.concatMapAttrsStringSep "\n" (priviledge_clause name) (create_users_ensure name));
+    + (lib.concatMapAttrsStringSep "\n" (priviledge_clause "'${name}'@'localhost'") (create_users_ensure name));
 
 in
 {
@@ -105,7 +105,8 @@ in
       lib.concatLines (
         (builtins.attrValues (builtins.mapAttrs add-user-clauses cfg.users))
         ++ (map add-unix-user-clauses cfg.unix_users)
-      )
+        ++ ["FLUSH PRIVILEGES;"]
+      ) 
     );
   };
 
@@ -116,6 +117,7 @@ in
     package = pkgs.mariadb;
     settings = {
       mysqld = {
+        # socket="/var/lib/mysql/mysql.sock";
         log_error = "/var/log/mysql_err.log";
         log_warnings = 2;
       };
diff --git a/services/uptimekuma.nix b/services/uptimekuma.nix
index 1ac6006..32549c3 100644
--- a/services/uptimekuma.nix
+++ b/services/uptimekuma.nix
@@ -33,6 +33,7 @@ in
     users.groups.uptimekuma = { };
 
     systemd.services.uptime-kuma.serviceConfig.User = "uptimekuma";
+    systemd.services.uptime-kuma.after = ["mysql.service"];
 
     # sops.secrets =
     #   (lib.genAttrs (map toSops secrets)
@@ -69,7 +70,7 @@ in
         UPTIME_KUMA_PORT = "3111";
         UPTIME_KUMA_HOST = "127.0.0.1";
         UPTIME_KUMA_DB_TYPE = "sqlite";
-        UPTIME_KUMA_DB_SOCKET = "/var/lib/mysql/mysql.sock";
+        UPTIME_KUMA_DB_SOCKET = "/run/mysqld/mysqld.sock";
       };
     };
   });
diff --git a/services/vaultwarden.nix b/services/vaultwarden.nix
index 4aa24ba..90feace 100644
--- a/services/vaultwarden.nix
+++ b/services/vaultwarden.nix
@@ -61,7 +61,7 @@ in
 
       services.vaultwarden = {
         enable = cfg.enable;
-        backupDir = "/srv/data/vaultwarden";
+        backupDir = cfg.backupDir;
         config = {
           DOMAIN = cfg.domain;
           ROCKET_ADDRESS = "127.0.0.1";
diff --git a/services/wakapi.nix b/services/wakapi.nix
index c89a46a..69251d3 100644
--- a/services/wakapi.nix
+++ b/services/wakapi.nix
@@ -64,10 +64,11 @@ in
         };
       };
 
+      systemd.services.wakapi.after = ["mysql.service"];
       services.wakapi = {
         enable = true;
         stateDir = cfg.dataDir;
-        passwordSaltFile = config.sops.secrets.wakapi/password_salt;
+        passwordSaltFile = config.sops.secrets."wakapi/password_salt".path;
         settings = {
           server = {
             port = 3111;
@@ -83,10 +84,9 @@ in
             datetime_format = "Mon, 02 Jan 2006 15:04";
           };
           db = {
-            socket = "/var/lib/mysql/mysql.sock";
+            socket = "/run/mysqld/mysqld.sock";
             name = "wakapi";
             dialect = "mysql";
-            charset = "utf8mb4";
           };
           security = {
             insecure_cookies = false;