From 19835b9be47ba9b96b1f72c93c98e3c3866a858a Mon Sep 17 00:00:00 2001 From: Jakub Stachurski Date: Sun, 25 Jan 2026 17:23:01 +0100 Subject: Fixes in secrets and services. Mostly fixes connection to mysql and the unix-socket auth for it. --- hosts/omega-relay/firewall.nix | 4 +++- secrets/omega-relay/freshrss.yaml | 6 +++--- services/freshrss.nix | 3 ++- services/mysql.nix | 10 ++++++---- services/uptimekuma.nix | 3 ++- services/vaultwarden.nix | 2 +- services/wakapi.nix | 6 +++--- 7 files changed, 20 insertions(+), 14 deletions(-) diff --git a/hosts/omega-relay/firewall.nix b/hosts/omega-relay/firewall.nix index 360e7da..553730e 100644 --- a/hosts/omega-relay/firewall.nix +++ b/hosts/omega-relay/firewall.nix @@ -1,4 +1,4 @@ -{ ... }: +{ config,... }: let baseTCP = [ 20 @@ -20,6 +20,7 @@ let ]; secureTCP = [ + # config.wilkuu.services.mysql.port ]; secureUDP = [ @@ -54,6 +55,7 @@ in "veth*" "vnet*" "virbr*" + "lo" ]; }; diff --git a/secrets/omega-relay/freshrss.yaml b/secrets/omega-relay/freshrss.yaml index d6ad4b6..e2c07fb 100644 --- a/secrets/omega-relay/freshrss.yaml +++ b/secrets/omega-relay/freshrss.yaml @@ -1,6 +1,6 @@ fresh-rss: admin_password: ENC[AES256_GCM,data:aAKl2jCR4w==,iv:xYQXINEeywuyg8+guhS+kv79L/crXLquJp+k6l4vUkI=,tag:4UA4D9jcYtIGHh1FHBv7Nw==,type:str] - db_password: ENC[AES256_GCM,data:Ov79Vw1I8A==,iv:T7oJEszUQoNyK8xxSg9jUEEmGlAVHTm98idrcLBWC3E=,tag:dow8CF+HwZFDh7PjF1dSUg==,type:str] + db_pass: ENC[AES256_GCM,data:Sx53LIP7pQ==,iv:qWX7dMQ/8j00rxdRs9Gj//enxe6SMBqjIizX/xkFS4w=,tag:JFktb8O7DJSuNrsbe9bnWQ==,type:str] sops: age: - recipient: age1hsxrd9shau86k7zz9wfdeplldyg5c2al6umnr7rn6tf7ewus64uswufr0a @@ -21,7 +21,7 @@ sops: alBWOE94TnA2ZnFEOHg2dElDS0ZuZ3MKem45+6LBH4GXrZpbAn9RUrbF/8A8Ecyd oOjFC7bRxEDSbq1bU9LV4PurnjIFXJjrZbFlIZkiqQz8IfievsKY/w== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-01-25T12:43:00Z" - mac: ENC[AES256_GCM,data:SzUHVvZ9eDMMuXFSsmqxEPvpbLDd+b0x8c9vkypCduLyoi7W2kvM4hT/F5hWbdDcCcI262BETceMq19a3hkH9H0I2U8zxnYkPZuPjCI53v9Rb4tQkhrSc35afHijcVOsQmfqoP/olvESdNi+Db1ghkay8C3Dl7/SJ+J6chClmFs=,iv:ayViaJ5Ammcqi2mmf1y6W2BcLcheoMwlPN7CHEFaXYc=,tag:harswwEu4WVISwz6KyxDdg==,type:str] + lastmodified: "2026-01-25T14:55:26Z" + mac: ENC[AES256_GCM,data:8++RevhtJBSX10DrrQO1sB8iqysw1MZGdkifmD4kZ1u2WwEQrWGtEk+W4Vnfhik8OyTFHjcLOmEdJ4Ksn+yrWDm1w+Dvw9/nPGQbS5ARp4sLp7likDn++F+uM0MI2UREIAxxys5QkcUWSF3/Ct6T9JHklKU82yWjRYjIAuLYY0M=,iv:+9zPYgRtHax95taB4ix3MwyB0cqIhzbbDb90fMGa97o=,tag:KjOM9/pOKKGZC3RqsKO38w==,type:str] unencrypted_suffix: _unencrypted version: 3.11.0 diff --git a/services/freshrss.nix b/services/freshrss.nix index acb1770..2cabe68 100644 --- a/services/freshrss.nix +++ b/services/freshrss.nix @@ -54,6 +54,7 @@ in enableACME = cfg.doACME; }; + systemd.services.freshrss.after = ["mysql.service"]; wilkuu.services.mysql = { enable = true; users."freshrss" = { @@ -80,7 +81,7 @@ in virtualHost = cfg.domain; database = { passFile = config.sops.secrets."fresh-rss/db_pass".path; - host = "localhost"; + host = "127.0.0.1"; port = config.wilkuu.services.mysql.port; name = "freshrss"; user = "freshrss"; diff --git a/services/mysql.nix b/services/mysql.nix index 92db5f7..445751a 100644 --- a/services/mysql.nix +++ b/services/mysql.nix @@ -35,10 +35,10 @@ let name: '' -- Clauses for user ${name} - ALTER USER IF EXISTS '${name}'@'localhost' IDENTIFIED BY unix_socket'; - CREATE USER IF NOT EXISTS '${name}'@'localhost' IDENTIFIED BY unix_socket'; + ALTER USER IF EXISTS '${name}'@'localhost' IDENTIFIED VIA unix_socket; + CREATE USER IF NOT EXISTS '${name}'@'localhost' IDENTIFIED VIA unix_socket; '' - + (lib.concatMapAttrsStringSep "\n" (priviledge_clause name) (create_users_ensure name)); + + (lib.concatMapAttrsStringSep "\n" (priviledge_clause "'${name}'@'localhost'") (create_users_ensure name)); in { @@ -105,7 +105,8 @@ in lib.concatLines ( (builtins.attrValues (builtins.mapAttrs add-user-clauses cfg.users)) ++ (map add-unix-user-clauses cfg.unix_users) - ) + ++ ["FLUSH PRIVILEGES;"] + ) ); }; @@ -116,6 +117,7 @@ in package = pkgs.mariadb; settings = { mysqld = { + # socket="/var/lib/mysql/mysql.sock"; log_error = "/var/log/mysql_err.log"; log_warnings = 2; }; diff --git a/services/uptimekuma.nix b/services/uptimekuma.nix index 1ac6006..32549c3 100644 --- a/services/uptimekuma.nix +++ b/services/uptimekuma.nix @@ -33,6 +33,7 @@ in users.groups.uptimekuma = { }; systemd.services.uptime-kuma.serviceConfig.User = "uptimekuma"; + systemd.services.uptime-kuma.after = ["mysql.service"]; # sops.secrets = # (lib.genAttrs (map toSops secrets) @@ -69,7 +70,7 @@ in UPTIME_KUMA_PORT = "3111"; UPTIME_KUMA_HOST = "127.0.0.1"; UPTIME_KUMA_DB_TYPE = "sqlite"; - UPTIME_KUMA_DB_SOCKET = "/var/lib/mysql/mysql.sock"; + UPTIME_KUMA_DB_SOCKET = "/run/mysqld/mysqld.sock"; }; }; }); diff --git a/services/vaultwarden.nix b/services/vaultwarden.nix index 4aa24ba..90feace 100644 --- a/services/vaultwarden.nix +++ b/services/vaultwarden.nix @@ -61,7 +61,7 @@ in services.vaultwarden = { enable = cfg.enable; - backupDir = "/srv/data/vaultwarden"; + backupDir = cfg.backupDir; config = { DOMAIN = cfg.domain; ROCKET_ADDRESS = "127.0.0.1"; diff --git a/services/wakapi.nix b/services/wakapi.nix index c89a46a..69251d3 100644 --- a/services/wakapi.nix +++ b/services/wakapi.nix @@ -64,10 +64,11 @@ in }; }; + systemd.services.wakapi.after = ["mysql.service"]; services.wakapi = { enable = true; stateDir = cfg.dataDir; - passwordSaltFile = config.sops.secrets.wakapi/password_salt; + passwordSaltFile = config.sops.secrets."wakapi/password_salt".path; settings = { server = { port = 3111; @@ -83,10 +84,9 @@ in datetime_format = "Mon, 02 Jan 2006 15:04"; }; db = { - socket = "/var/lib/mysql/mysql.sock"; + socket = "/run/mysqld/mysqld.sock"; name = "wakapi"; dialect = "mysql"; - charset = "utf8mb4"; }; security = { insecure_cookies = false; -- cgit v1.3.1