servers/mermet/keys.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (builtins.extraBuiltins) pass;
   4   inherit (config) networking;
   5 in
   6 {
   7   deployment.keys = {
   8     "${networking.domain}.key.pem" = {
   9       text        = pass "x509/${networking.domain}/key.pem";
  10       user        = "root";
  11       group       = "root";
  12       destDir     = "/run/keys/";
  13       permissions = "0400"; # WARNING: not enforced when deployment.storeKeysOnMachine = true
  14     };
  15   };
  16 }