From 85b5c2bce69ac3d5037d6bf9888555e1cc70171f Mon Sep 17 00:00:00 2001
From: Tobias Ostner <tobias.ostner@gmail.com>
Date: Sat, 11 Apr 2026 19:38:28 +0200
Subject: [PATCH] manage nextcloud admin-pass with sops

---
 modules/nextcloud.nix  | 8 +++++++-
 secrets/tobserver.yaml | 6 ++++--
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/modules/nextcloud.nix b/modules/nextcloud.nix
index 398fb9a..f7e63c9 100644
--- a/modules/nextcloud.nix
+++ b/modules/nextcloud.nix
@@ -10,6 +10,12 @@
     mode = "0400";
   };
 
+  sops.secrets."nextcloud/admin-pass" = {
+    owner = "root";
+    group = "root";
+    mode = "0400";
+  };
+
   services = {
 
     nextcloud = {
@@ -23,7 +29,7 @@
       config = {
         dbtype = "mysql";
         adminuser = "tobi";
-	      adminpassFile = "/var/lib/nextcloud/admin-pass";
+	      adminpassFile = config.sops.secrets."nextcloud/admin-pass".path;
       };
 
       autoUpdateApps.enable = true;
diff --git a/secrets/tobserver.yaml b/secrets/tobserver.yaml
index ff4ff8c..ebc1005 100644
--- a/secrets/tobserver.yaml
+++ b/secrets/tobserver.yaml
@@ -1,6 +1,8 @@
 mempool:
     mariadb-password: ENC[AES256_GCM,data:NmFq8C3stA==,iv:XUvpviqUiS4UFCyZ3eahNY6NNy6/q3kLgWDfMW6I52U=,tag:9i5TO+9KbyM73RldtBw0fw==,type:str]
     mariadb-root-password: ENC[AES256_GCM,data:CjXQWw==,iv:3amyq9/3Nq7pz8s7wk4UORI1gSgURufGh1u/cITQf/I=,tag:4ulBVRDh0Ws04IqHT5P6tg==,type:str]
+nextcloud:
+    admin-pass: ENC[AES256_GCM,data:3xufFHvcm5g5+jn+B4qxRljuWDqDXo1mLu4IlSuax7Cz+3ZoOuNXoCXoiaY=,iv:WaWeu/a45Vuz+HvO7m0dUlCGCexk4IX/ijURmb/7jPU=,tag:ytRjS89AmHiGOhKymViTrg==,type:str]
 sops:
     age:
         - recipient: age1qnudtkywppsdk6zn6jh9gra093w4mnf63m333hxsms9ys7elkpps3y008z
@@ -21,7 +23,7 @@ sops:
             cVE5VG56cFAzT1dsRFN4cCtnVEJJdU0KSBWm4blGhnVlOJ3k7lh8aJVOEH8NfFOh
             EwU/4Up6zWYBoe2+GKiQf8imnVLSSxMR7dlNd06ttuFD4B5baqFRcA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-11T12:27:40Z"
-    mac: ENC[AES256_GCM,data:Uk6vIxyBzRLa3+IoQ0Tv5T4dwz2EQehuBSEXAzeTeNxf7ob/GRgzdZxVyoq0ycEOz3JS7k6RjhZYe0zDXMnp/9FVsWbItFiFs8OfqkxVbrjXjBCk5CeUENaeND4Hu7L0GvLCJYm7JPeI4+0Jr0DE0bPQs+HGYcwPUwDxqsjqgxU=,iv:zNNnfmlbQdfjzX3hqBEiw98TQUvUGiIbedqurWV/zBw=,tag:f8dfjTtWg48lls/Ah2wvtQ==,type:str]
+    lastmodified: "2026-04-11T17:27:25Z"
+    mac: ENC[AES256_GCM,data:0926uedsIZ1GyhtTJjedMPds3zGvANUlRH6ro0abt391OfJ+b1z/pgjT7bRxiJNCOZITKfkaWoXR0529PK00dZAI2Z70lX2oDftNEtBzX+cq994m0s3HlfjaChqRwpFfxxX7sYbyvGqQRJxxgbiMfloyNeps55ODKXGXYwNKYog=,iv:PRHplnL6SUBwx1+wpi8uvWKZvHurhdiexIJr0kjQ8ao=,tag:uwDy9B7uP0khPorbc2woRA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.11.0