maurice/snix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Disabling the monzo-token-server

Browse source 
I haven't used this since I wrote it... and now the .tokens attribute is missing
and it's screwing up my other deployment... *sigh*
This commit is contained in:
William Carroll 2020-08-13 22:26:29 +01:00
parent 0b34482b6d
commit 4a836f363b
1 changed files with 19 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

40
nixos/socrates/configuration.nix
View file

@ -115,27 +115,25 @@ in {
rootUrl = "https://git.wpcarro.dev/"; rootUrl = "https://git.wpcarro.dev/";
}; };
systemd.services.monzo-token-server = { # systemd.services.monzo-token-server = {
enable = true; # enable = true;
description = "Ensure my Monzo access token is valid"; # description = "Ensure my Monzo access token is valid";
script = "${briefcase.monzo_ynab.tokens}/bin/token-server"; # script = "${briefcase.monzo_ynab.tokens}/bin/token-server";
# # TODO(wpcarro): I'm unsure of the size of this security risk, but if a
# TODO(wpcarro): I'm unsure of the size of this security risk, but if a # # non-root user runs `systemctl cat monzo-token-server`, they could read the
# non-root user runs `systemctl cat monzo-token-server`, they could read the # # following, sensitive environment variables.
# following, sensitive environment variables. # environment = {
environment = { # store_path = "/var/cache/monzo_ynab";
store_path = "/var/cache/monzo_ynab"; # monzo_client_id = readSecret "monzo-client-id";
monzo_client_id = readSecret "monzo-client-id"; # monzo_client_secret = readSecret "monzo-client-secret";
monzo_client_secret = readSecret "monzo-client-secret"; # ynab_personal_access_token = readSecret "ynab-personal-access-token";
ynab_personal_access_token = readSecret "ynab-personal-access-token"; # ynab_account_id = readSecret "ynab-account-id";
ynab_account_id = readSecret "ynab-account-id"; # ynab_budget_id = readSecret "ynab-budget-id";
ynab_budget_id = readSecret "ynab-budget-id"; # };
}; # serviceConfig = {
# Type = "simple";
serviceConfig = { # };
Type = "simple"; # };
};
};
services.gitDaemon = { services.gitDaemon = {
enable = true; enable = true;