Centralized shared secrets

hosts/bastion/profiles/caddy/default.nix

@@ -1,18 +1,31 @@
-{ config, hosts, ... }: {
-  sops.secrets = {
-    e10_camp_lego_route53_credentials = {
-      sopsFile = ./secrets.yml;
-      format = "yaml";
-    };
-
+{
+  config,
+  hosts,
+  lib,
+  profiles,
+  ...
+}:
+let
+  # Parses a port from an address (e.g., `http://foo.bar:4000` -> `4000`)
+  portFromAddress =
+    addr:
+    lib.pipe addr [
+      (lib.strings.splitString ":")
+      lib.lists.last
+      lib.strings.toInt
+    ];
+in
+{
+  imports = [ profiles.secrets.aws.default ];
+
+  sops.templates = {
     e10_video_lego_route53_credentials = {
-      sopsFile = ./secrets.yml;
-      format = "yaml";
-    };
-
-    e10_land_lego_route53_credentials = {
-      sopsFile = ./secrets.yml;
-      format = "yaml";
+      content = ''
+        AWS_ACCESS_KEY_ID="${config.sops.placeholder.aws_access_key_id}"
+        AWS_SECRET_ACCESS_KEY="${config.sops.placeholder.aws_secret_access_key}"
+        AWS_REGION=us-east-2
+        AWS_HOSTED_ZONE_ID=Z01153052TLZPYRX634V
+      '';
     };
   };
 
@@ -67,7 +80,9 @@
     proxies = {
       "e10.land" = {
         host = hosts.matrix;
-        port = 8090;
+        port =
+          portFromAddress
+            hosts.matrix.config.services.caddy.virtualHosts."http://e10.land:8090".hostName;
         extraConfig = ''
           encode gzip zstd
         '';
@@ -125,13 +140,13 @@
       "requests.e10.video" = {
         host = hosts.htpc;
         inherit (hosts.htpc.config.services.seerr) port;
-        acme.environmentFile = config.sops.secrets.e10_video_lego_route53_credentials.path;
+        acme.environmentFile = config.sops.templates.e10_video_lego_route53_credentials.path;
       };
 
       "tautulli.e10.camp" = {
         host = hosts.htpc;
         inherit (hosts.htpc.config.services.tautulli) port;
-        acme.environmentFile = config.sops.secrets.e10_video_lego_route53_credentials.path;
+        acme.environmentFile = config.sops.templates.e10_video_lego_route53_credentials.path;
       };
 
       "cache.builder.e10.camp" = {
@@ -172,12 +187,14 @@
 
       "netbox.e10.camp" = {
         host = hosts.matrix;
-        port = 8002;
+        port =
+          portFromAddress
+            hosts.matrix.config.services.caddy.virtualHosts."http://netbox.e10.camp:8002".hostName;
       };
 
       "cache.e10.camp" = {
         host = hosts.omnibus;
-        port = 8080;
+        port = portFromAddress hosts.omnibus.config.services.atticd.settings.listen;
         extraConfig = ''
           encode gzip zstd
 
@@ -211,13 +228,15 @@
 
       "auth.e10.camp" = {
         host = hosts.bastion;
-        port = 9091;
+        port = portFromAddress hosts.bastion.config.services.authelia.instances.bastion.settings.server.address;
       };
 
       "speedtest-tracker.e10.camp" = {
         host = hosts.controller;
-        port = 8881;
-        # inherit (hosts.controller.config.services.speedtest-tracker) port;
+        inherit
+          ((builtins.head hosts.controller.config.services.nginx.virtualHosts."speedtest-tracker".listen))
+          port
+          ;
       };
 
       "change-detection.e10.camp" = {

modules/profiles/media-management/bazarr/default.nix

@@ -1,4 +1,15 @@
-{ config, lib, ... }: {
+{
+  config,
+  lib,
+  profiles,
+  ...
+}:
+{
+  imports = [
+    profiles.secrets.sonarr.default
+    profiles.secrets.radarr.default
+  ];
+
   sops = {
     secrets = {
       bazarr_api_key = {
@@ -11,16 +22,6 @@
         format = "yaml";
       };
 
-      bazarr_radarr_api_key = {
-        sopsFile = ./secrets.yml;
-        format = "yaml";
-      };
-
-      bazarr_sonarr_api_key = {
-        sopsFile = ./secrets.yml;
-        format = "yaml";
-      };
-
       bazarr_opensubtitles_username = {
         sopsFile = ./secrets.yml;
         format = "yaml";
@@ -279,7 +280,7 @@
           username = "";
         };
         radarr = {
-          apikey = config.sops.placeholder.bazarr_radarr_api_key;
+          apikey = config.sops.placeholder.radarr_api_key;
           base_url = "";
           defer_search_signalr = false;
           excluded_tags = [ ];
@@ -310,7 +311,7 @@
           year = 90;
         };
         sonarr = {
-          apikey = config.sops.placeholder.bazarr_sonarr_api_key;
+          apikey = config.sops.placeholder.sonarr_api_key;
           base_url = "";
           defer_search_signalr = false;
           episodes_sync = 60;

modules/profiles/media-management/radarr/default.nix

@@ -1,12 +1,13 @@
-{ flake, config, ... }: {
-  imports = [ ./postgresql.nix ];
+{
+  flake,
+  config,
+  profiles,
+  ...
+}:
+{
+  imports = [ profiles.secrets.radarr.default ] ++ [ ./postgresql.nix ];
 
   sops = {
-    secrets.radarr_api_key = {
-      sopsFile = ./secrets.yml;
-      format = "yaml";
-    };
-
     templates."radarr/config.xml" = {
       content =
         flake.lib.generators.toXML

modules/profiles/media-management/sonarr/default.nix

@@ -1,12 +1,13 @@
-{ flake, config, ... }: {
-  imports = [ ./postgresql.nix ];
+{
+  flake,
+  config,
+  profiles,
+  ...
+}:
+{
+  imports = [ profiles.secrets.sonarr.default ] ++ [ ./postgresql.nix ];
 
   sops = {
-    secrets.sonarr_api_key = {
-      sopsFile = ./secrets.yml;
-      format = "yaml";
-    };
-
     templates."sonarr/config.xml" = {
       content =
         flake.lib.generators.toXML