machines/porthos/services.nix

@@ -52,7 +52,6 @@ in
     lohr = {
       enable = true;
       sharedSecretFile = secrets."lohr/secret".path;
-      sshKeyFile = secrets."lohr/ssh-key".path;
     };
     # Matrix backend and Element chat front-end
     matrix = {

modules/secrets/secrets.nix

@@ -19,7 +19,6 @@ in
   "drone/ssh/private-key.age".publicKeys = all;
 
   "lohr/secret.age".publicKeys = all;
-  "lohr/ssh-key.age".publicKeys = all;
 
   "matrix/mail.age" = {
     owner = "matrix-synapse";

modules/services/lohr/default.nix

@@ -5,9 +5,6 @@ let
   settingsFormat = pkgs.formats.yaml { };
 
   lohrPkg = pkgs.ambroisie.lohr;
-
-  lohrStateDirectory = "lohr";
-  lohrHome = "/var/lib/lohr/";
 in
 {
   options.my.services.lohr = with lib; {
@@ -37,15 +34,6 @@ in
       example = "/run/secrets/lohr.env";
       description = "Shared secret between lohr and Gitea hook";
     };
-
-    sshKeyFile = mkOption {
-      type = with types; nullOr str;
-      default = null;
-      example = "/run/secrets/lohr/ssh-key";
-      description = ''
-        The ssh key that should be used by lohr to mirror repositories
-      '';
-    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -58,31 +46,16 @@ in
         Environment = [
           "ROCKET_PORT=${toString cfg.port}"
           "ROCKET_LOG_LEVEL=normal"
-          "LOHR_HOME=${lohrHome}"
+          "LOHR_HOME=/var/lib/lohr/"
           "LOHR_CONFIG="
         ];
-        ExecStartPre = lib.mkIf (cfg.sshKeyFile != null) ''+${
-          pkgs.writeScript "copy-ssh-key" ''
-            #!${pkgs.bash}/bin/bash
-            # Ensure the key is not there
-            mkdir -p '${lohrHome}/.ssh'
-            rm -f '${lohrHome}/.ssh/id_ed25519'
-
-            # Move the key into place
-            cp ${cfg.sshKeyFile} '${lohrHome}/.ssh/id_ed25519'
-
-            # Fix permissions
-            chown -R lohr:lohr '${lohrHome}/.ssh'
-            chmod -R 0700 '${lohrHome}/.ssh'
-          ''
-        }'';
         ExecStart =
           let
             configFile = settingsFormat.generate "lohr-config.yaml" cfg.setting;
           in
           "${lohrPkg}/bin/lohr --config ${configFile}";
-        StateDirectory = lohrStateDirectory;
+        StateDirectory = "lohr";
-        WorkingDirectory = lohrHome;
+        WorkingDirectory = "/var/lib/lohr";
         User = "lohr";
         Group = "lohr";
       };
@@ -93,7 +66,7 @@ in
 
     users.users.lohr = {
       isSystemUser = true;
-      home = lohrHome;
+      home = "/var/lib/lohr";
       createHome = true;
       group = "lohr";
     };