Open ajgon opened 1 month ago
Ok, there "is" workaround, by using sqlx env vars as described here: https://docs.rs/sqlx/latest/sqlx/postgres/struct.PgConnectOptions.html#impl-PgConnectOptions .
So by setting:
{
services.atticd.database.url = "postgresql://postgres@localhost:5432/attic";
}
and then adding PGPASSWORD=mypostgrespassword
to credentials file, I managed to make it work. Still I think, it's a hack, and not a proper solution of the problem :)
thanks for documenting this workaround, seems like the issue is because of the hardcoded default url for an sqlite db.
So, my use case is basically to avoid exposing a secret (postgres password) anywhere in repository or nix store. To do so, I'm leveraging sops-nix files with secrets. Here is the part of my config:
and in sops
attic/server/credentials
:So far so good, credentials file is generated properly and loaded as environment file. But atticd still uses sqlite as it's DB. My assumption is, because nix sets a default in settings here: https://github.com/zhaofengli/attic/blob/main/nixos/atticd.nix#L174 and env var has lower priority.
As a workaround I tried to use
configFile
and pass full config from sops there, but because checkedConfigFile evaluates too early, the sops secret is not there yet.Is there any way, to pass postgres password without exposing it? Also I think that env being effectively ignore, is a bug, and should be taking priority if set.