From e9fd2a86e31d7c3d3c90a325c865552addb5e573 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Victor=20I=C8=99an?= <victor@isan.ro>
Date: Wed, 8 Jul 2026 14:25:44 +0200
Subject: [PATCH] containers: changed clementines config

---
 modules/agenix.nix                            |  6 +++
 .../containers/specificallyclementines.nix    |  7 ++-
 secrets/clementines-jwt.age                   | 24 ++++++++++
 secrets/clementines.age                       | 45 +++++++++----------
 secrets/secrets.nix                           |  1 +
 5 files changed, 56 insertions(+), 27 deletions(-)
 create mode 100644 secrets/clementines-jwt.age

diff --git a/modules/agenix.nix b/modules/agenix.nix
index 0120fc0..a709f2c 100644
--- a/modules/agenix.nix
+++ b/modules/agenix.nix
@@ -53,5 +53,11 @@
             group = "admin";
             mode = "0440";
         };
+        clementines-jwt = {
+            file = ../secrets/clementines-jwt.age;
+            owner = "root";
+            group = "root";
+            mode = "0440";
+        };
     };
 }
diff --git a/modules/containers/specificallyclementines.nix b/modules/containers/specificallyclementines.nix
index 58d9790..40fc431 100644
--- a/modules/containers/specificallyclementines.nix
+++ b/modules/containers/specificallyclementines.nix
@@ -5,8 +5,7 @@ let
 in
 {
     systemd.tmpfiles.rules = [
-        "d ${workDir}/dbdata 2770 root admin"
-        "d ${workDir}/dbetclocal 2770 root admin"
+        "d ${workDir} 2770 root admin"
     ];
 
     virtualisation.oci-containers.containers = {
@@ -19,8 +18,8 @@ in
             ];
 
             volumes = [
-                "${workDir}/dbdata:/opt/couchdb/data"
-                "${workDir}/dbetclocal:/opt/couchdb/etc/local.d"
+                "${workDir}:/opt/couchdb/data"
+                "${config.age.secrets.clementines-jwt.path}:/opt/couchdb/etc/local.d/jwt.ini:ro"
             ];
 
             environmentFiles = [
diff --git a/secrets/clementines-jwt.age b/secrets/clementines-jwt.age
new file mode 100644
index 0000000..0ab728a
--- /dev/null
+++ b/secrets/clementines-jwt.age
@@ -0,0 +1,24 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFA5bEdnQSBHMTVq
+a2kxaGhpNVEwRVlmbE1sWWk2ckVSUDErcEZMeWpJcnhVMktNZzMwClVCUmFjRFRZ
+emVsbXN4aTQ5dlJ4MFJUbVJjK0dyaGtxczBRd1Y0T1l0TGMKLT4gc3NoLWVkMjU1
+MTkgS0tuNDVBIDdUMm1ILzFvKy9FWHcxSDcybXh3azJRRW9vcUh6REQ1TEE4aG15
+VVYxRkUKQWRER2lNV0JCQTZ0T3R1RWxPUWp5ZTF3Q1Y3TWlkK01heTFENWx5SUNV
+VQotPiB+KEoha0EtZ3JlYXNlIHIgRiU1c1ogbTQgbjQmWEY7RSIKcmhxdmF6UkQr
+LzY1V2hBNnd0NTBVTllnWFFDaFh2SWkvc3NGS3F1TVBVaUlnZ0tuNG5QeWtNalB3
+S2tFCi0tLSBmMitrQVFiZnpRUjd5cTVpQ1czRGk5b015Q3A5aVYxS3hkZ3NRWDJy
+V1JNCtXL2YlFVcap/E6uDAe7D2/IeiEQsKzQ/rcaw5P8nQmlcYib6N2V7B3u+djZ
+zQlpEGkunGzJMiwK7Lri1YeUopqiBHeruFQM043UfC/zAphF/JIRAK+DQyQJg634
+s3nL2zjy4ToQTmB3Kogu4chndv08zKtYBYRvKl/IgJCzHQp86d+2GOqoHjCvthOK
+3djyNoxkF7hmlUdAZe1eITjh35Wh6fdLnlaqiQOe/4W2EXT+V+8xwPrB/7q0KQ7o
+T792YyemMpWvAdIjfRDMBQLyMbTKrhJp4vSSi8jyMFgWfpjn9zNQGxqZHDiEB7Pn
+87dIC1iAX9a2gh6X/0SfYODp53CHwmJ9/50o3gdI1bj0WgNSnmUE5KUtv56AgKBp
+erE5cre3Rb1twi0cJrc4TsQGHT3Gc50zl1kCZ+QOCoUQ0peRJipJy9KtFMZa+wg8
+HImr0JzKB/92zmHfV9DhusWCOouBL98FUMzpPTkh+MDR5W5TnTfKJ41n8Ljay4t+
+TyKvJj/ckMKXVMC8EGfkgcx8AoeaK57UgG5kCoQ1o7JFUm3GYrJzYSQVhPv4EEct
+9Np9naeHNBvuqvyMNfRlkxPSlSMpC32+Al27Le3am6//av3yWmGQ6wa8FHB8VgWT
++6xxJT8XYHgx/Pr15h/t9kSBgO92rglHa6Baz3FN09/97kUuyi+1XtESs7F4i/4p
+xhg3fSMSgUVuk+WsINLGO/04CC7aeuaJGEaqn7RS8inuoH0awbLTFtlM5ZvjhtI6
+Mw0s4uD0aeAl//7hEacEmtKfDtCOz/+r6QmpkOdmHI53QA1RZpHQWiuSe9+/+FiX
+4Ag2POg=
+-----END AGE ENCRYPTED FILE-----
diff --git a/secrets/clementines.age b/secrets/clementines.age
index 745fd16..2bb59f4 100644
--- a/secrets/clementines.age
+++ b/secrets/clementines.age
@@ -1,25 +1,24 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFA5bEdnQSBiNHlu
-V2lPT1dsc09xMVNvVnhkWnExRW1VaUZtZGI5RzhucE80ZXhseWlFCjNUZUk5WDVv
-NVdlOXFCWW8zdFJ5R3I3V01nZ0pyaStnK1NMUGJHaVhaQUUKLT4gc3NoLWVkMjU1
-MTkgS0tuNDVBIGoxTVU5T0ZCaFJjOHlFLzNyaGYwWWxuZ2VKTU9JQ1AxZkNIWkJs
-SjNpd2cKalVLVnZnSTQ2dUpPdTdWdUhRRlBvK1huVUgwdk5SRngwU0x1UmwvdEZu
-NAotPiApe3pKYl0tZ3JlYXNlIHwgP3dwZSEsKApiV1YvVkxtS1JmNnRLU0hBWHpw
-dkNUVCtjUk5Idks4UnlOK3ppZUZxR3doSjRLb09hRFNjVW02RUJuTEhBY1dvCkRh
-WHN5WlJOWFRtVVNtVHRMZmMKLS0tIE9OaHluNEZDdGJhQzZ0cTVrWnJlYWV3MlNR
-STArRUhYQXJMZ3BhQm0xeEEKfNX3iTmFEVi9+000T1KkV0FtdA62z/TCBbKfyFwL
-jU6UBakVXy2ih1hbt3WboOyLw+mShW1qtyL1O3obfAmmiYslyMgVqiSQNwqcABoY
-0Af3tNYRymykX9wMTDkouQHNwZkwVx7nSyY800vHum0jpUSqiu9jPrNOEubKIYcq
-N3ky8ufcL+s4yED6q6W60TKLgVZ4Iy+rVFYi6LxDBlIC72+LSlSWZfNd8m4M5aI3
-cYSL8h81tH1byQIQFCy7fp/PbycD1IPl1pVPxZaiHrZ9QlQIDSBgszPP0y1VrEdR
-BR3c29gjQD6FcNAOTf/klWFwIHGbYBmNujUziL9stWIR01vhqp6uJ8/o851bOKKR
-uMYiyZumhfhzb4P/F1wi1A4AuiafIffdKYTzqOU8Qu2CSUOevNhNASgAW8sbqHuw
-B3G3T+KqjTVa8fue1JABvBhs6NSBpHFvubi9BMKo7RApaUGFSQob7EYwOSG5v08d
-mIFexKbZ+Sqh2uZCFV+aiiTdz9k1XUu+jK/7jmGX26aU1msBVTdLopiq605vhGjo
-GXyI6x84E4kuYigl+hJhLcY0EY4iQLRD7Bfe+YHG/dE0H+cGv1rk0H7BqmEno1So
-fTkNl8hZJmpbc5cYkAtR8jSzEYwTd0gOo+ny8tfGjvzYKg/9qmccYfWrgVM9NuFL
-FKRaFj+PPBdmHLYIhCcFXtu/7YW0N1PFBE5/pIOldtVKwDTVutovX9nIebP6ykHo
-P0lcN2izR3gK6bP1aB9qjj1TKuk+CKHJwx9ugA3wf2JsuVTC25XKRLTGUjYW/eXr
-+F2lmLRJqJFV6Y4flvI6b9uOcHraZ+6DfxymliPw3YVkHBCtdzRzflpwAJ0+AvTx
-T73B4wAQkEoE8Jl6BElclOlk8aEDKtlXY9B7QwpZYuynhFM=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFA5bEdnQSB4d1Zz
+S3pOZlVkeXhVWmtxYTZIcnFmYlZuNkdMMnFkN1QwcjU2NFIvNFdFCkt5S3pMQWh4
+cjdxZktLaHhySVZBeFBEOUdlelM1UEJON3pIOExBdENGK28KLT4gc3NoLWVkMjU1
+MTkgS0tuNDVBIHBIb1lHUmRRZlkwaytpaE4xWkZVRzFtd2h3MHg2czVmWW04eGgv
+dDRvbkkKK1lVODVrcXVQWFMrR0l2UCtxVnpOY2lRN2ZJdkJJaXl4V0dHUVN2R1h2
+UQotPiA7JiMpP3FUOy1ncmVhc2UKRmVTcHJZeVFZZwotLS0gVzUydUhFTzV4N2sz
+KzZNRzJaWTBNcCtEWXN6OXI4UTFDOEJaRGh6MjRRSQoXxHSENke/Jl+WMj9Dy8n4
+tuXAHGPIKMsiW+PjIu1Q+2PBc3jB5LvZyF/YenXO9Vhu06oDMY7pmHOHRv90MqwV
+emSMKwIOKgZ5wa8cMLQT0XRm/iddLerqUFuhctZnu47jlmdwWXaV8BecP/EA+w37
+drpaDVIyC/6ybX7djGXDPflytUsy6cXKA3jKBFmw77ONrqu5Jid+Ng+dD2hEXLGp
+LNs/BVD8Ihui7XxWqutUqtCDb8y99OwZxejJvCsk07d22+1x7y8dQXT83gevOBm8
+SeHHD1ApB1GH8VXbZqp7N7nY5oPsdSdHTtlYGdFmU9nVzfR66yJuQfoOFSzcXy6/
+xXp9QCncdq7PvDPFNLwlUEVP1OG93O9HadTaUJpHDJZrYrnn2WcSWbzceE5ujHYG
+iFaGwNRSDmN8m0QyOz6ASt4C3YNMhw0JZ5iR2EZSJ8/+ORgtb2ZG2QnB2er8LX0D
+lZXCt5NP27j082K3rNXFmqGYj2yH/WO0r5bp0AOqxYV9oLunq1POfLP/N2RNsmdZ
+0NzzA3lGPmzhU4ARTRVVLvgDb1PDgfed2E7uX++oHEW/kdkB4vvLyn+wwS/dIHgE
+bCdYNoYTPkS/kq+mIK2z2oq66rYAZlRWBNL8CJQnMoPaoRIZ9h0G2AtR55oVWgFh
+Fc6Q09U5yCo6zUU2v3bEN1SOj00jyZZbMcFBB6IYqAazwsqvisvwyPW911AMYmOW
+sxZSJznPhZ1HiYrtz1VJm2ngWpLtC2/8hIkVrtfRNuDhvWiS9YviWrqvowcD85A1
+vUdA0uMvVxhCJzBughocY5uGoKhj3KGXRsjz5AkZb73RIsfMFNlHx6FiYH9s4Rmn
+UOQi1X1CznqYSX7FrrU4lzHFu6bBy892mT3+nMMgUWkvNmsQ5vDl4c2WrI3NdXS1
+1Fk=
 -----END AGE ENCRYPTED FILE-----
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 2997b3a..83219d9 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -13,4 +13,5 @@ in
   "immich.age".publicKeys = [ victor isengard ];
   "argus-conf.age".publicKeys = [ victor isengard ];
   "clementines.age".publicKeys = [ victor isengard ];
+  "clementines-jwt.age".publicKeys = [ victor isengard ];
 }