Adding Secrets #
Note
See sops-nix documentation for more details.
We can make use of sops-nix templates to deploy Kubernetes secrets which can then be referenced by Helm charts and other manifests. This should be done for all sensitive data such as API keys and passwords:
{
self,
inputs,
...
}:
{
flake.modules.nixos.immich-secrets =
{
config,
lib,
pkgs,
...
}:
{
config = lib.mkIf (config.immich.enable && config.secrets.enable && config.secrets.immich.enable) {
sops = {
secrets = {
"immich/key" = { };
"immich/postgres_password" = { };
"immich/valkey_password" = { };
};
templates = {
immich-secrets = {
content = builtins.toJSON {
apiVersion = "v1";
kind = "Secret";
metadata = {
name = "immich-secrets";
namespace = "immich";
};
type = "Opaque";
stringData = {
username = "immich";
password = config.sops.placeholder."immich/postgres_password";
valkey-password = config.sops.placeholder."immich/valkey_password";
};
};
path = "/var/lib/rancher/k3s/server/manifests/immich-secrets.json";
};
};
};
};
};
}