pgadmin: Use systemd's LoadCredential for password files (#312569)

* pgadmin: Use systemd's LoadCredential for password files

* Update nixos/modules/services/admin/pgadmin.nix

---------

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>

TNE 4582b524 aa5d9c30

Changed files
+7 -3
nixos
modules
services
admin
+7 -3
nixos/modules/services/admin/pgadmin.nix
···
# Check here for password length to prevent pgadmin from starting
# and presenting a hard to find error message
# see https://github.com/NixOS/nixpkgs/issues/270624
-
PW_LENGTH=$(wc -m < ${escapeShellArg cfg.initialPasswordFile})
if [ $PW_LENGTH -lt ${toString cfg.minimumPasswordLength} ]; then
echo "Password must be at least ${toString cfg.minimumPasswordLength} characters long"
exit 1
···
echo ${escapeShellArg cfg.initialEmail}
# file might not contain newline. echo hack fixes that.
-
PW=$(cat ${escapeShellArg cfg.initialPasswordFile})
# Password:
echo "$PW"
···
LogsDirectory = "pgadmin";
StateDirectory = "pgadmin";
ExecStart = "${cfg.package}/bin/pgadmin4";
};
};
···
environment.etc."pgadmin/config_system.py" = {
text = lib.optionalString cfg.emailServer.enable ''
-
with open("${cfg.emailServer.passwordFile}") as f:
pw = f.read()
MAIL_PASSWORD = pw
'' + formatPy cfg.settings;
···
# Check here for password length to prevent pgadmin from starting
# and presenting a hard to find error message
# see https://github.com/NixOS/nixpkgs/issues/270624
+
PW_FILE="$CREDENTIALS_DIRECTORY/initial_password"
+
PW_LENGTH=$(wc -m < "$PW_FILE")
if [ $PW_LENGTH -lt ${toString cfg.minimumPasswordLength} ]; then
echo "Password must be at least ${toString cfg.minimumPasswordLength} characters long"
exit 1
···
echo ${escapeShellArg cfg.initialEmail}
# file might not contain newline. echo hack fixes that.
+
PW=$(cat "$PW_FILE")
# Password:
echo "$PW"
···
LogsDirectory = "pgadmin";
StateDirectory = "pgadmin";
ExecStart = "${cfg.package}/bin/pgadmin4";
+
LoadCredential = [ "initial_password:${cfg.initialPasswordFile}" ]
+
++ optional cfg.emailServer.enable "email_password:${cfg.emailServer.passwordFile}";
};
};
···
environment.etc."pgadmin/config_system.py" = {
text = lib.optionalString cfg.emailServer.enable ''
+
import os
+
with open(os.path.join(os.environ['CREDENTIALS_DIRECTORY'], 'email_password')) as f:
pw = f.read()
MAIL_PASSWORD = pw
'' + formatPy cfg.settings;