From 48467689090388d3c1b0648c9079dcaec3671e6e Mon Sep 17 00:00:00 2001
From: oppiliappan <me@oppi.li>
Date: Fri, 8 Aug 2025 11:46:24 +0100
Subject: [PATCH] nix: add secrets config to spindle module

Signed-off-by: oppiliappan <me@oppi.li>
---
 nix/modules/spindle.nix | 22 ++++++++++++++++++++++
 nix/vm.nix              |  3 +++
 2 files changed, 25 insertions(+)

diff --git a/nix/modules/spindle.nix b/nix/modules/spindle.nix
index 60081bd3..dbde1eb3 100644
--- a/nix/modules/spindle.nix
+++ b/nix/modules/spindle.nix
@@ -54,6 +54,25 @@ in
             example = "did:plc:qfpnj4og54vl56wngdriaxug";
             description = "DID of owner (required)";
           };
+
+          secrets = {
+            provider = mkOption {
+              type = types.str;
+              default = "sqlite";
+              description = "Backend to use for secret management, valid options are 'sqlite', and 'openbao'.";
+            };
+
+            openbao = {
+              proxyAddr = mkOption {
+                type = types.str;
+                default = "http://127.0.0.1:8200";
+              };
+              mount = mkOption {
+                type = types.str;
+                default = "spindle";
+              };
+            };
+          };
         };
 
         pipelines = {
@@ -89,6 +108,9 @@ in
             "SPINDLE_SERVER_JETSTREAM=${cfg.server.jetstreamEndpoint}"
             "SPINDLE_SERVER_DEV=${lib.boolToString cfg.server.dev}"
             "SPINDLE_SERVER_OWNER=${cfg.server.owner}"
+            "SPINDLE_SERVER_SECRETS_PROVIDER=${cfg.server.secrets.provider}"
+            "SPINDLE_SERVER_SECRETS_OPENBAO_PROXY_ADDR=${cfg.server.secrets.openbao.proxyAddr}"
+            "SPINDLE_SERVER_SECRETS_OPENBAO_MOUNT=${cfg.server.secrets.openbao.mount}"
             "SPINDLE_PIPELINES_NIXERY=${cfg.pipelines.nixery}"
             "SPINDLE_PIPELINES_WORKFLOW_TIMEOUT=${cfg.pipelines.workflowTimeout}"
           ];
diff --git a/nix/vm.nix b/nix/vm.nix
index 2f69fa93..41ff743c 100644
--- a/nix/vm.nix
+++ b/nix/vm.nix
@@ -62,6 +62,9 @@ nixpkgs.lib.nixosSystem {
           hostname = "localhost:6555";
           listenAddr = "0.0.0.0:6555";
           dev = true;
+          secrets = {
+            provider = "sqlite";
+          };
         };
       };
     })
-- 
2.51.2