NixOS deployment #

Import provenance.nixosModules.default into your NixOS configuration. Use string paths for runtime data and Agenix secrets:

services.provenance.appview = {
  enable = true;
  dataDirectory = "/srv/provenance/appview";
  serviceKeyFile = config.age.secrets.provenance-service.path;
  jetstreamReplay = true;
  jetstreamAPIKeyFile = config.age.secrets.jetstream.path;
};

services.provenance.ui = {
  enable = true;
  dataDirectory = "/srv/provenance/ui";
  serviceKeyFile = config.age.secrets.provenance-service.path;
  encryptionKeyFile = config.age.secrets.provenance-encryption.path;
  publicOrigin = "https://provenance.example.com";
};

Systemd reads Agenix secrets through LoadCredential. Secret contents do not enter the Nix store. The appview reads the Jetstream credential file directly, without an environment variable that contains the key. Outside NixOS, set JETSTREAM_API_KEY_FILE to a readable file path. This file takes precedence over JETSTREAM_API_KEY. An unreadable or empty file stops startup when replay is enabled.

dataDirectory defaults to /var/lib/<stateDirectory>. The default directory uses DynamicUser and systemd state management. A custom directory uses the persistent provenance-appview or provenance-ui user. Tmpfiles creates the custom directory with mode 0700. The service waits for its mount.

The module does not move an existing database. Before you change the directory, stop the service. Move the database and its SQLite companion files to the new directory. Set their owner to the service user and their mode to 0600. Then start the service.

Keep the appview and UI data directories separate. Configure HTTPS, backups, and secret declarations separately.