# NixOS deployment

Import `provenance.nixosModules.default` into your NixOS configuration.
Use string paths for runtime data and Agenix secrets:

```nix
services.provenance.appview = {
  enable = true;
  dataDirectory = "/srv/provenance/appview";
  serviceKeyFile = config.age.secrets.provenance-service.path;
  jetstreamReplay = true;
  jetstreamAPIKeyFile = config.age.secrets.jetstream.path;
};

services.provenance.ui = {
  enable = true;
  dataDirectory = "/srv/provenance/ui";
  serviceKeyFile = config.age.secrets.provenance-service.path;
  encryptionKeyFile = config.age.secrets.provenance-encryption.path;
  publicOrigin = "https://provenance.example.com";
};
```

Systemd reads Agenix secrets through `LoadCredential`. Secret contents do not enter the Nix store.
The appview reads the Jetstream credential file directly, without an environment variable that contains the key.
Outside NixOS, set `JETSTREAM_API_KEY_FILE` to a readable file path.
This file takes precedence over `JETSTREAM_API_KEY`. An unreadable or empty file stops startup when replay is enabled.

`dataDirectory` defaults to `/var/lib/<stateDirectory>`.
The default directory uses `DynamicUser` and systemd state management.
A custom directory uses the persistent `provenance-appview` or `provenance-ui` user.
Tmpfiles creates the custom directory with mode `0700`. The service waits for its mount.

The module does not move an existing database.
Before you change the directory, stop the service.
Move the database and its SQLite companion files to the new directory.
Set their owner to the service user and their mode to `0600`.
Then start the service.

Keep the appview and UI data directories separate.
Configure HTTPS, backups, and secret declarations separately.