From e8d15b35dc3facc524f2bb2e994f746b7a3fa0b6 Mon Sep 17 00:00:00 2001
From: dish <pyrox@pyrox.dev>
Date: Sat, 21 Feb 2026 14:42:28 -0500
Subject: [PATCH] [marvin.grafana] add secret-key secret and make new
 generation method for secrets

---
 hosts/marvin/services/grafana.nix             | 41 +++++++++++--------
 .../services/secrets/grafana/secret-key.age   | 21 ++++++++++
 hosts/marvin/services/secrets/secrets.nix     |  1 +
 3 files changed, 45 insertions(+), 18 deletions(-)
 create mode 100644 hosts/marvin/services/secrets/grafana/secret-key.age

diff --git a/hosts/marvin/services/grafana.nix b/hosts/marvin/services/grafana.nix
index b7098ab7..e32cec0c 100644
--- a/hosts/marvin/services/grafana.nix
+++ b/hosts/marvin/services/grafana.nix
@@ -7,6 +7,21 @@
 let
   d = self.lib.data.services.grafana;
   p = self.lib.data.services.pocket-id;
+
+  grafanaSecret = name: {
+    owner = "grafana";
+    group = "grafana";
+    file = ./secrets/grafana/${name}.age;
+  };
+
+  mkGrafanaSecrets =
+    secrets:
+    builtins.listToAttrs (
+      map (sec: {
+        name = "grafana-${sec}";
+        value = grafanaSecret sec;
+      }) secrets
+    );
 in
 {
   services.grafana = {
@@ -30,7 +45,8 @@ in
       };
       security = {
         admin_user = "pyrox";
-        admin_password = "$__file{${config.age.secrets.grafana-admin.path}}";
+        admin_password = "$__file{${config.age.secrets.grafana-admin-password.path}}";
+        secret_key = "$__file{${config.age.secrets.grafana-secret-key.path}}";
       };
       server = {
         root_url = "https://${d.extUrl}";
@@ -47,23 +63,12 @@ in
       };
     };
   };
-  age.secrets = {
-    grafana-admin = {
-      file = ./secrets/grafana/admin-password.age;
-      owner = "grafana";
-      group = "grafana";
-    };
-    grafana-smtp-password = {
-      file = ./secrets/grafana/smtp-password.age;
-      owner = "grafana";
-      group = "grafana";
-    };
-    grafana-oidc-secret = {
-      file = ./secrets/grafana/oidc-secret.age;
-      owner = "grafana";
-      group = "grafana";
-    };
-  };
+  age.secrets = mkGrafanaSecrets [
+    "admin-password"
+    "smtp-password"
+    "oidc-secret"
+    "secret-key"
+  ];
   services.anubis.instances.grafana = {
     settings = {
       BIND = ":${toString d.anubis}";
diff --git a/hosts/marvin/services/secrets/grafana/secret-key.age b/hosts/marvin/services/secrets/grafana/secret-key.age
new file mode 100644
index 00000000..3f08fb6e
--- /dev/null
+++ b/hosts/marvin/services/secrets/grafana/secret-key.age
@@ -0,0 +1,21 @@
+age-encryption.org/v1
+-> ssh-ed25519 iqBxIA vgDEngwzctG2YRa5PF2lmW+1G7FGDzEz5kMJ1tw9Qxw
+H+MLQpbDRv/LcUvMlUb4BnV9kR0Y9G9/9vmPBXtRfAc
+-> ssh-rsa fFaiTA
+qy9ko5llnHE3EA26CfHuGYn4kuTsz7cOOXRkH733gVEIfapBqD01hlLs0TrQ8MMJ
+B/j7DPjvJb3q1qSHudDolR+xqyN09UP+SISwgxxVNvcPPLBlMzpYuXdiNHSLh3NJ
+FSWf7A8klPPTvnxKIUzOFE4Bmz6NpKIOKCoS9Bp4hhtS4JbUt0cBAoDCm4RU/YkE
+YU7s8ldJM5hM8vRuoFOUdEJuRJnjbe03sN3FIfO7qxs3nk6d6ucUKCDE31HhEfpk
+I3gVAtrK2DHwW3+tvyBkKQNftfdXCFdg+a42gqQKoNqpbtupYdC7HscDXaPq3VTP
+9FZBrktGWaytuQo/T9qxhr+Nnms1bKy+AZ59X2GoOX2L3KtsxKG7fG1j63xVaEv/
+GBAfdMU44SRB8f+LRETd1RiPo2UjsxUsTHbrHeQq+n2JfCdR0gpxT72ybD5d0ONo
+ywMPdeRVXwOHJAat/k6jTEfolxSIhMcJ6mcSt6cmFgZH/a/OQwThWZr9N3tkhds4
+vx8C1nKK1MBiJf4VhEFDgpTOVSILsK/pbLTqEYdDsnHYfT4J7vq2P8cPF2Fy6yth
+QCResLpC0XiRd3Tp/Fv4k/zjNPJ5BJKy8kXCIcp0eDInZeLB8iPU5c1AqpZnCEf+
+l/U1CAFY+6deBTraF/iF8NA3N0Zd4ru/8tfoa2+bejA
+-> ssh-ed25519 wpmdHA AnfuD1L6PhKjIELsaJ9xxqJ5f/qOTETUIxOmukcGLls
+kwVjpYNnk40BHIsQNcYR96ny0IFCx7qGFomnAr3Z1kk
+--- Z5811GzYT7IZpeyN7fAN3gaEdhfWyrYbHLYLZyGKBPg
+��L|�M�FEx�yx��˞�9�
+eY�v9������|����%�m/:�(�=@\����OK*
�5�G/�7
+��}�4�.�~�_�'�=��~
\ No newline at end of file
diff --git a/hosts/marvin/services/secrets/secrets.nix b/hosts/marvin/services/secrets/secrets.nix
index 9b5a5e8d..0be2c42e 100644
--- a/hosts/marvin/services/secrets/secrets.nix
+++ b/hosts/marvin/services/secrets/secrets.nix
@@ -29,6 +29,7 @@ in
   "grafana/admin-password.age".publicKeys = marvinDefault;
   "grafana/oidc-secret.age".publicKeys = marvinDefault;
   "grafana/smtp-password.age".publicKeys = marvinDefault;
+  "grafana/secret-key.age".publicKeys = marvinDefault;
   "immich/oauth-secret.age".publicKeys = marvinDefault;
   "immich/mail-pw.age".publicKeys = marvinDefault;
   "jellyfin-exporter-config.age".publicKeys = marvinDefault;
-- 
2.51.2