From 0bc634639c37698aa02884d721ef42a0213cf4a8 Mon Sep 17 00:00:00 2001
From: dish <pyrox@pyrox.dev>
Date: Wed, 8 Apr 2026 23:26:35 -0400
Subject: [PATCH] [marvin] move service secrets to mkServiceSecrets

---
 hosts/marvin/services/git.nix | 70 ++++++++++++++++++++---------------
 1 file changed, 41 insertions(+), 29 deletions(-)

diff --git a/hosts/marvin/services/git.nix b/hosts/marvin/services/git.nix
index 3457d098..3e450eee 100644
--- a/hosts/marvin/services/git.nix
+++ b/hosts/marvin/services/git.nix
@@ -125,35 +125,47 @@ in
       };
     };
   };
-  age.secrets = lib.mkIf config.services.forgejo.enable {
-    forgejo-db-pw = forgejoSecret // {
-      file = ./secrets/forgejo/db-pw.age;
-    };
-    forgejo-mail-pw = forgejoSecret // {
-      file = ./secrets/forgejo/mail-pw.age;
-    };
-    forgejo-aux-docs-runner-token = forgejoSecret // {
-      file = ./secrets/forgejo/aux-docs-runner-token.age;
-    };
-    forgejo-default-runner-token = forgejoSecret // {
-      file = ./secrets/forgejo/default-runner-token.age;
-    };
-    forgejo-gitgay-runner-token = forgejoSecret // {
-      file = ./secrets/forgejo/gitgay-runner-token.age;
-    };
-    forgejo-internal-token = forgejoSecret // {
-      file = ./secrets/forgejo/internal-token.age;
-    };
-    forgejo-oauth2-jwt-secret = forgejoSecret // {
-      file = ./secrets/forgejo/oauth2-jwt-secret.age;
-    };
-    forgejo-lfs-jwt-secret = forgejoSecret // {
-      file = ./secrets/forgejo/lfs-jwt-secret.age;
-    };
-    forgejo-secret-key = forgejoSecret // {
-      file = ./secrets/forgejo/secret-key.age;
-    };
-  };
+  age.secrets = self.lib.secrets.mkServiceSecrets "forgejo" true ./secrets [
+    "oidc-secret"
+    "db-pw"
+    "mail-pw"
+    "aux-docs-runner-token"
+    "default-runner-token"
+    "gitgay-runner-token"
+    "internal-token"
+    "oauth2-jwt-secret"
+    "lfs-jwt-secret"
+    "secret-key"
+  ];
+  # age.secrets = lib.mkIf config.services.forgejo.enable {
+  #   forgejo-db-pw = forgejoSecret // {
+  #     file = ./secrets/forgejo/db-pw.age;
+  #   };
+  #   forgejo-mail-pw = forgejoSecret // {
+  #     file = ./secrets/forgejo/mail-pw.age;
+  #   };
+  #   forgejo-aux-docs-runner-token = forgejoSecret // {
+  #     file = ./secrets/forgejo/aux-docs-runner-token.age;
+  #   };
+  #   forgejo-default-runner-token = forgejoSecret // {
+  #     file = ./secrets/forgejo/default-runner-token.age;
+  #   };
+  #   forgejo-gitgay-runner-token = forgejoSecret // {
+  #     file = ./secrets/forgejo/gitgay-runner-token.age;
+  #   };
+  #   forgejo-internal-token = forgejoSecret // {
+  #     file = ./secrets/forgejo/internal-token.age;
+  #   };
+  #   forgejo-oauth2-jwt-secret = forgejoSecret // {
+  #     file = ./secrets/forgejo/oauth2-jwt-secret.age;
+  #   };
+  #   forgejo-lfs-jwt-secret = forgejoSecret // {
+  #     file = ./secrets/forgejo/lfs-jwt-secret.age;
+  #   };
+  #   forgejo-secret-key = forgejoSecret // {
+  #     file = ./secrets/forgejo/secret-key.age;
+  #   };
+  # };
   services.anubis.instances.forgejo = lib.mkIf config.services.forgejo.enable {
     settings = {
       BIND = ":${toString d.anubis}";
-- 
2.51.2