Move password files to /run/keys

README.org

@@ -9,8 +9,9 @@
  - ZFS pool configuration: hardware-configuration.nix
  - Network configuration: networking.nix
  - Printing and scanner server: printing.nix
- - Nginx and PostgreSQL: webstack.nix
- - Radicale and Syncthing: datasync.nix
- - Gitea: devops.nix
+ - Synchronization and backup services: datasync.nix
+ - Web services and reverse proxy: webstack.nix
+ - Development tools: devops.nix
+ - Smartd: monitoring.nix
 
  All the modules are imported in *configuration.nix*

configuration.nix

@@ -103,12 +103,13 @@
 
   # Import other configuration modules
   imports = [
-    ./modules/printing.nix
-    ./modules/networking.nix
-    ./modules/datasync.nix
     ./modules/hardware-configuration.nix
+    ./modules/networking.nix
+    ./modules/printing.nix
+    ./modules/datasync.nix
     ./modules/webstack.nix
     ./modules/devops.nix
+    ./modules/monitoring.nix
   ];
 
 }

modules/datasync.nix

@@ -68,7 +68,7 @@
 
       [auth]
       type = htpasswd
-      htpasswd_filename = /var/lib/radicale/users
+      htpasswd_filename = /run/keys/radicale
       htpasswd_encryption = plain
       delay = 1
     '';

modules/monitoring.nix

@@ -0,0 +1,23 @@
+{ config, lib, pkgs, ... }:
+
+{
+  # Notify when a disk starts going haywire
+  services.smartd = {
+    enable = true;
+    notifications.mail = {
+      enable = true;
+      recipient = "akasroua@gmail.com";
+    };
+  };
+
+  # Enable trivial MTA for smartd notifications
+  services.ssmtp = {
+    enable = true;
+    useTLS = true;
+    useSTARTTLS = true;
+    domain = "gmail.com";
+    hostName = "smtp.gmail.com:587";
+    authUser = "akasroua@gmail.com";
+    authPassFile = "/run/keys/ssmtp";
+  };
+}

modules/networking.nix

@@ -1,6 +1,6 @@
 { config, pkgs, lib, ... }:
 
-let password = builtins.readFile /var/lib/ddclient/token;
+let password = builtins.readFile /run/keys/ddclient;
 
 in {