Spacebar secret paths

2 files changed, 43 insertions, 0 deletions

diff --git a/host/Rory-ovh/services/containers/spacebar/container.nix b/host/Rory-ovh/services/containers/spacebar/container.nix

index 2abd2be..3189236 100644
--- a/host/Rory-ovh/services/containers/spacebar/container.nix
+++ b/host/Rory-ovh/services/containers/spacebar/container.nix
@@ -26,4 +26,10 @@
     mountPoint = "/storage";
     isReadOnly = false;
   };
+
+  bindMounts."spacebar-secrets" = {
+    hostPath = "/data/secrets/spacebar";
+    mountPoint = "/run/secrets/spacebar";
+    isReadOnly = true;
+  };
 }
diff --git a/host/Rory-ovh/services/containers/spacebar/services/spacebar.nix b/host/Rory-ovh/services/containers/spacebar/services/spacebar.nix

index 833a35e..7f75e1e 100644
--- a/host/Rory-ovh/services/containers/spacebar/services/spacebar.nix
+++ b/host/Rory-ovh/services/containers/spacebar/services/spacebar.nix
@@ -12,11 +12,48 @@ in
     gatewayEndpoint = sb.mkEndpoint "gateway.rory.server.spacebar.chat" 3002 true;
     cdnEndpoint = sb.mkEndpoint "cdn.rory.server.spacebar.chat" 3003 true;
     cdnPath = "/storage";
+
+    cdnSignaturePath = "/run/secrets/spacebar/cdnSignature";
+    legacyJwtSecretPath = "/run/secrets/spacebar/legacyJwtSecret";
+    mailjetApiKeyPath = "/run/secrets/spacebar/mailjetApiKey";
+    mailjetApiSecretPath = "/run/secrets/spacebar/mailjetApiSecret";
+    # smtpPasswordPath = "/run/secrets/spacebar/smtpPassword";
+    gifApiKeyPath = "/run/secrets/spacebar/gifApiKey";
+    rabbitmqHostPath = "/run/secrets/spacebar/rabbitmqHost";
+    abuseIpDbApiKeyPath = "/run/secrets/spacebar/abuseIpDbApiKey";
+    captchaSecretKeyPath = "/run/secrets/spacebar/captchaSecretKey";
+    captchaSiteKeyPath = "/run/secrets/spacebar/captchaSiteKey";
+    ipdataApiKeyPath = "/run/secrets/spacebar/ipdataApiKey";
+    requestSignaturePath = "/run/secrets/spacebar/requestSignature";
+
     settings = {
       security = {
         forwardedFor = "X-Forwarded-For";
         trustedProxies = "192.168.100.1, linklocal";
       };
+      user = {
+        blockedContains = [
+          "discord"
+          "clyde"
+          "mail.ru"
+          "penis"
+          "child"
+          "admin"
+          "owner"
+          "moderator"
+          "Noruya"
+          "𝖞𝖔𝖗𝖚𝖟𝖆"
+          "spacebar"
+          "1488"
+          "hitler"
+          "nigger"
+          "nitro"
+          "monero"
+          "gmail.com"
+          "outlook.com"
+          "steam"
+        ];
+      };
     };
     extraEnvironment = {
       DATABASE = "postgres://spacebar:spacebar@192.168.100.1/spacebar";