...

1 files changed, 5 insertions, 3 deletions

diff --git a/hosts/surtr/dns/default.nix b/hosts/surtr/dns/default.nix
index 808c56da..026111be 100644
--- a/hosts/surtr/dns/default.nix
+++ b/hosts/surtr/dns/default.nix
@@ -44,11 +44,14 @@ in {
         fsType = "zfs";
       };
 
-    systemd.services.knot.unitConfig.RequiresMountsFor = [ "/var/lib/knot" ];
+    systemd.services.knot = {
+      unitConfig.RequiresMountsFor = [ "/var/lib/knot" ];
+      serviceConfig.LoadCredential = map ({name, ...}: "${name}:config.sops.secrets.${name}.path") knotKeys;
+    };
     
     services.knot = {
       enable = true;
-      keyFiles = map ({name, ...}: config.sops.secrets.${name}.path) knotKeys;
+      keyFiles = map ({name, ...}: "/run/credentials/knot.service/${name}") knotKeys;
       extraConfig = ''
         server:
           listen: 127.0.0.1@53
@@ -192,7 +195,6 @@ in {
 
     sops.secrets = listToAttrs (map ({name, path}: nameValuePair name {
       format = "binary";
-      owner = "knot";
       sopsFile = path;
     }) knotKeys);