2 files changed, 16 insertions, 33 deletions

diff --git a/hosts/vidhar/network/dhcp/default.nix b/hosts/vidhar/network/dhcp/default.nix
index 557794e0..e4c3f16e 100644
--- a/hosts/vidhar/network/dhcp/default.nix
+++ b/hosts/vidhar/network/dhcp/default.nix
@@ -256,40 +256,27 @@ in {
               }
             ];
           };
+          tsig-keys = [
+            { name = "local_key";
+              algorithm = "HMAC-SHA256";
+              secret-file = "/run/credentials/kea-dhcp-ddns-server.service/local_key";
+            }
+          ];
         };
       };
     };
 
     systemd.services.kea-dhcp-ddns-server = {
-      preStart = let
-        configLines = [
-          "<?include \"\${CREDENTIALS_DIRECTORY}/knot-tsig.json.frag\"?>"
-        ] ++ mapAttrsToList (k: v:
-          "\"${k}\": ${builtins.toJSON v}"
-        ) config.services.kea.dhcp-ddns.settings;
-
-        config-template = pkgs.writeText "dhcp-ddns.conf" ''
-          {"DhcpDdns": {
-            ${concatStringsSep ",\n  " configLines}
-          }}
-        '';
-      in ''
-        ${pkgs.envsubst}/bin/envsubst -i "${config-template}" -o "''${RUNTIME_DIRECTORY}/dhcp-ddns.conf"
-      '';
-
       serviceConfig = {
-        ExecStart = mkForce ''
-          ${pkgs.kea}/bin/kea-dhcp-ddns -c "''${RUNTIME_DIRECTORY}/dhcp-ddns.conf" ${escapeShellArgs config.services.kea.dhcp-ddns.extraArgs}
-        '';
         LoadCredential = [
-          "knot-tsig.json.frag:${config.sops.secrets."kea-knot-tsig.json.frag".path}"
+          "local_key:${config.sops.secrets."kea-knot-tsig".path}"
         ];
       };
     };
 
-    sops.secrets."kea-knot-tsig.json.frag" = {
+    sops.secrets."kea-knot-tsig" = {
       format = "binary";
-      sopsFile = ./knot-tsig.json.frag;
+      sopsFile = ./knot-tsig;
     };
 
     services.nginx.virtualHosts."nfsroot.vidhar.yggdrasil" = {
diff --git a/hosts/vidhar/network/dhcp/knot-tsig.json.frag b/hosts/vidhar/network/dhcp/knot-tsig
index c10115cf..73a8f11d 100644
--- a/hosts/vidhar/network/dhcp/knot-tsig.json.frag
+++ b/hosts/vidhar/network/dhcp/knot-tsig
@@ -1,18 +1,14 @@
 {
-        "data": "ENC[AES256_GCM,data:cGcoqYZ341xQOFukDm4J5KDfG6+NaNbk2U2k4YGneRsAoPJZe/8KDmVr8TBWFCXXbuzeCGbiuXRVBmtYSEIqbqTN4u00RdQgpeL72cB3ZFd2c7cideEQV5z802pqFfXSlmLBC01OPG3TwAgk6xhQYSn5IcBTIL6fRF235Y9Q8k/X96rhfwPRVq84,iv:UoweWBcVuQIXeWFFl/WNUHLXG8nEri1UuTskC2I26hU=,tag:TJldVr2LDTmKA3ozZoX+cQ==,type:str]",
+        "data": "ENC[AES256_GCM,data:ZjPqKfUCRYD4iD7yC7qObZhBAMll0DXNzImZ43TM0D8SXRtANqG6YnfwQuJ7,iv:GXD5LutgEz6ktGEtpI9z41IJLLzIMj6OvPADQlZcvwk=,tag:v9ISQFDubtLWcb2mVHa4zA==,type:str]",
         "sops": {
-                "kms": null,
-                "gcp_kms": null,
-                "azure_kv": null,
-                "hc_vault": null,
                 "age": [
                         {
-                                "recipient": "age1qffdqvy9arld9zd5a5cylt0n98xhcns5shxhrhwjq5g4qa844ejselaa4l",
-                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCYk5tM1lPRXc0MGpHZENQ\ndDU2M2VKY2t2VGFrcTUvd0NrU3VMZGQ3NHlNClNTaWVjdDNTQXh6WDFmMDk3SWtn\ncjJjRzUxODFFL25Ic0dabyt1ZW5xRE0KLS0tIDJlT0NTVDlXNWphQ1B0VTQ1U0NH\nNktRNlIrQzdhRjZ0SjR0T3oyRkZiWXMKX28S4SySQguT1cgMZpDY4o/OKY6IvjT9\n1oUzwx/BzBbC2JbpGYvQQgp/qfiM2k0oXmQlfdTv8kD/MoOqPO8E1Q==\n-----END AGE ENCRYPTED FILE-----\n"
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCYk5tM1lPRXc0MGpHZENQ\ndDU2M2VKY2t2VGFrcTUvd0NrU3VMZGQ3NHlNClNTaWVjdDNTQXh6WDFmMDk3SWtn\ncjJjRzUxODFFL25Ic0dabyt1ZW5xRE0KLS0tIDJlT0NTVDlXNWphQ1B0VTQ1U0NH\nNktRNlIrQzdhRjZ0SjR0T3oyRkZiWXMKX28S4SySQguT1cgMZpDY4o/OKY6IvjT9\n1oUzwx/BzBbC2JbpGYvQQgp/qfiM2k0oXmQlfdTv8kD/MoOqPO8E1Q==\n-----END AGE ENCRYPTED FILE-----\n",
+                                "recipient": "age1qffdqvy9arld9zd5a5cylt0n98xhcns5shxhrhwjq5g4qa844ejselaa4l"
                         }
                 ],
-                "lastmodified": "2022-03-15T13:52:17Z",
-                "mac": "ENC[AES256_GCM,data:rTelaGx5S2E2oYPNGfctFbgDKdyRX8tpVTqLtpcCAJ8MS5ppFTjnSwYi4yQHvTicfAPNz7hGJYAnTdyC2QDTciJgkS6KC3CCXWCimkTybBdVW4Azwz9iBZCpWu+rB1vcQhSLlLCaKmKskkqDZZ5+mfuaXc+TT2uwTA0SDtZWvnM=,iv:ANCZ1fHy6w/svEE53o7rWsp5qU15qoriqyVMzClH6J0=,tag:H92RM5GuLIl9/kslq4tzkQ==,type:str]",
+                "lastmodified": "2026-07-29T06:39:18Z",
+                "mac": "ENC[AES256_GCM,data:hj/YR0N8NhGHQEcCOjt/r+rfM8plkaUZoee9sI25evvEvOlfX69YRxUv1vyd6Sqd9wPEgCsF5STnMXFQhq3zgGjoTFcdHU+olRVmRq9rkYQo/ButZ/NEIQ7uc5b4FRPdPwOGF14aSpgI67F35oRavv1vtk10zGme+X0I1VXTIqE=,iv:rMUL+CyTLhQBJrsQJQPhN75FjCf5uGFh1z6KAXKDeB8=,tag:bpeQZ3UPZ10tCrgveoDklg==,type:str]",
                 "pgp": [
                         {
                                 "created_at": "2023-01-30T11:00:34Z",
@@ -21,6 +17,6 @@
                         }
                 ],
                 "unencrypted_suffix": "_unencrypted",
-                "version": "3.7.1"
+                "version": "3.13.2"
         }
-}
\ No newline at end of file
+}