From 516e0d27fe1343af7a122fe45457d714052ac6f4 Mon Sep 17 00:00:00 2001
From: Gregor Kleen <gkleen@yggdrasil.li>
Date: Wed, 29 Jul 2026 08:39:50 +0200
Subject: ...

---
 hosts/vidhar/network/dhcp/default.nix | 31 +++++++++----------------------
 1 file changed, 9 insertions(+), 22 deletions(-)

(limited to 'hosts/vidhar/network/dhcp/default.nix')

diff --git a/hosts/vidhar/network/dhcp/default.nix b/hosts/vidhar/network/dhcp/default.nix
index 557794e0..e4c3f16e 100644
--- a/hosts/vidhar/network/dhcp/default.nix
+++ b/hosts/vidhar/network/dhcp/default.nix
@@ -256,40 +256,27 @@ in {
               }
             ];
           };
+          tsig-keys = [
+            { name = "local_key";
+              algorithm = "HMAC-SHA256";
+              secret-file = "/run/credentials/kea-dhcp-ddns-server.service/local_key";
+            }
+          ];
         };
       };
     };
 
     systemd.services.kea-dhcp-ddns-server = {
-      preStart = let
-        configLines = [
-          "<?include \"\${CREDENTIALS_DIRECTORY}/knot-tsig.json.frag\"?>"
-        ] ++ mapAttrsToList (k: v:
-          "\"${k}\": ${builtins.toJSON v}"
-        ) config.services.kea.dhcp-ddns.settings;
-
-        config-template = pkgs.writeText "dhcp-ddns.conf" ''
-          {"DhcpDdns": {
-            ${concatStringsSep ",\n  " configLines}
-          }}
-        '';
-      in ''
-        ${pkgs.envsubst}/bin/envsubst -i "${config-template}" -o "''${RUNTIME_DIRECTORY}/dhcp-ddns.conf"
-      '';
-
       serviceConfig = {
-        ExecStart = mkForce ''
-          ${pkgs.kea}/bin/kea-dhcp-ddns -c "''${RUNTIME_DIRECTORY}/dhcp-ddns.conf" ${escapeShellArgs config.services.kea.dhcp-ddns.extraArgs}
-        '';
         LoadCredential = [
-          "knot-tsig.json.frag:${config.sops.secrets."kea-knot-tsig.json.frag".path}"
+          "local_key:${config.sops.secrets."kea-knot-tsig".path}"
         ];
       };
     };
 
-    sops.secrets."kea-knot-tsig.json.frag" = {
+    sops.secrets."kea-knot-tsig" = {
       format = "binary";
-      sopsFile = ./knot-tsig.json.frag;
+      sopsFile = ./knot-tsig;
     };
 
     services.nginx.virtualHosts."nfsroot.vidhar.yggdrasil" = {
-- 
cgit v1.2.3