2626 vaultPrefix = "kv/servers/${config.networking.hostName}";
2727 vaultAddress = "https://vault.example.com:8200";
2828
29- # Define a secret called `mysecret `, with default options.
30- secrets.mysecret = {};
29+ # Define a secret called `myservice `, with default options.
30+ secrets.myservice = {};
3131 };
3232
3333 services.myservice = {
3434 enable = true;
35- environmentFile = "${vs.mysecret }/environment";
35+ environmentFile = "${vs.myservice }/environment";
3636 };
3737}
3838```
3939
40- In this example, we define a secret ` mysecret ` for a service called
40+ In this example, we define a secret ` myservice ` for a service called
4141` myservice ` . The AppRole used to log in will be ` myservice ` . In order to
4242log in using such an AppRole, it first needs to be created in Vault, and
4343credentials for it need to be generated, and placed in
@@ -49,9 +49,9 @@ script generators documented below significantly simplifies the process.
4949The secrets themselves will be fetched from Vault from two specific paths under
5050` vaultPrefix ` . In this example, it will query ` kv/servers/hostname/environment `
5151and ` kv/servers/hostname/secrets ` . Any keys defined in ` environment ` will be
52- dumped into ` /run/secrets/mysecret /environment ` in a format suitable for usage
52+ dumped into ` /run/secrets/myservice /environment ` in a format suitable for usage
5353with systemd ` EnvironmentFile ` . Any keys defined in ` secrets ` will be dumped
54- into individual files under ` /run/secrets/mysecret ` , named after the keys, and
54+ into individual files under ` /run/secrets/myservice ` , named after the keys, and
5555containing the corresponding value. The values of ` secrets ` may optionally be
5656flagged as ` base64 ` encoded, which is recommended if you need to store binary
5757data or multiline text, as Vault has a bad habit of mangling these.
0 commit comments