From 7351194feeece63f23fa6b9ebdbdcc1a77d7dfc9 Mon Sep 17 00:00:00 2001
From: Yuri Tatishchev <itatishch@gmail.com>
Date: Sun, 11 Oct 2026 11:32:58 -0700
Subject: [PATCH] router: services: add secret for grafana key

---
 modules/router/secrets/grafana-secret-key.age | 5 +++++
 modules/router/services.nix                   | 2 ++
 2 files changed, 7 insertions(+)
 create mode 100644 modules/router/secrets/grafana-secret-key.age

diff --git a/modules/router/secrets/grafana-secret-key.age b/modules/router/secrets/grafana-secret-key.age
new file mode 100644
index 0000000..b34711d
--- /dev/null
+++ b/modules/router/secrets/grafana-secret-key.age
@@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> ssh-ed25519 D2MY/A txjDSEsRr2CJtC9rDIiY9H8aX0us53vhnqJStt+XvlA
+vjmrx5ByEhbHE/hBEQq3gRqY8b5/mjHLs+He3D/27LM
+--- rp66vDf9qnM7f9S5YD/X/99YsufPWmvz+V8z8htB2Ow
+9‡Ài¨*¡-oš·}Ć(Š5[¬[ÕyKr)¾-­cùäóŽù¼R0?Ë8`Èô×{
\ No newline at end of file
diff --git a/modules/router/services.nix b/modules/router/services.nix
index 8cc4a30..f168d3e 100644
--- a/modules/router/services.nix
+++ b/modules/router/services.nix
@@ -29,10 +29,12 @@ in
   };
 
   # https://wiki.nixos.org/wiki/Grafana#Declarative_configuration
+  secrix.services.grafana.secrets.security-key.encrypted.file = ./secrets/grafana-secret-key.age;
   services.grafana = {
     enable = true;
     settings = {
       security.allow_embedding = true;
+      security.secret_key = "$__file{${config.secrix.services.grafana.secrets.security-key.decrypted.path}}";
       server = {
         http_port = 3001;
         domain = "grouter.${domain}";