From 93e19c74e9bcc453d38d11dc014a1baae9a09016 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Bourdeauducq?= <sb@m-labs.hk>
Date: Sun, 11 Aug 2024 12:09:30 +0800
Subject: [PATCH] nixbld/rt: use psql peer authentication

---
 nixbld-etc-nixos/configuration.nix | 11 +++++++++--
 nixbld-etc-nixos/rt.nix            | 18 ++----------------
 2 files changed, 11 insertions(+), 18 deletions(-)

diff --git a/nixbld-etc-nixos/configuration.nix b/nixbld-etc-nixos/configuration.nix
index fae992e..b89b262 100644
--- a/nixbld-etc-nixos/configuration.nix
+++ b/nixbld-etc-nixos/configuration.nix
@@ -816,12 +816,19 @@ in
     siteUrl = "https://chat.m-labs.hk/";
     mutableConfig = true;
   };
-  services.postgresql.package = pkgs.postgresql_12;
   services.matterbridge = {
     enable = true;
     configPath = "/etc/nixos/secret/matterbridge.toml";
   };
- 
+
+  services.postgresql = {
+    package = pkgs.postgresql_12;
+    identMap =
+      ''
+      rt rt rt_user
+      '';
+  };
+
   nixpkgs.config.packageOverrides = super: let self = super.pkgs; in {
     nix = super.nix.overrideAttrs(oa: {
       patches = oa.patches or [] ++ [ ./nix-networked-derivations.patch ];
diff --git a/nixbld-etc-nixos/rt.nix b/nixbld-etc-nixos/rt.nix
index 554406c..30b8e5a 100644
--- a/nixbld-etc-nixos/rt.nix
+++ b/nixbld-etc-nixos/rt.nix
@@ -19,14 +19,9 @@ let
       Set($Timezone, '${cfg.timeZone}');
 
       Set($DatabaseType, 'Pg');
-      Set($DatabaseHost, 'localhost');
-      Set($DatabaseUser, 'rt_user');
+      Set($DatabaseHost, '/run/postgresql');
+      Set($DatabaseUser, 'rt');
       Set($DatabaseName, 'rt5');
-      # Read database password from file
-      open my $fh, '<', '${cfg.dbPasswordFile}' or die 'Can\'t open file $!';
-      my $dbpw = do { local $/; <$fh> };
-      $dbpw =~ s/^\s+|\s+$//g;
-      Set($DatabasePassword, $dbpw);
 
       # System (Logging)
       Set($LogToSTDERR, undef); # Don't log twice
@@ -154,13 +149,6 @@ in {
       type = str;
     };
 
-    dbPasswordFile = mkOption {
-      description = "File containing the database password";
-      type = str;
-      default = "/etc/nixos/secret/rtpasswd";
-      internal = true;
-    };
-
     domain = mkOption {
       description = "Which domain RT is running on";
       type = str;
@@ -245,8 +233,6 @@ in {
 
           PrivateNetwork = false;
           MemoryDenyWriteExecute = false;
-
-          ReadOnlyPaths = [ cfg.dbPasswordFile ];
         };
 
         environment = {