nixos/prometheus-exporters/fastly: fix secret handling

The exporter expects the token as an environment variable, not a path to the file containing the token.
NixOS · Jan 4, 2025 · 62f35da · 62f35da
1 parent b25a2b5
commit 62f35da
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 6 deletions.
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/fastly.nix b/nixos/modules/services/monitoring/prometheus/exporters/fastly.nix
@@ -31,18 +31,17 @@ in
       '';
     };
 
-    tokenPath = mkOption {
+    environmentFile = mkOption {
       type = path;
       description = ''
-        A run-time path to the token file, which is supposed to be provisioned
-        outside of Nix store.
+        An environment file containg at least the FASTLY_API_TOKEN= environment
+        variable.
       '';
     };
   };
   serviceOpts = {
     serviceConfig = {
-      LoadCredential = "fastly-api-token:${cfg.tokenPath}";
-      Environment = [ "FASTLY_API_TOKEN=%d/fastly-api-token" ];
+      EnvironmentFile = cfg.environmentFile;
       ExecStart = escapeSystemdExecArgs (
         [
           (getExe pkgs.prometheus-fastly-exporter)

diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix
@@ -399,7 +399,7 @@ let
     fastly = {
       exporterConfig = {
         enable = true;
-        tokenPath = pkgs.writeText "token" "abc123";
+        environmentFile = pkgs.writeText "fastly-exporter-env" "FASTLY_API_TOKEN=abc123";
       };
 
       exporterTest = ''