tadpole/test-vm: Update WHIB service

- Update `WHIB` input
- Update secrets to reflect changes in input

hosts/tadpole/modules/whib/default.nix

@@ -1,5 +1,4 @@
 {
-  pkgs,
   lib,
   config,
   ...
@@ -26,26 +25,20 @@ in
       enable = true;
 
       backend = {
-        signingKey = "$(${pkgs.coreutils}/bin/cat ${config.age.secrets.whib-signing-key.path})";
         domain = "api.whib.ppp.pm";
         useACMEHost = "api.whib.ppp.pm";
+
+        environmentFile = config.age.secrets.whib-backend-env-vars.path;
       };
 
       postgres = {
-        database = "whib";
-        host = "postgres";
-        port = "5432";
-        user = "whib";
-        password = "$(${pkgs.coreutils}/bin/cat ${config.age.secrets.whib-postgres-password.path})";
+        environmentFile = config.age.secrets.whib-postgres-env-vars.path;
 
         backup = {
           interval = "*-*-* 00:00:00 UTC";
 
+          environmentFile = config.age.secrets.whib-postgres-backup-env-vars.path;
           gpgPassphraseFile = config.age.secrets.whib-gpg-key.path;
-
-          backblazeBucket = "$(${pkgs.coreutils}/bin/cat ${config.age.secrets.whib-backblaze-bucket.path})";
-          backblazeKeyID = "$(${pkgs.coreutils}/bin/cat ${config.age.secrets.whib-backblaze-key-id.path})";
-          backblazeKey = "$(${pkgs.coreutils}/bin/cat ${config.age.secrets.whib-backblaze-key.path})";
         };
       };
 
@@ -53,19 +46,19 @@ in
         domain = "grafana.whib.ppp.pm";
         useACMEHost = "grafana.whib.ppp.pm";
 
-        password = "$(${pkgs.coreutils}/bin/cat ${config.age.secrets.whib-grafana-password.path})";
+        environmentFile = config.age.secrets.whib-grafana-env-vars.path;
       };
     };
 
     age.secrets = {
-      "whib-signing-key".file = ../../../../secrets/tadpole/whib-signing-key.age;
-      "whib-postgres-password".file = ../../../../secrets/tadpole/whib-postgres-password.age;
-      "whib-grafana-password".file = ../../../../secrets/tadpole/whib-grafana-password.age;
+      "whib-backend-env-vars".file = ../../../../secrets/tadpole/whib-backend-env-vars.age;
+      "whib-postgres-env-vars".file = ../../../../secrets/tadpole/whib-postgres-env-vars.age;
 
+      "whib-postgres-backup-env-vars".file =
+        ../../../../secrets/tadpole/whib-postgres-backup-env-vars.age;
       "whib-gpg-key".file = ../../../../secrets/tadpole/whib-gpg-key.age;
-      "whib-backblaze-bucket".file = ../../../../secrets/tadpole/whib-backblaze-bucket.age;
-      "whib-backblaze-key-id".file = ../../../../secrets/tadpole/whib-backblaze-key-id.age;
-      "whib-backblaze-key".file = ../../../../secrets/tadpole/whib-backblaze-key.age;
+
+      "whib-grafana-env-vars".file = ../../../../secrets/tadpole/whib-grafana-env-vars.age;
     };
   };
 }

hosts/test-vm/whib-backend.nix

@@ -1,4 +1,5 @@
 {
+  pkgs,
   lib,
   config,
   ...
@@ -14,34 +15,68 @@ in
   };
 
   config = lib.mkIf enabled {
-    services.whib-backend = {
-      enable = true;
+    services.whib-backend =
+      let
+        backendEnvVars = pkgs.writeText "backend-env-vars" ''
+          SIGNING_KEY=signingkey
+          POSTGRES_DB=whib
+          POSTGRES_USER=whib
+          POSTGRES_PASSWORD=pgpassword
+        '';
 
-      backend = {
-        signingKey = "super-secret-key";
-        domain = "whib-backend.local";
-      };
+        postgresEnvVars = pkgs.writeText "postgres-env-vars" ''
+          POSTGRES_DB=whib
+          POSTGRES_USER=whib
+          POSTGRES_PASSWORD=pgpassword
+        '';
 
-      postgres = {
-        password = "postgrespassword";
+        postgresBackupEnvVars = pkgs.writeText "postgres-backup-env-vars" ''
+          PGDATABASE=whib
+          PGUSER=whib
+          PGPASSWORD=pgpassword
+          B2_BUCKET=a
+          B2_APPLICATION_KEY_ID=b
+          B2_APPLICATION_KEY=c
+        '';
 
-        backup = {
-          interval = "*-*-* *:*:00 UTC"; # Every minute, for testing
+        gpgPassphraseFile = pkgs.writeText "gpg-passphrase" ''
+          foobar
+        '';
 
-          # Set these for test runs
-          gpgPassphraseFile = "";
+        grafanaEnvVars = pkgs.writeText "grafana-env-vars" ''
+          GF_SECURITY_ADMIN_PASSWORD=grafanapassword
+          GF_USERS_ALLOW_SIGN_UP=false
+        '';
 
-          backblazeBucket = "";
-          backblazeKeyID = "";
-          backblazeKey = "";
+      in
+      {
+        enable = true;
+
+        backend = {
+          domain = "whib-backend.local";
+
+          environmentFile = backendEnvVars;
+        };
+
+        postgres = {
+          environmentFile = postgresEnvVars;
+
+          backup = {
+            interval = "*-*-* *:*:00 UTC"; # Every minute, for testing
+
+            environmentFile = postgresBackupEnvVars;
+            gpgPassphraseFile = gpgPassphraseFile;
+
+          };
+        };
+
+        grafana = {
+          domain = "grafana.local";
+
+          environmentFile = grafanaEnvVars;
         };
       };
 
-      grafana = {
-        password = "granfanapassword";
-      };
-    };
-
     virtualisation.vmVariant = {
       virtualisation = {
         sharedDirectories = {