prometheus

systems/x86_64-linux/jallen-nas/sops.nix

@@ -135,10 +135,13 @@ in
       };
       "jallen-nas/nextcloud/adminpassword" = {
         sopsFile = defaultSops;
-        mode = "0650";
+        mode = "0440";
         owner = config.users.users."${user}".name;
-        group = config.users.users."${user}".group;
-        restartUnits = [ "nextcloud.service" ];
+        group = "keys";
+        restartUnits = [
+          "nextcloud.service"
+          "prometheus-nextcloud-exporter.service"
+        ];
       };
       "jallen-nas/nextcloud/smtp_settings" = {
         sopsFile = defaultSops;

systems/x86_64-linux/jallen-nas/users.nix

@@ -43,6 +43,15 @@ in
         hashedPasswordFile = passwordFile;
       };
       root.shell = pkgs.zsh;
+
+      # Allow the Prometheus Nextcloud exporter to read its password secret.
+      prometheus-nextcloud-exporter = {
+        isSystemUser = true;
+        group = "prometheus-nextcloud-exporter";
+        extraGroups = [ "keys" ];
+      };
     };
+
+    groups.prometheus-nextcloud-exporter = { };
   };
 }