feat(nimbolus): init a http terraform backend

machines/nixos/compute01/nimbolus.nix

@@ -2,7 +2,12 @@
 #
 # SPDX-License-Identifier: EUPL-1.2
 
-{ pkgs, sources, ... }:
+{
+  pkgs,
+  sources,
+  config,
+  ...
+}:
 let
   host = "nimbolus.dgnum.eu";
   port = 9008;
@@ -23,10 +28,9 @@ in
       # AUTH_JWT_OIDC_ISSUER_URL = "https://vault.dgnum.eu/v1/identity/oidc";
     };
     secretEnvironment = {
-      # FIXME: use agenix and real secrets
-      KMS_KEY = pkgs.writeText "nimbolus-kms-unsecure" "nVbFN9o4rIP2qi0SWtcgNZlWolrF61/Drx3YxeQTSZk=";
-      STORAGE_S3_ACCESS_KEY = pkgs.writeText "unsecure" "KEYID";
-      STORAGE_S3_SECRET_KEY = pkgs.writeText "unsecure" "KEYSECRET";
+      KMS_KEY = config.age.secrets."nimbolus-kms_key".path;
+      STORAGE_S3_ACCESS_KEY = config.age.secrets."nimbolus-s3_access".path;
+      STORAGE_S3_SECRET_KEY = config.age.secrets."nimbolus-s3_secret".path;
     };
   };
   dgn-web.simpleProxies.nimbolus = {

machines/nixos/compute01/secrets/secrets.nix

@@ -25,6 +25,9 @@
     "netbox-environment_file"
     "nextcloud-adminpass_file"
     "nextcloud-s3_secret_file"
+    "nimbolus-kms_key"
+    "nimbolus-s3_access"
+    "nimbolus-s3_secret"
     "opengist-environment_file"
     "outline-oidc_client_secret_file"
     "outline-smtp_password_file"