From 943e5d2a15a801c46e1372949807d5e3611d7cd2 Mon Sep 17 00:00:00 2001
From: Igor Ramazanov <igor.ramazanov@magine.com>
Date: Tue, 20 May 2025 19:33:00 +0000
Subject: [PATCH] Remove inlined secrets options

Leaving only `_path` variants.
---
 nix/module.nix | 61 --------------------------------------------------
 1 file changed, 61 deletions(-)

diff --git a/nix/module.nix b/nix/module.nix
index b73f998..bcea2f6 100644
--- a/nix/module.nix
+++ b/nix/module.nix
@@ -61,17 +61,6 @@ in {
                   description = "The port to listen on.";
                 };
 
-                cookie_secret = lib.mkOption {
-                  type = lib.types.nullOr lib.types.str;
-                  default = null;
-                  description = ''
-                    The secret used to encode and decode web sessions.
-                    Ensure that this is exactly 32 characters long.
-                    Can be either a direct string or a path to a file containing the secret.
-                  '';
-                  example = "config.sops.secrets.headplane.path";
-                };
-
                 cookie_secret_path = lib.mkOption {
                   type = lib.types.nullOr lib.types.path;
                   default = null;
@@ -96,16 +85,6 @@ in {
                 agent = lib.mkOption {
                   type = lib.types.submodule {
                     options = {
-                      authkey = lib.mkOption {
-                        type = lib.types.nullOr lib.types.str;
-                        default = null;
-                        description = ''
-                          The auth key used to authenticate the agent with Headplane.
-                          Can be either a direct string or a path to a file containing the key.
-                        '';
-                        example = "config.sops.secrets.agent_authkey.path";
-                      };
-
                       authkey_path = lib.mkOption {
                         type = lib.types.nullOr lib.types.path;
                         default = null;
@@ -153,16 +132,6 @@ in {
                   example = "https://headscale.example.com";
                 };
 
-                tls_cert = lib.mkOption {
-                  type = lib.types.nullOr lib.types.str;
-                  default = null;
-                  description = ''
-                    TLS certificate for HTTPS connections.
-                    Can be either a direct string or a path to a file containing the certificate.
-                  '';
-                  example = "config.sops.secrets.tls_cert.path";
-                };
-
                 tls_cert_path = lib.mkOption {
                   type = lib.types.nullOr lib.types.path;
                   default = null;
@@ -173,16 +142,6 @@ in {
                   example = "config.sops.secrets.tls_cert.path";
                 };
 
-                tls_key = lib.mkOption {
-                  type = lib.types.nullOr lib.types.str;
-                  default = null;
-                  description = ''
-                    TLS private key for HTTPS connections.
-                    Can be either a direct string or a path to a file containing the key.
-                  '';
-                  example = "config.sops.secrets.tls_key.path";
-                };
-
                 tls_key_path = lib.mkOption {
                   type = lib.types.nullOr lib.types.path;
                   default = null;
@@ -264,15 +223,6 @@ in {
                   example = "your-client-id";
                 };
 
-                client_secret = lib.mkOption {
-                  type = lib.types.nullOr lib.types.str;
-                  default = null;
-                  description = ''
-                    The client secret for the OIDC client.
-                  '';
-                  example = "config.sops.secrets.oidc_secret.path";
-                };
-
                 client_secret_path = lib.mkOption {
                   type = lib.types.nullOr lib.types.path;
                   default = null;
@@ -298,17 +248,6 @@ in {
                   description = "The token endpoint authentication method.";
                 };
 
-                headscale_api_key = lib.mkOption {
-                  type = lib.types.nullOr lib.types.str;
-                  default = null;
-                  description = ''
-                    If you are using OIDC, you need to generate an API key
-                    that can be used to authenticate other sessions when signing in.
-                    This can be done with `headscale apikeys create --expiration 999d`.
-                  '';
-                  example = "config.sops.secrets.headscale_api_key.path";
-                };
-
                 headscale_api_key_path = lib.mkOption {
                   type = lib.types.nullOr lib.types.path;
                   default = null;