ansible-taler-exchange

commit 0248e868e3f05efbd10ede23afbc6aa0222105cd
parent ad3e519f37747ac7bb64ca3a8aecf5aa2baef1c1
Author: Florian Dold <florian@dold.me>
Date:   Wed,  8 Jul 2026 19:01:37 +0200

put taler wire gateway token in secret config file, make top-level one world-readable again

Diffstat:
M
roles/libeufin-nexus/tasks/main.yml
 | 
11
++++++++++-
M
roles/libeufin-nexus/templates/etc/libeufin/libeufin-nexus.conf.j2
 | 
11
++++++-----
A
roles/libeufin-nexus/templates/etc/libeufin/wire-gateway.secret.conf.j2
 | 
3
+++

3 files changed, 19 insertions(+), 6 deletions(-)
diff --git a/roles/libeufin-nexus/tasks/main.yml b/roles/libeufin-nexus/tasks/main.yml
@@ -102,7 +102,7 @@
     dest: "/etc/libeufin/libeufin-nexus.conf"
     owner: libeufin-nexus
     group: libeufin-nexus
-    mode: "0400"
+    mode: "0444"
 
 - name: Place libeufin-nexus EBICS config
   ansible.builtin.template:
@@ -113,6 +113,15 @@
     mode: "0400"
   when: use_ebics or configure_ebics
 
+- name: Place wire gateway secret config
+  ansible.builtin.template:
+    src: templates/etc/libeufin/wire-gateway.secret.conf.j2
+    dest: "/etc/libeufin/wire-gateway.secret.conf"
+    owner: libeufin-nexus
+    group: libeufin-nexus
+    mode: "0400"
+  when: use_ebics or configure_ebics
+
 - name: Setup libeufin database
   ansible.builtin.command:
     cmd: libeufin-dbconfig --only-nexus
diff --git a/roles/libeufin-nexus/templates/etc/libeufin/libeufin-nexus.conf.j2 b/roles/libeufin-nexus/templates/etc/libeufin/libeufin-nexus.conf.j2
@@ -48,14 +48,15 @@ BIND_TO = 127.0.0.1
 [nexus-postgres]
 CONFIG = postgres:///libeufin
 
-[nexus-httpd-wire-gateway-api]
-ENABLED = YES
-AUTH_METHOD = bearer
-TOKEN = {{ ansible_local['libeufin-nexus-access-token'] }}
-
 {% if exchange_qr_iban is defined and exchange_qr_iban %}
 [nexus-ebics]
 QR_IBAN = {{ exchange_qr_iban }}
 {% endif %}
 
+[nexus-httpd-wire-gateway-api]
+ENABLED = YES
+AUTH_METHOD = bearer
+# Actual token is in the secrets file!
+
+@inline-secret@ nexus-httpd-wire-gateway-api wire-gateway.secret.conf
 @inline-secret@ nexus-ebics libeufin-nexus-ebics.conf
diff --git a/roles/libeufin-nexus/templates/etc/libeufin/wire-gateway.secret.conf.j2 b/roles/libeufin-nexus/templates/etc/libeufin/wire-gateway.secret.conf.j2
@@ -0,0 +1,2 @@
+[nexus-httpd-wire-gateway-api]
+TOKEN = {{ ansible_local['libeufin-nexus-access-token'] }}
+\ No newline at end of file