flake.lock

@@ -288,11 +288,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1729665710,
-        "narHash": "sha256-AlcmCXJZPIlO5dmFzV3V2XF6x/OpNWUV8Y/FMPGd8Z4=",
+        "lastModified": 1729413321,
+        "narHash": "sha256-I4tuhRpZFa6Fu6dcH9Dlo5LlH17peT79vx1y1SpeKt0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2768c7d042a37de65bb1b5b3268fc987e534c49d",
+        "rev": "1997e4aa514312c1af7e2bda7fad1644e778ff26",
         "type": "github"
       },
       "original": {

hosts/hydra-1/nix-cache.nix

@@ -5,11 +5,19 @@
   services.harmonia = {
     enable = true;
     settings.bind = "[::1]:5005";
-    signKeyPaths = [
-      config.sops.secrets."sign-key-nix-cache.clerie.de".path
-      config.sops.secrets."sign-key-cache.nix.clerie.de".path
+  };
+
+  systemd.services.harmonia = {
+    environment = {
+      SIGN_KEY_PATHS = "%d/key1 %d/key2";
+    };
+    serviceConfig = {
+      LoadCredential = [
+        "key1:${config.sops.secrets."sign-key-nix-cache.clerie.de".path}"
+        "key2:${config.sops.secrets."sign-key-cache.nix.clerie.de".path}"
       ];
     };
+  };
 
   services.nginx.virtualHosts = {
     "nix-cache.clerie.de" = {