From e337063a95081a4235475207735adf8a9cab5836 Mon Sep 17 00:00:00 2001
From: beatzaplenty <wayne.bennett@live.com>
Date: Mon, 20 Jul 2026 02:57:55 +1000
Subject: [PATCH] Add parameterized beszel host-token helper module

hosts/server/host.nix and hosts/nix-cache/host.nix each hand-rolled the
same sops secret/template/environmentFile wiring for the beszel agent
token, differing only in the sops file path and template name. Factor
it into modules/beszel/host-token.nix ({ name, sopsFile }) so a third
host can adopt it without copy-pasting the boilerplate again. Also
drops two dead, stale commented-out HUB_URL lines left over from
before variables.nix grew a homeDomain var.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot
---
 hosts/nix-cache/host.nix      | 16 ++++++++--------
 hosts/server/host.nix         | 16 ++++++++--------
 modules/beszel/host-token.nix | 11 +++++++++++
 3 files changed, 27 insertions(+), 16 deletions(-)
 create mode 100644 modules/beszel/host-token.nix

diff --git a/hosts/nix-cache/host.nix b/hosts/nix-cache/host.nix
index 53188f2..44146eb 100644
--- a/hosts/nix-cache/host.nix
+++ b/hosts/nix-cache/host.nix
@@ -1,19 +1,19 @@
-{ config, vars, ... }:
+{ vars, ... }:
 
 {
-  networking.hostName = vars.nixCacheHost;
+  imports = [
+    (import ../../modules/beszel/host-token.nix {
+      name = "nix-cache";
+      sopsFile = ../../secrets/nix-cache.yaml;
+    })
+  ];
 
-  sops.secrets."beszel-token".sopsFile = ../../secrets/nix-cache.yaml;
-  sops.templates."nix-cache-beszel.env".content = ''
-    TOKEN=${config.sops.placeholder."beszel-token"}
-  '';
+  networking.hostName = vars.nixCacheHost;
 
   services.beszel.agent.environment = {
     #DOCKER_HOST = "tcp://docker-socket-proxy:2375";
-    #HUB_URL = "http://docker.sweet.home:8090";
     KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG";
   };
-  services.beszel.agent.environmentFile = config.sops.templates."nix-cache-beszel.env".path;
 
   # Preserved from the pre-refactor `nix-cache` target — stateVersion must
   # never be bumped on an already-installed machine.
diff --git a/hosts/server/host.nix b/hosts/server/host.nix
index e725cab..2e9089d 100644
--- a/hosts/server/host.nix
+++ b/hosts/server/host.nix
@@ -1,22 +1,22 @@
-{ config, vars, ... }:
+{ vars, ... }:
 
 {
+  imports = [
+    (import ../../modules/beszel/host-token.nix {
+      name = "server";
+      sopsFile = ../../secrets/server.yaml;
+    })
+  ];
+
   networking.hostName = vars.nfsServerHost;
   networking.hostId = "6689f93e";
 
-  sops.secrets."beszel-token".sopsFile = ../../secrets/server.yaml;
-  sops.templates."server-beszel.env".content = ''
-    TOKEN=${config.sops.placeholder."beszel-token"}
-  '';
-
   services.beszel.agent.environment = {
     #DOCKER_HOST = "tcp://docker-socket-proxy:2375";
-    #HUB_URL = "http://docker.sweet.home:8090";
     KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG";
     EXTRA_FILESYSTEMS = "${vars.storageRoot}/docker/volumes";
     LOG_LEVEL = "debug";
   };
-  services.beszel.agent.environmentFile = config.sops.templates."server-beszel.env".path;
 
   # Preserved from the pre-refactor `server` target — stateVersion must never
   # be bumped on an already-installed machine.
diff --git a/modules/beszel/host-token.nix b/modules/beszel/host-token.nix
new file mode 100644
index 0000000..5339b4b
--- /dev/null
+++ b/modules/beszel/host-token.nix
@@ -0,0 +1,11 @@
+{ name, sopsFile }:
+
+{ config, ... }:
+
+{
+  sops.secrets."beszel-token".sopsFile = sopsFile;
+  sops.templates."${name}-beszel.env".content = ''
+    TOKEN=${config.sops.placeholder."beszel-token"}
+  '';
+  services.beszel.agent.environmentFile = config.sops.templates."${name}-beszel.env".path;
+}