added lndconnet

modules/credentials-pdf.nix

@@ -68,7 +68,7 @@ in
         echo "║                                                      ║"
         echo "║  'passwd free' only updates /etc/shadow.             ║"
         echo "║  The Hub and Magic Keys PDF will NOT be updated.     ║"
-        echo "╚════════════════════════════════════════<EFBFBD><EFBFBD>═════════════╝"
+        echo "╚════════════════════════════<EFBFBD><EFBFBD>═════════════════════════╝"
         echo ""
         return 1
       end
@@ -116,6 +116,47 @@ in
     '';
   };
 
+  # ── 1c. Save Zeus/lndconnect URL for hub credentials ────────
+  systemd.services.zeus-connect-setup = {
+    description = "Save Zeus lndconnect URL";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "lnd.service" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    path = [ pkgs.coreutils "/run/current-system/sw" ];
+    script = ''
+      SECRET_FILE="/var/lib/secrets/zeus-connect-url"
+      mkdir -p /var/lib/secrets
+
+      URL=""
+      if command -v lndconnect >/dev/null 2>&1; then
+        URL=$(lndconnect --url 2>/dev/null || true)
+      elif command -v lnconnect-clnrest >/dev/null 2>&1; then
+        URL=$(lnconnect-clnrest --url 2>/dev/null || true)
+      fi
+
+      if [ -n "$URL" ]; then
+        echo "$URL" > "$SECRET_FILE"
+        chmod 600 "$SECRET_FILE"
+        echo "Zeus connect URL saved."
+      else
+        echo "No lndconnect URL available yet."
+      fi
+    '';
+  };
+
+  # ── Refresh Zeus URL periodically (certs/macaroons may rotate)
+  systemd.timers.zeus-connect-setup = {
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnBootSec = "2min";
+      OnUnitActiveSec = "30min";
+      Unit = "zeus-connect-setup.service";
+    };
+  };
+
   # ── 2. Timer: Check every 5 minutes ────────────────────────
   systemd.timers.generate-credentials-pdf = {
     description = "Periodically check if Magic Keys PDF needs regenerating";
@@ -172,7 +213,8 @@ in
         /var/lib/secrets/wordpress-admin \
         /var/lib/secrets/vaultwarden/vaultwarden.env \
         /var/lib/domains/vaultwarden \
-        /var/lib/domains/btcpayserver; do
+        /var/lib/domains/btcpayserver \
+        /var/lib/secrets/zeus-connect-url; do
         if [ -f "$f" ]; then
           SECRET_SOURCES="$SECRET_SOURCES$(cat "$f")"
         fi