move all of the secrets onto transient (tmpfs) storage

morph/lib/make-issuer.nix

@@ -15,7 +15,7 @@
     secrets = {
       "ristretto-signing-key" = {
         source = ristrettoSigningKeyPath;
-        destination = "/var/secrets/ristretto.signing-key";
+        destination = "/run/keys/ristretto.signing-key";
         owner.user = "root";
         owner.group = "root";
         permissions = "0400";
@@ -23,7 +23,7 @@
       };
       "stripe-secret-key" = {
         source = stripeSecretKeyPath;
-        destination = "/var/secrets/stripe.secret-key";
+        destination = "/run/keys/stripe.secret-key";
         owner.user = "root";
         owner.group = "root";
         permissions = "0400";

morph/lib/make-storage.nix

@@ -19,7 +19,7 @@
     secrets = {
       "ristretto-signing-key" = {
         source = ristrettoSigningKeyPath;
-        destination = "/var/secrets/ristretto.signing-key";
+        destination = "/run/keys/ristretto.signing-key";
         owner.user = "root";
         owner.group = "root";
         permissions = "0400";

morph/lib/make-testing.nix

@@ -6,7 +6,7 @@
     secrets = {
       "ristretto-signing-key" = {
         source = ristrettoSigningKeyPath;
-        destination = "/var/secrets/ristretto.signing-key";
+        destination = "/run/keys/ristretto.signing-key";
         owner.user = "root";
         owner.group = "root";
         permissions = "0400";