From bc7d62b063d75f8b682c5cf6bd52f302a5291736 Mon Sep 17 00:00:00 2001
From: Ryan Yin <xiaoyin_c@qq.com>
Date: Mon, 21 Sep 2026 15:50:15 +0800
Subject: [PATCH] refactor(kubevirt-youko): resolve cert paths with
 relativeToRoot

The service modules moved two levels deeper, so their certs/ paths
resolved relative to the wrong directory. Use mylib.relativeToRoot so
they no longer depend on the module's depth.
---
 hosts/k8s/kubevirt-youko/homelab-services/caddy.nix          | 5 ++++-
 .../kubevirt-youko/homelab-services/grafana/datasources.nix  | 4 ++--
 hosts/k8s/kubevirt-youko/homelab-services/postgresql.nix     | 3 ++-
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/hosts/k8s/kubevirt-youko/homelab-services/caddy.nix b/hosts/k8s/kubevirt-youko/homelab-services/caddy.nix
index b00f8950..cab95e33 100644
--- a/hosts/k8s/kubevirt-youko/homelab-services/caddy.nix
+++ b/hosts/k8s/kubevirt-youko/homelab-services/caddy.nix
@@ -1,4 +1,5 @@
 {
+  mylib,
   pkgs,
   config,
   wallpapers,
@@ -7,7 +8,9 @@
 let
   hostCommonConfig = ''
     encode zstd gzip
-    tls ${../../certs/ecc-server.crt} ${config.age.secrets."caddy-ecc-server.key".path} {
+    tls ${mylib.relativeToRoot "certs/ecc-server.crt"} ${
+      config.age.secrets."caddy-ecc-server.key".path
+    } {
       protocols tls1.3 tls1.3
       curves x25519 secp384r1 secp521r1
     }
diff --git a/hosts/k8s/kubevirt-youko/homelab-services/grafana/datasources.nix b/hosts/k8s/kubevirt-youko/homelab-services/grafana/datasources.nix
index 0451baf7..626dc7c0 100644
--- a/hosts/k8s/kubevirt-youko/homelab-services/grafana/datasources.nix
+++ b/hosts/k8s/kubevirt-youko/homelab-services/grafana/datasources.nix
@@ -1,4 +1,4 @@
-{ config, ... }:
+{ config, mylib, ... }:
 {
 
   # Declaratively provision Grafana's data sources, dashboards, and alerting rules.
@@ -114,7 +114,7 @@
             postgresVersion = 1500; # 15.xx
             # tls
             tlsConfigurationMethod = "file-path";
-            sslRootCertFile = ../../../certs/ecc-ca.crt;
+            sslRootCertFile = mylib.relativeToRoot "certs/ecc-ca.crt";
           };
           editable = false;
         }
diff --git a/hosts/k8s/kubevirt-youko/homelab-services/postgresql.nix b/hosts/k8s/kubevirt-youko/homelab-services/postgresql.nix
index 400e6f9c..ac35aa28 100644
--- a/hosts/k8s/kubevirt-youko/homelab-services/postgresql.nix
+++ b/hosts/k8s/kubevirt-youko/homelab-services/postgresql.nix
@@ -1,5 +1,6 @@
 {
   config,
+  mylib,
   pkgs,
   lib,
   myvars,
@@ -69,7 +70,7 @@ in
 
       # ssl
       ssl = true;
-      ssl_cert_file = "${../../certs/ecc-server.crt}";
+      ssl_cert_file = "${mylib.relativeToRoot "certs/ecc-server.crt"}";
       ssl_key_file = config.age.secrets."postgres-ecc-server.key".path;
       ssl_min_protocol_version = "TLSv1.3";
       ssl_ecdh_curve = "secp384r1";