From b322b1156b712a2271076c6381e938d2551f560c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Torjus=20H=C3=A5kestad?= <torjus@usit.uio.no>
Date: Thu, 5 Feb 2026 21:56:26 +0100
Subject: [PATCH] monitoring: fix openbao token output path

The outputDir with extractKey should be the full file path, not just
the parent directory.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 services/monitoring/prometheus.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/monitoring/prometheus.nix b/services/monitoring/prometheus.nix
index 378a5b0..56d44c6 100644
--- a/services/monitoring/prometheus.nix
+++ b/services/monitoring/prometheus.nix
@@ -11,7 +11,7 @@ in
   vault.secrets.openbao-token = {
     secretPath = "hosts/monitoring01/openbao-token";
     extractKey = "token";
-    outputDir = "/run/secrets/prometheus";
+    outputDir = "/run/secrets/prometheus/openbao-token";
     mode = "0400";
     owner = "prometheus";
     services = [ "prometheus" ];