Move Icecast password to secrets.liq, remove from tracked files

.gitignore

@@ -32,5 +32,6 @@ __pycache__/
 # Legacy/backup files
 *.bak
 
-# Secrets — Icecast password is in radio.liq and track_announce.liq
-# These are tracked but the password should be moved to env var eventually
+# Secrets
+secrets.liq
+ezstream.xml

ezstream.xml

@@ -1,71 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<ezstream>
-  <servers>
-    <server>
-      <name>default</name>
-      <protocol>HTTP</protocol>
-      <hostname>127.0.0.1</hostname>
-      <port>8910</port>
-      <user>source</user>
-      <password>REDACTED</password>
-      <tls>None</tls>
-      <reconnect_attempts>20</reconnect_attempts>
-    </server>
-  </servers>
-
-  <streams>
-    <stream>
-      <mountpoint>/stream</mountpoint>
-      <intake>default</intake>
-      <server>default</server>
-      <public>No</public>
-      <format>MP3</format>
-      <encoder>mp3</encoder>
-      <stream_name>Radio Susan</stream_name>
-      <stream_url>https://radio.jihakuz.xyz</stream_url>
-      <stream_genre>Eclectic</stream_genre>
-      <stream_description>Personal radio station</stream_description>
-      <stream_bitrate>192</stream_bitrate>
-      <stream_samplerate>44100</stream_samplerate>
-      <stream_channels>2</stream_channels>
-    </stream>
-  </streams>
-
-  <intakes>
-    <intake>
-      <name>default</name>
-      <type>playlist</type>
-      <filename>/var/lib/radio/playlists/all.m3u</filename>
-      <shuffle>Yes</shuffle>
-      <stream_once>No</stream_once>
-    </intake>
-  </intakes>
-
-  <metadata>
-    <format_str>@a@ - @t@</format_str>
-    <normalize_strings>Yes</normalize_strings>
-    <no_updates>No</no_updates>
-  </metadata>
-
-  <decoders>
-    <decoder>
-      <name>ffmpeg-all</name>
-      <program>/var/lib/radio/decode.sh @T@</program>
-      <file_ext>.flac</file_ext>
-      <file_ext>.mp3</file_ext>
-      <file_ext>.ogg</file_ext>
-      <file_ext>.m4a</file_ext>
-      <file_ext>.opus</file_ext>
-      <file_ext>.wav</file_ext>
-      <file_ext>.wma</file_ext>
-    </decoder>
-  </decoders>
-
-  <encoders>
-    <encoder>
-      <name>mp3</name>
-      <format>MP3</format>
-      <program>/var/lib/radio/encode.sh</program>
-    </encoder>
-  </encoders>
-</ezstream>

radio.liq

@@ -4,6 +4,8 @@
 # Tracks, announcements, and jingles are all baked into playlist.m3u
 # Liquidsoap just plays it sequentially.
 
+%include "secrets.liq"
+
 set("log.file.path", "/var/lib/radio/radio.log")
 set("log.level", 3)
 set("server.telnet", true)
@@ -61,7 +63,7 @@ output.icecast(
   %mp3(bitrate=192),
   host="localhost",
   port=8910,
-  password="REDACTED",
+  password=icecast_password,
   mount="/stream",
   name="Radio Susan",
   description="Personal radio station",

track_announce.liq

@@ -67,7 +67,7 @@ output.icecast(
   %mp3(bitrate=192),
   host="localhost",
   port=8910,
-  password="REDACTED",
+  password=icecast_password,
   mount="/stream",
   name="Radio Susan",
   description="Personal radio station",