From 1a4643b779d01fcdbf7963bc3f9b7d2a83f5e228 Mon Sep 17 00:00:00 2001 From: Ryan Mulligan Date: Tue, 8 Mar 2022 07:58:08 -0800 Subject: [PATCH] feature: warn about missing files rage itself does not have good error messages when files are missing, so add some of our own checks and warnings. --- modules/age.nix | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/modules/age.nix b/modules/age.nix index 4e9e55a..ad4e392 100644 --- a/modules/age.nix +++ b/modules/age.nix @@ -27,6 +27,8 @@ let [ "${secretType.path}" != "${cfg.secretsDir}/${secretType.name}" ] && mkdir -p "$(dirname "${secretType.path}")" ( umask u=r,g=,o= + test -f "${secretType.file}" || echo '[agenix] WARNING: encrypted file ${secretType.file} does not exist!' + test -d "$(dirname "$TMP_FILE")" || echo "[agenix] WARNING: $(dirname "$TMP_FILE") does not exist!" LANG=${config.i18n.defaultLocale} ${ageBin} --decrypt ${identities} -o "$TMP_FILE" "${secretType.file}" ) chmod ${secretType.mode} "$TMP_FILE" @@ -38,11 +40,15 @@ let ''} ''; + testIdentities = map (path: '' + test -f ${path} || echo '[agenix] WARNING: config.age.identityPaths entry ${path} not present!' + '') cfg.identityPaths; + isRootSecret = st: (st.owner == "root" || st.owner == "0") && (st.group == "root" || st.group == "0"); isNotRootSecret = st: !(isRootSecret st); rootOwnedSecrets = builtins.filter isRootSecret (builtins.attrValues cfg.secrets); - installRootOwnedSecrets = builtins.concatStringsSep "\n" ([ "echo '[agenix] decrypting root secrets...'" ] ++ (map installSecret rootOwnedSecrets)); + installRootOwnedSecrets = builtins.concatStringsSep "\n" ([ "echo '[agenix] decrypting root secrets...'" ] ++ testIdentities ++ (map installSecret rootOwnedSecrets)); nonRootSecrets = builtins.filter isNotRootSecret (builtins.attrValues cfg.secrets); installNonRootSecrets = builtins.concatStringsSep "\n" ([ "echo '[agenix] decrypting non-root secrets...'" ] ++ (map installSecret nonRootSecrets));