mynix/agenix
1
0
Fork 0
mirror of https://github.com/ryantm/agenix.git synced 2024-11-22 09:40:47 +03:00
Code Issues Projects Releases Packages Wiki Activity

add flake

Browse source
This commit is contained in:
Ryan Mulligan 2020-09-02 20:49:24 -07:00
parent c77d82e784
commit 4c2fd23693
3 changed files with 30 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
default.nix Normal file
View file

@ -0,0 +1,6 @@
{ pkgs ? import <nixpkgs> {} }:
rec {
age-nix = pkgs.writeScriptBin "age-nix" ''
exit 0
'';
}

18
flake.nix Normal file
View file

@ -0,0 +1,18 @@
{
description = "Secret management with age";
outputs = { self, nixpkgs }: let
systems = [
"x86_64-linux"
"i686-linux"
"x86_64-darwin"
"aarch64-linux"
"armv6l-linux"
"armv7l-linux"
];
forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f system);
in {
nixosModules.age = import ./modules/age.nix;
# packages = forAllSystems (system: nixpkgs.legacyPackages.${system}.callPackage ./default.nix {});
# defaultPackage = forAllSystems (system: self.packages.${system}.age-nix); #
};
}

11
modules/age.nix
View file

@ -8,13 +8,14 @@ let
identities = builtins.concatStringsSep " " (map (path: "-i ${path}") cfg.sshKeyPaths); identities = builtins.concatStringsSep " " (map (path: "-i ${path}") cfg.sshKeyPaths);
installSecret = secretType: '' installSecret = secretType: ''
TMP_DIR=$(mktemp -d) TMP_FILE="${secretType.path}.tmp"
TMP_FILE="$TMP_DIR/file"
(umask 0400; ${pkgs.age}/bin/age --decrypt ${identities} -o "$TMP_FILE" "${secretType.file}") (umask 0400; ${pkgs.age}/bin/age --decrypt ${identities} -o "$TMP_FILE" "${secretType.file}")
install -o '${secretType.owner}' -g '${secretType.group}' -m '${secretType.mode}' "$TMP_FILE" '${secretType.path}' chmod ${secretType.mode} "$TMP_FILE"
rm -rf "$TMP_DIR" chown ${secretType.owner}:${secretType.group} "$TMP_FILE"
mv -f "$TMP_FILE" '${secretType.path}'
''; '';
installAllSecrets = builtins.concatStringsSep (map installSecret (builtins.attrValues cfg.secrets)); installAllSecrets = builtins.concatStringsSep "\n" (map installSecret (builtins.attrValues cfg.secrets));
secretType = types.submodule ({ config, ... }: { secretType = types.submodule ({ config, ... }: {
options = { options = {