mynix/agenix
1
0
Fork 0
mirror of https://github.com/ryantm/agenix.git synced 2024-11-22 09:40:47 +03:00
Code Issues Projects Releases Packages Wiki Activity

modules/age: nixpkgs-fmt

Browse source
This commit is contained in:
Cole Helbling 2021-03-01 13:10:52 -08:00
parent ed7e69bff3
commit 9b8f6c01fe
No known key found for this signature in database
GPG key ID: B37E0F2371016A4C
1 changed files with 17 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
modules/age.nix
View file

@ -21,10 +21,10 @@ let
''; '';
rootOwnedSecrets = builtins.filter (st: st.owner == "root" && st.group == "root") (builtins.attrValues cfg.secrets); rootOwnedSecrets = builtins.filter (st: st.owner == "root" && st.group == "root") (builtins.attrValues cfg.secrets);
installRootOwnedSecrets = builtins.concatStringsSep "\n" (["echo '[agenix] decrypting root secrets...'"] ++ (map installSecret rootOwnedSecrets)); installRootOwnedSecrets = builtins.concatStringsSep "\n" ([ "echo '[agenix] decrypting root secrets...'" ] ++ (map installSecret rootOwnedSecrets));
nonRootSecrets = builtins.filter (st: st.owner != "root" || st.group != "root") (builtins.attrValues cfg.secrets); nonRootSecrets = builtins.filter (st: st.owner != "root" || st.group != "root") (builtins.attrValues cfg.secrets);
installNonRootSecrets = builtins.concatStringsSep "\n" (["echo '[agenix] decrypting non-root secrets...'"] ++ (map installSecret nonRootSecrets)); installNonRootSecrets = builtins.concatStringsSep "\n" ([ "echo '[agenix] decrypting non-root secrets...'" ] ++ (map installSecret nonRootSecrets));
secretType = types.submodule ({ config, ... }: { secretType = types.submodule ({ config, ... }: {
options = { options = {
@ -42,12 +42,12 @@ let
''; '';
}; };
path = mkOption { path = mkOption {
type = types.str; type = types.str;
default = "/run/secrets/${config.name}"; default = "/run/secrets/${config.name}";
description = '' description = ''
Path where the decrypted secret is installed. Path where the decrypted secret is installed.
''; '';
}; };
mode = mkOption { mode = mkOption {
type = types.str; type = types.str;
default = "0400"; default = "0400";
@ -71,28 +71,30 @@ let
}; };
}; };
}); });
in { in
{
options.age = { options.age = {
secrets = mkOption { secrets = mkOption {
type = types.attrsOf secretType; type = types.attrsOf secretType;
default = {}; default = { };
description = '' description = ''
Attrset of secrets. Attrset of secrets.
''; '';
}; };
sshKeyPaths = mkOption { sshKeyPaths = mkOption {
type = types.listOf types.path; type = types.listOf types.path;
default = if config.services.openssh.enable then default =
map (e: e.path) (lib.filter (e: e.type == "rsa" || e.type == "ed25519") config.services.openssh.hostKeys) if config.services.openssh.enable then
else []; map (e: e.path) (lib.filter (e: e.type == "rsa" || e.type == "ed25519") config.services.openssh.hostKeys)
else [ ];
description = '' description = ''
Path to SSH keys to be used as identities in age decryption. Path to SSH keys to be used as identities in age decryption.
''; '';
}; };
}; };
config = mkIf (cfg.secrets != {}) { config = mkIf (cfg.secrets != { }) {
assertions = [{ assertions = [{
assertion = cfg.sshKeyPaths != []; assertion = cfg.sshKeyPaths != [ ];
message = "age.sshKeyPaths must be set."; message = "age.sshKeyPaths must be set.";
}]; }];