Modules/Agenix: Change to system module
This commit is contained in:
@@ -1,50 +0,0 @@
|
||||
{
|
||||
config,
|
||||
nixosConfig,
|
||||
lib,
|
||||
mylib,
|
||||
pkgs,
|
||||
username,
|
||||
publicKeys,
|
||||
...
|
||||
}: let
|
||||
inherit (config.modules) agenix;
|
||||
in {
|
||||
options.modules.agenix = import ./options.nix {inherit lib mylib;};
|
||||
|
||||
config = {
|
||||
# The user will be able to decrypt .age files using agenix.
|
||||
# On each user/machine, this should generate a corresponding secrets.nix
|
||||
home.file."${config.paths.nixflake}/home/modules/agenix/secrets.nix".text = let
|
||||
mkSecret = key: name: "\"${name}.age\".publicKeys = [\"${key}\"];";
|
||||
in ''
|
||||
# NOTE: This file will contain keys depending on the host/by which user it was built on.
|
||||
{
|
||||
${lib.optionalString
|
||||
# If this user defined any secrets...
|
||||
(builtins.hasAttr "${username}" agenix.secrets)
|
||||
# ...we will add them to the current secrets.nix,
|
||||
# s.t. agenix can be used to encrypt the secret.
|
||||
(builtins.concatStringsSep "\n"
|
||||
(builtins.map
|
||||
(mkSecret publicKeys.${username}.ssh)
|
||||
agenix.secrets.${username}))}
|
||||
}
|
||||
'';
|
||||
|
||||
age.secrets = let
|
||||
mkSecretIfExists = name:
|
||||
# If this user has already encrypted the secret...
|
||||
if builtins.pathExists ./${name}.age
|
||||
# ...we will register it with age...
|
||||
then {${name}.file = ./${name}.age;}
|
||||
# ...otherwise we link to a bogus file.
|
||||
else {${name}.file = ./void.age;};
|
||||
in
|
||||
lib.mkIf
|
||||
# If this user defined any secrets...
|
||||
(builtins.hasAttr "${username}" agenix.secrets)
|
||||
# ...we will register all secrets files that have already been generated.
|
||||
(lib.mkMerge (builtins.map mkSecretIfExists agenix.secrets.${username}));
|
||||
};
|
||||
}
|
||||
@@ -1,5 +0,0 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 PW+5DQ 2vardSYoPFvDEw4TiKSXntAJmChcVu9X+nD1+rCac1c
|
||||
mbx9xEy0vkQvl6HqLcFTk3qrsUpDAUuKD6GnJGa9elc
|
||||
--- vKkGWdp/anMV2VzwJEEHeWNUjv/SkzjYOIljRK6ExbI
|
||||
¹Ò¤Š�v®òLHôæl†|µ>ßïÇMcsoÏ{jÄSöÊÅ_à‰'—ÐŒÊWlÃ…£_iûM°Y×âÏÐý�VVûŒsÛ,D%�-&+�½ì¡ißÖTçP"�g
|
||||
@@ -1,6 +0,0 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 PW+5DQ Wm5RTSiZ/ndp6l6q2T43wrHiMnyP/FqDzUsl29TYoQc
|
||||
ti4Pc/+g+6618wOQAb+28bNt87A8f3gRFzCaMlNKpP4
|
||||
--- aRzLWmbnb7MqPVDSTYLqCIDHqaj0fu3JVp4ES93xZ9I
|
||||
B6Ï<ª
|
||||
I mjì–óñ½L‰¹N£í÷—-eØ![Ç'y_�aIë·
|
||||
@@ -1,6 +0,0 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 PW+5DQ ZeBpvImtTWyKOxlCh573CNitT2z1OX2PgHAzLB/RTzg
|
||||
jx7n2REzbCJ9zr2TQHSvEz7lUZap5J2mjHNx710L49w
|
||||
--- kdRUEg3IOfjUfAgPEMj7MdiGftxVptPeC/Mbh5qWf8c
|
||||
Ν
|
||||
™Ò#N'ß(:aì©aá]µÿgüPo©ý¡í²[�¯=nÜ
|
||||
@@ -1,5 +0,0 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 PW+5DQ V2ejrKdFVeO7nNqkRqa3nSnz8MKlHyZcQ+T1NRfntSw
|
||||
t79YI5ZFtW0k6IZRB5VMjy7st+WlhONTFyVF/tvPaKk
|
||||
--- Cz4XV8J+oM6q6bVq6uXXUUvW/BqBL0agNzmobzcu2Kc
|
||||
á�{*$˜cøÐ̨&ZÅuthF¿ïþï¢[ÍTý%?ˆÙÞ?|*½`¾^OÉ
|
||||
@@ -1,33 +0,0 @@
|
||||
{
|
||||
lib,
|
||||
mylib,
|
||||
...
|
||||
}: let
|
||||
mkSecret = file:
|
||||
lib.mkOption {
|
||||
type = lib.types.path;
|
||||
default = file;
|
||||
};
|
||||
in {
|
||||
secrets = lib.mkOption {
|
||||
type = lib.types.attrs;
|
||||
description = "The secret files managed by agenix (and their associated keys)";
|
||||
example = ''
|
||||
{
|
||||
christoph = [
|
||||
"heidi-discord-token"
|
||||
"kopia-password"
|
||||
"kopia-server-username"
|
||||
"kopia-server-password"
|
||||
];
|
||||
}
|
||||
'';
|
||||
|
||||
default = {};
|
||||
};
|
||||
|
||||
heidi-discord-token = mkSecret ./heidi-discord-token.age;
|
||||
kopia-user-password = mkSecret ./kopia-user-password.age;
|
||||
kopia-server-user = mkSecret ./kopia-server-user.age;
|
||||
kopia-server-password = mkSecret ./kopia-server-password.age;
|
||||
}
|
||||
@@ -1 +0,0 @@
|
||||
This secret has not been generated.
|
||||
@@ -3,7 +3,6 @@
|
||||
# Obsolete modules are kept in "1_deprecated" for reference.
|
||||
|
||||
# My own HM modules
|
||||
./agenix
|
||||
./beets
|
||||
./chromium
|
||||
./color
|
||||
|
||||
Reference in New Issue
Block a user