SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-01-21 15:11:34 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

sops: Turn secretsFile into an absolute path

Browse source
This commit is contained in:
SebastianStork 2025-12-25 21:06:56 +01:00
parent 21b4e04613
commit 1170bbf857
Signed by: SebastianStork
SSH key fingerprint: SHA256:iEM011ogNMG1q8+U500adGu/9rpPuZ2KnFtbdLeqTiI
2 changed files with 7 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

6
flake-parts/sops.nix
View file

@ -10,13 +10,13 @@
{ {
packages.sops-config = packages.sops-config =
let let
adminKey = "age1mpq8m4p7dnxh5ze3fh7etd2k6sp85zdnmp9te3e9chcw4pw07pcq960zh5"; adminPublicKey = "age1mpq8m4p7dnxh5ze3fh7etd2k6sp85zdnmp9te3e9chcw4pw07pcq960zh5";
mkCreationRule = sopsCfg: { mkCreationRule = sopsCfg: {
path_regex = sopsCfg.secretsFile; path_regex = self.lib.relativePath sopsCfg.secretsFile;
key_groups = lib.singleton { key_groups = lib.singleton {
age = [ age = [
adminKey adminPublicKey
sopsCfg.agePublicKey sopsCfg.agePublicKey
]; ];
}; };

10
modules/system/sops.nix
View file

@ -7,8 +7,6 @@
}: }:
let let
cfg = config.custom.sops; cfg = config.custom.sops;
absoluteSecretsPath = "${self}/${cfg.secretsFile}";
in in
{ {
imports = [ inputs.sops.nixosModules.sops ]; imports = [ inputs.sops.nixosModules.sops ];
@ -20,12 +18,12 @@ in
default = "${self}/hosts/${config.networking.hostName}/keys/age.pub" |> lib.readFile |> lib.trim; default = "${self}/hosts/${config.networking.hostName}/keys/age.pub" |> lib.readFile |> lib.trim;
}; };
secretsFile = lib.mkOption { secretsFile = lib.mkOption {
type = lib.types.nonEmptyStr; type = lib.types.path;
default = "hosts/${config.networking.hostName}/secrets.json"; default = "${self}/hosts/${config.networking.hostName}/secrets.json";
}; };
secrets = lib.mkOption { secrets = lib.mkOption {
type = lib.types.anything; type = lib.types.anything;
default = absoluteSecretsPath |> lib.readFile |> lib.strings.fromJSON; default = cfg.secretsFile |> lib.readFile |> lib.strings.fromJSON;
}; };
}; };
@ -34,7 +32,7 @@ in
age.sshKeyPaths = [ age.sshKeyPaths = [
"${lib.optionalString config.custom.persistence.enable "/persist"}/etc/ssh/ssh_host_ed25519_key" "${lib.optionalString config.custom.persistence.enable "/persist"}/etc/ssh/ssh_host_ed25519_key"
]; ];
defaultSopsFile = absoluteSecretsPath; defaultSopsFile = cfg.secretsFile;
}; };
}; };
} }