diff options
author | Franck Cuny <franck@fcuny.net> | 2022-04-10 14:44:33 -0700 |
---|---|---|
committer | Franck Cuny <franck@fcuny.net> | 2022-04-10 14:44:33 -0700 |
commit | 6a5cb9b7544168e7136ab2dbd833c9fc63020db7 (patch) | |
tree | 88db9fe9f436648acba60ffea98fd47942343b74 /modules/secrets/default.nix | |
parent | add a module for backup with restic (diff) | |
download | world-6a5cb9b7544168e7136ab2dbd833c9fc63020db7.tar.gz |
secrets: move all the secrets under module/
Refactor a bit the configuration, which should simplify the management and usage of secrets from now on.
Diffstat (limited to '')
-rw-r--r-- | modules/secrets/default.nix | 24 |
1 files changed, 24 insertions, 0 deletions
diff --git a/modules/secrets/default.nix b/modules/secrets/default.nix new file mode 100644 index 0000000..e6f3a7b --- /dev/null +++ b/modules/secrets/default.nix @@ -0,0 +1,24 @@ +{ config, inputs, lib, options, ... }: + +{ + imports = [ inputs.agenix.nixosModules.age ]; + + config.age = { + secrets = let + toName = lib.removeSuffix ".age"; + userExists = u: builtins.hasAttr u config.users.users; + # Only set the user if it exists, to avoid warnings + userIfExists = u: if userExists u then u else "root"; + toSecret = name: + { owner ? "root", ... }: { + file = ./. + "/${name}"; + owner = lib.mkDefault (userIfExists owner); + }; + convertSecrets = n: v: lib.nameValuePair (toName n) (toSecret n v); + secrets = import ./secrets.nix; + in lib.mapAttrs' convertSecrets secrets; + + identityPaths = options.age.identityPaths.default + ++ [ "/home/fcuny/.ssh/id_ed25519" ]; + }; +} |