diff options
author | Franck Cuny <franck@fcuny.net> | 2022-04-13 10:23:20 -0700 |
---|---|---|
committer | Franck Cuny <franck@fcuny.net> | 2022-04-13 10:23:20 -0700 |
commit | 5e4d8a007254b9811c86b2ea142a280c9828271d (patch) | |
tree | 83c1b8e3ab3b502cb82c79d8438e201334f012c4 /modules | |
parent | secrets: fix the path to the ssh key (diff) | |
download | world-5e4d8a007254b9811c86b2ea142a280c9828271d.tar.gz |
secrets: move the actual secrets with hosts config
Having the secrets closer to the host is easier to manage. At the moment I don't have secrets that are shared across multiple hosts, so that's an OK approach.
Diffstat (limited to 'modules')
-rw-r--r-- | modules/secrets/default.nix | 23 | ||||
-rw-r--r-- | modules/secrets/network/aptos/wireguard_privatekey.age | bin | 467 -> 0 bytes |
2 files changed, 12 insertions, 11 deletions
diff --git a/modules/secrets/default.nix b/modules/secrets/default.nix index 556bf32..20dbfd2 100644 --- a/modules/secrets/default.nix +++ b/modules/secrets/default.nix @@ -1,22 +1,23 @@ { config, inputs, lib, options, ... }: -with builtins; { +with builtins; +with lib; +let + secretsDir = "${toString ../../hosts}/${config.networking.hostName}/secrets"; + secretsFile = "${secretsDir}/secrets.nix"; +in { imports = [ inputs.agenix.nixosModules.age ]; config.age = { secrets = let - toName = lib.removeSuffix ".age"; userExists = u: builtins.hasAttr u config.users.users; # Only set the user if it exists, to avoid warnings userIfExists = u: if userExists u then u else "root"; - toSecret = name: - { owner ? "root", ... }: { - file = ./. + "/${name}"; - owner = lib.mkDefault (userIfExists owner); - }; - convertSecrets = n: v: lib.nameValuePair (toName n) (toSecret n v); - secrets = import ./secrets.nix; - in lib.mapAttrs' convertSecrets secrets; - + in if pathExists secretsFile then + mapAttrs' (n: _: + nameValuePair (removeSuffix ".age" n) { file = "${secretsDir}/${n}"; }) + (import secretsFile) + else + { }; identityPaths = options.age.identityPaths.default ++ (filter pathExists [ "${config.users.users.fcuny.home}/.ssh/id_ed25519" ]); }; diff --git a/modules/secrets/network/aptos/wireguard_privatekey.age b/modules/secrets/network/aptos/wireguard_privatekey.age deleted file mode 100644 index 2f6edf3..0000000 --- a/modules/secrets/network/aptos/wireguard_privatekey.age +++ /dev/null Binary files differ |