From fb13f9d23a34812a6fa0407557b207a8636663cf Mon Sep 17 00:00:00 2001
From: Franck Cuny <franck@fcuny.net>
Date: Wed, 13 Apr 2022 13:49:17 -0700
Subject: secrets: we can specify which user owns it

---
 modules/secrets/default.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

(limited to 'modules')

diff --git a/modules/secrets/default.nix b/modules/secrets/default.nix
index 20dbfd2..296f5fc 100644
--- a/modules/secrets/default.nix
+++ b/modules/secrets/default.nix
@@ -9,12 +9,17 @@ in {
 
   config.age = {
     secrets = let
+      toName = lib.removeSuffix ".age";
       userExists = u: builtins.hasAttr u config.users.users;
       # Only set the user if it exists, to avoid warnings
       userIfExists = u: if userExists u then u else "root";
+      toSecret = name:
+        { owner ? "root", ... }: {
+          file = "${secretsDir}/${name}";
+          owner = lib.mkDefault (userIfExists owner);
+        };
     in if pathExists secretsFile then
-      mapAttrs' (n: _:
-        nameValuePair (removeSuffix ".age" n) { file = "${secretsDir}/${n}"; })
+      mapAttrs' (n: v: nameValuePair (toName n) (toSecret n v))
       (import secretsFile)
     else
       { };
-- 
cgit 1.4.1