Add agenix
Indexes all *.age files in $HOST/secrets/
This commit is contained in:
		
							parent
							
								
									c92199848c
								
							
						
					
					
						commit
						69d730f89d
					
				
							
								
								
									
										37
									
								
								flake.lock
									
									
									
									
									
								
							
							
						
						
									
										37
									
								
								flake.lock
									
									
									
									
									
								
							|  | @ -1,5 +1,26 @@ | |||
| { | ||||
|   "nodes": { | ||||
|     "agenix": { | ||||
|       "inputs": { | ||||
|         "flake-utils": "flake-utils", | ||||
|         "nixpkgs": [ | ||||
|           "nixpkgs" | ||||
|         ] | ||||
|       }, | ||||
|       "locked": { | ||||
|         "lastModified": 1609364598, | ||||
|         "narHash": "sha256-dKFCWfUKXRP1z0k/bRMoDOuT0iKM5/starxgG0jn7Ek=", | ||||
|         "owner": "ryantm", | ||||
|         "repo": "agenix", | ||||
|         "rev": "37b1d2aa3f2afd196350e43b5e90e8bfd8718d90", | ||||
|         "type": "github" | ||||
|       }, | ||||
|       "original": { | ||||
|         "owner": "ryantm", | ||||
|         "repo": "agenix", | ||||
|         "type": "github" | ||||
|       } | ||||
|     }, | ||||
|     "emacs-overlay": { | ||||
|       "locked": { | ||||
|         "lastModified": 1609865496, | ||||
|  | @ -15,6 +36,21 @@ | |||
|         "type": "github" | ||||
|       } | ||||
|     }, | ||||
|     "flake-utils": { | ||||
|       "locked": { | ||||
|         "lastModified": 1600209923, | ||||
|         "narHash": "sha256-zoOWauTliFEjI++esk6Jzk7QO5EKpddWXQm9yQK24iM=", | ||||
|         "owner": "numtide", | ||||
|         "repo": "flake-utils", | ||||
|         "rev": "3cd06d3c1df6879c9e41cb2c33113df10566c760", | ||||
|         "type": "github" | ||||
|       }, | ||||
|       "original": { | ||||
|         "owner": "numtide", | ||||
|         "repo": "flake-utils", | ||||
|         "type": "github" | ||||
|       } | ||||
|     }, | ||||
|     "home-manager": { | ||||
|       "inputs": { | ||||
|         "nixpkgs": [ | ||||
|  | @ -83,6 +119,7 @@ | |||
|     }, | ||||
|     "root": { | ||||
|       "inputs": { | ||||
|         "agenix": "agenix", | ||||
|         "emacs-overlay": "emacs-overlay", | ||||
|         "home-manager": "home-manager", | ||||
|         "nixos-hardware": "nixos-hardware", | ||||
|  |  | |||
|  | @ -18,6 +18,8 @@ | |||
|       nixpkgs-unstable.url = "nixpkgs/master"; | ||||
|       home-manager.url = "github:rycee/home-manager/master"; | ||||
|       home-manager.inputs.nixpkgs.follows = "nixpkgs"; | ||||
|       agenix.url = "github:ryantm/agenix"; | ||||
|       agenix.inputs.nixpkgs.follows = "nixpkgs"; | ||||
| 
 | ||||
|       # Extras | ||||
|       emacs-overlay.url  = "github:nix-community/emacs-overlay"; | ||||
|  |  | |||
							
								
								
									
										29
									
								
								modules/agenix.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										29
									
								
								modules/agenix.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,29 @@ | |||
| # modules/agenix.nix -- encrypt secrets in nix store | ||||
| 
 | ||||
| { options, config, inputs, lib, pkgs, ... }: | ||||
| 
 | ||||
| with builtins; | ||||
| with lib; | ||||
| with lib.my; | ||||
| let inherit (inputs) agenix; | ||||
|     secretsDir = "${dotFilesDir}/hosts/${config.networking.hostName}/secrets"; | ||||
|     secretsFile = "${secretsDir}/secrets.nix"; | ||||
| in { | ||||
|   imports = [ agenix.nixosModules.age ]; | ||||
|   environment.systemPackages = [ agenix.defaultPackage.x86_64-linux ]; | ||||
| 
 | ||||
|   age = { | ||||
|     secrets = | ||||
|       if pathExists secretsFile | ||||
|       then mapAttrs' (n: _: nameValuePair (removeSuffix ".age" n) { | ||||
|         file = "${secretsDir}/${n}"; | ||||
|         owner = mkDefault config.user.name; | ||||
|       }) (import secretsFile) | ||||
|       else {}; | ||||
|     sshKeyPaths = | ||||
|       options.age.sshKeyPaths.default ++ (filter pathExists [ | ||||
|         "${config.user.home}/.ssh/id_ed25519" | ||||
|         "${config.user.home}/.ssh/id_rsa" | ||||
|       ]); | ||||
|   }; | ||||
| } | ||||
		Loading…
	
		Reference in a new issue