8a6bf347e9
Rather than the local secrets, which won't be found if the remote has no ~/.config/dotfiles.
30 lines
846 B
Nix
30 lines
846 B
Nix
# modules/agenix.nix -- encrypt secrets in nix store
|
|
|
|
{ options, config, inputs, lib, pkgs, ... }:
|
|
|
|
with builtins;
|
|
with lib;
|
|
with lib.my;
|
|
let inherit (inputs) agenix;
|
|
secretsDir = "${toString ../hosts}/${config.networking.hostName}/secrets";
|
|
secretsFile = "${secretsDir}/secrets.nix";
|
|
in {
|
|
imports = [ agenix.nixosModules.age ];
|
|
environment.systemPackages = [ agenix.defaultPackage.x86_64-linux ];
|
|
|
|
age = {
|
|
secrets =
|
|
if pathExists secretsFile
|
|
then mapAttrs' (n: _: nameValuePair (removeSuffix ".age" n) {
|
|
file = "${secretsDir}/${n}";
|
|
owner = mkDefault config.user.name;
|
|
}) (import secretsFile)
|
|
else {};
|
|
sshKeyPaths =
|
|
options.age.sshKeyPaths.default ++ (filter pathExists [
|
|
"${config.user.home}/.ssh/id_ed25519"
|
|
"${config.user.home}/.ssh/id_rsa"
|
|
]);
|
|
};
|
|
}
|