AtaraxiaDev/nixos-config
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

secrets fixed?

Browse Source
This commit is contained in:
Dmitriy Kholkin 2021-10-26 03:16:26 +03:00
parent 1e97d3ab7f
commit f3cf2f7f19
1 changed files with 20 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
modules/secrets.nix
View File

@ -95,6 +95,23 @@ let
(builtins.attrNames config.secrets-envsubst)
++ map (name: "${name}-secrets.service")
(builtins.attrNames config.secrets));
activate-secrets = pkgs.writeShellScriptBin "activate-secrets" ''
set -euo pipefail
# Make sure card is available and unlocked
# echo fetch | gpg --card-edit --no-tty --command-fd=0
# ${pkgs.gnupg}/bin/gpg --card-status
if [ -d "${password-store}/.git" ]; then
cd "${password-store}"; ${pkgs.git}/bin/git pull
else
${pkgs.git}/bin/git clone ${lib.escapeShellArg config.secretsConfig.repo} "${password-store}"
fi
ln -sf ${
pkgs.writeShellScript "push" "${pkgs.git}/bin/git push origin master"
} "${password-store}/.git/hooks/post-commit"
cat ${password-store}/spotify.gpg | ${pkgs.gnupg}/bin/gpg --decrypt > /dev/null
sudo systemctl restart ${allServices}
'';
in {
options.secrets = lib.mkOption {
type = attrsOf (submodule secret);
@ -111,24 +128,7 @@ in {
config.systemd.services =
mkMerge (concatLists (mapAttrsToList mkServices config.secrets));
config.environment.systemPackages = [
(pkgs.writeShellScriptBin "activate-secrets" ''
set -euo pipefail
# Make sure card is available and unlocked
# echo fetch | gpg --card-edit --no-tty --command-fd=0
# ${pkgs.gnupg}/bin/gpg --card-status
if [ -d "${password-store}/.git" ]; then
cd "${password-store}"; ${pkgs.git}/bin/git pull
else
${pkgs.git}/bin/git clone ${lib.escapeShellArg config.secretsConfig.repo} "${password-store}"
fi
ln -sf ${
pkgs.writeShellScript "push" "${pkgs.git}/bin/git push origin master"
} "${password-store}/.git/hooks/post-commit"
cat ${password-store}/spotify.gpg | ${pkgs.gnupg}/bin/gpg --decrypt > /dev/null
sudo systemctl restart ${allServices}
'')
];
config.environment.systemPackages = [ activate-secrets ];
config.security.sudo.extraRules = [{
users = [ "alukard" ];
@ -143,9 +143,8 @@ in {
config.startup = [{ command = "activate-secrets"; }];
};
systemd.user.services.activate-secrets = lib.mkIf config.deviceSpecific.isServer {
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStart = "activate-secrets";
Service = {
ExecStart = "${activate-secrets}/bin/activate-secrets";
Type = "oneshot";
};
};