0xrsydn/dotfiles
1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

nix format

Browse source
This commit is contained in:
Rasyidan Akbar F. 2025-09-30 18:00:43 +07:00
commit 629604b44b
3 changed files with 48 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

49
modules/home/rsydn/secrets.nix
View file

@ -6,19 +6,19 @@ let
sanitizeSecret = name: secret:
let
sopsFile = secret.sopsFile or cfg.defaultSopsFile;
extra = lib.filterAttrs (k: _: !(builtins.elem k [ "path" "mode" "sopsFile" ])) secret;
in
{
extra =
lib.filterAttrs (k: _: !(builtins.elem k [ "path" "mode" "sopsFile" ]))
secret;
in {
path = secret.path or "${config.xdg.configHome}/secrets/${name}";
mode = secret.mode or "0400";
}
// (lib.optionalAttrs (sopsFile != null) { inherit sopsFile; })
// extra;
} // (lib.optionalAttrs (sopsFile != null) { inherit sopsFile; }) // extra;
in {
imports = [ inputs.sops-nix.homeManagerModules.sops ];
options.rsydn.secrets = {
enable = mkEnableOption "sops-nix integration for managing decrypted secrets";
enable =
mkEnableOption "sops-nix integration for managing decrypted secrets";
ageKeyFile = mkOption {
type = types.str;
@ -29,13 +29,15 @@ in {
defaultSopsFile = mkOption {
type = types.nullOr types.path;
default = null;
description = "Optional default SOPS file used when a secret definition omits `sopsFile`.";
description =
"Optional default SOPS file used when a secret definition omits `sopsFile`.";
};
secrets = mkOption {
type = types.attrsOf types.attrs;
default = { };
description = "Secret entries forwarded to `sops.secrets` with sensible defaults.";
description =
"Secret entries forwarded to `sops.secrets` with sensible defaults.";
example = lib.literalExpression ''
{
"api-key" = {
@ -49,22 +51,21 @@ in {
};
config = mkIf cfg.enable {
sops =
{
age = {
keyFile = cfg.ageKeyFile;
generateKey = true;
};
sops = {
age = {
keyFile = cfg.ageKeyFile;
generateKey = true;
};
secrets = lib.mapAttrs sanitizeSecret cfg.secrets;
}
// (lib.optionalAttrs (cfg.defaultSopsFile != null) {
defaultSopsFile = cfg.defaultSopsFile;
});
secrets = lib.mapAttrs sanitizeSecret cfg.secrets;
} // (lib.optionalAttrs (cfg.defaultSopsFile != null) {
defaultSopsFile = cfg.defaultSopsFile;
});
home.activation.ensureSecretDir = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
mkdir -p "${config.xdg.configHome}/secrets"
chmod 700 "${config.xdg.configHome}/secrets"
'';
home.activation.ensureSecretDir =
lib.hm.dag.entryAfter [ "writeBoundary" ] ''
mkdir -p "${config.xdg.configHome}/secrets"
chmod 700 "${config.xdg.configHome}/secrets"
'';
};
}