71 lines
2 KiB
Nix
71 lines
2 KiB
Nix
{ config, lib, inputs, ... }:
|
|
let
|
|
inherit (lib) mkEnableOption mkOption mkIf types;
|
|
cfg = config.rsydn.secrets;
|
|
|
|
sanitizeSecret = name: secret:
|
|
let
|
|
sopsFile = secret.sopsFile or cfg.defaultSopsFile;
|
|
extra =
|
|
lib.filterAttrs (k: _: !(builtins.elem k [ "path" "mode" "sopsFile" ]))
|
|
secret;
|
|
in {
|
|
path = secret.path or "${config.xdg.configHome}/secrets/${name}";
|
|
mode = secret.mode or "0400";
|
|
} // (lib.optionalAttrs (sopsFile != null) { inherit sopsFile; }) // extra;
|
|
in {
|
|
imports = [ inputs.sops-nix.homeManagerModules.sops ];
|
|
|
|
options.rsydn.secrets = {
|
|
enable =
|
|
mkEnableOption "sops-nix integration for managing decrypted secrets";
|
|
|
|
ageKeyFile = mkOption {
|
|
type = types.str;
|
|
default = "${config.home.homeDirectory}/.config/sops/age/keys.txt";
|
|
description = "Path to the Age key used for decrypting secrets.";
|
|
};
|
|
|
|
defaultSopsFile = mkOption {
|
|
type = types.nullOr types.path;
|
|
default = null;
|
|
description =
|
|
"Optional default SOPS file used when a secret definition omits `sopsFile`.";
|
|
};
|
|
|
|
secrets = mkOption {
|
|
type = types.attrsOf types.attrs;
|
|
default = { };
|
|
description =
|
|
"Secret entries forwarded to `sops.secrets` with sensible defaults.";
|
|
example = lib.literalExpression ''
|
|
{
|
|
"api-key" = {
|
|
sopsFile = ./secrets.yaml;
|
|
path = "${config.xdg.configHome}/secrets/api-key";
|
|
mode = "0400";
|
|
};
|
|
}
|
|
'';
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
sops = {
|
|
age = {
|
|
keyFile = cfg.ageKeyFile;
|
|
generateKey = true;
|
|
};
|
|
|
|
secrets = lib.mapAttrs sanitizeSecret cfg.secrets;
|
|
} // (lib.optionalAttrs (cfg.defaultSopsFile != null) {
|
|
defaultSopsFile = cfg.defaultSopsFile;
|
|
});
|
|
|
|
home.activation.ensureSecretDir =
|
|
lib.hm.dag.entryAfter [ "writeBoundary" ] ''
|
|
mkdir -p "${config.xdg.configHome}/secrets"
|
|
chmod 700 "${config.xdg.configHome}/secrets"
|
|
'';
|
|
};
|
|
}
|