From 6a5cb9b7544168e7136ab2dbd833c9fc63020db7 Mon Sep 17 00:00:00 2001
From: Franck Cuny <franck@fcuny.net>
Date: Sun, 10 Apr 2022 14:44:33 -0700
Subject: secrets: move all the secrets under module/

Refactor a bit the configuration, which should simplify the management
and usage of secrets from now on.
---
 modules/secrets/default.nix | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 modules/secrets/default.nix

(limited to 'modules/secrets/default.nix')

diff --git a/modules/secrets/default.nix b/modules/secrets/default.nix
new file mode 100644
index 0000000..e6f3a7b
--- /dev/null
+++ b/modules/secrets/default.nix
@@ -0,0 +1,24 @@
+{ config, inputs, lib, options, ... }:
+
+{
+  imports = [ inputs.agenix.nixosModules.age ];
+
+  config.age = {
+    secrets = let
+      toName = lib.removeSuffix ".age";
+      userExists = u: builtins.hasAttr u config.users.users;
+      # Only set the user if it exists, to avoid warnings
+      userIfExists = u: if userExists u then u else "root";
+      toSecret = name:
+        { owner ? "root", ... }: {
+          file = ./. + "/${name}";
+          owner = lib.mkDefault (userIfExists owner);
+        };
+      convertSecrets = n: v: lib.nameValuePair (toName n) (toSecret n v);
+      secrets = import ./secrets.nix;
+    in lib.mapAttrs' convertSecrets secrets;
+
+    identityPaths = options.age.identityPaths.default
+      ++ [ "/home/fcuny/.ssh/id_ed25519" ];
+  };
+}
-- 
cgit v1.2.3