about summary refs log tree commit diff
path: root/default.nix
diff options
context:
space:
mode:
authorVincent Ambo <tazjin@google.com>2019-09-03T14·56+0100
committerVincent Ambo <tazjin@google.com>2019-09-03T15·12+0100
commitbcd7710be565a4711a43d56122b37c7b38514b81 (patch)
tree8c53fe436606cea3ffd50ee4d42753b1340b8a5b /default.nix
parentabd5d7538c727e1aca7712455a799cf034d0fbaf (diff)
feat(tools): Introduce pass-compatible wrapper using Cloud KMS
Adds a shell script that supports a subset of the 'pass' interface for
compatibility with kontemplate, and wraps kontemplate in a script that
places this version on the PATH.

This makes it possible to use Cloud KMS encrypted secrets with kontemplate.
Diffstat (limited to 'default.nix')
-rw-r--r--default.nix13
1 files changed, 13 insertions, 0 deletions
diff --git a/default.nix b/default.nix
index ed6258108d5b..3b5736a19261 100644
--- a/default.nix
+++ b/default.nix
@@ -28,6 +28,13 @@ let
       blog = self.callPackage ./services/tazblog {};
       blog_cli = self.callPackage ./tools/blog_cli {};
       gemma = self.callPackage ./services/gemma {};
+
+      kms_pass = self.callPackage ./tools/kms_pass {
+        project = "tazjins-infrastructure";
+        region = "europe-north1";
+        keyring = "tazjins-keys";
+        key = "kontemplate-key";
+      };
     };
 
     # Third-party projects (either vendored or modified from nixpkgs) go here:
@@ -49,6 +56,12 @@ let
       sha256 = "1wn7nmb1cqfk2j91l3rwc6yhimfkzxprb8wknw5wi57yhq9m6lv1";
     }) {}).elmPackages;
 
+    # Wrap kontemplate to inject the Cloud KMS version of 'pass'
+    kontemplate = self.writeShellScriptBin "kontemplate" ''
+      export PATH="${self.tazjin.kms_pass}/bin:$PATH"
+      exec ${super.kontemplate}/bin/kontemplate $@
+    '';
+
     # One of Gemma's dependencies is missing in nixpkgs' Quicklisp
     # package set, it is overlaid locally here.
     lispPackages = import ./third_party/common_lisp/quicklisp.nix {