about summary refs log tree commit diff
path: root/default.nix
diff options
context:
space:
mode:
authorVincent Ambo <mail@tazj.in>2019-09-03T15·26+0100
committerGitHub <noreply@github.com>2019-09-03T15·26+0100
commit628cec34331ea7ef94a71f562a0dc1f8d49e9ecf (patch)
treefe6be2f9756627ac09c3207f876430921789baec /default.nix
parentbe28462a8a29403128b39696cc632f70363efa6e (diff)
parent283951388c96e871c9c4a835eee6594fc27e08c0 (diff)
Merge pull request #5 from tazjin/feat/cloud-kms-secrets r/80
Introduce secrets management via Google Cloud KMS
Diffstat (limited to 'default.nix')
-rw-r--r--default.nix13
1 files changed, 13 insertions, 0 deletions
diff --git a/default.nix b/default.nix
index ed6258108d5b..3b5736a19261 100644
--- a/default.nix
+++ b/default.nix
@@ -28,6 +28,13 @@ let
       blog = self.callPackage ./services/tazblog {};
       blog_cli = self.callPackage ./tools/blog_cli {};
       gemma = self.callPackage ./services/gemma {};
+
+      kms_pass = self.callPackage ./tools/kms_pass {
+        project = "tazjins-infrastructure";
+        region = "europe-north1";
+        keyring = "tazjins-keys";
+        key = "kontemplate-key";
+      };
     };
 
     # Third-party projects (either vendored or modified from nixpkgs) go here:
@@ -49,6 +56,12 @@ let
       sha256 = "1wn7nmb1cqfk2j91l3rwc6yhimfkzxprb8wknw5wi57yhq9m6lv1";
     }) {}).elmPackages;
 
+    # Wrap kontemplate to inject the Cloud KMS version of 'pass'
+    kontemplate = self.writeShellScriptBin "kontemplate" ''
+      export PATH="${self.tazjin.kms_pass}/bin:$PATH"
+      exec ${super.kontemplate}/bin/kontemplate $@
+    '';
+
     # One of Gemma's dependencies is missing in nixpkgs' Quicklisp
     # package set, it is overlaid locally here.
     lispPackages = import ./third_party/common_lisp/quicklisp.nix {