about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--ops/machines/whitby/default.nix2
-rw-r--r--ops/secrets/default.nix21
2 files changed, 22 insertions, 1 deletions
diff --git a/ops/machines/whitby/default.nix b/ops/machines/whitby/default.nix
index 3a41e1442c4c..f0e934c635d1 100644
--- a/ops/machines/whitby/default.nix
+++ b/ops/machines/whitby/default.nix
@@ -205,7 +205,7 @@ in {
   # Configure secrets for services that need them.
   age.secrets =
     let
-      secretFile = name: "${depot.path.origSrc}/ops/secrets/${name}.age";
+      secretFile = name: depot.ops.secrets."${name}.age";
     in {
       clbot.file = secretFile "clbot";
       gerrit-queue.file = secretFile "gerrit-queue";
diff --git a/ops/secrets/default.nix b/ops/secrets/default.nix
new file mode 100644
index 000000000000..cafd605a4e9b
--- /dev/null
+++ b/ops/secrets/default.nix
@@ -0,0 +1,21 @@
+# Expose secrets as part of the tree, making it possible to validate
+# their paths at eval time.
+#
+# Note that encrypted secrets end up in the Nix store, but this is
+# fine since they're publicly available anyways.
+{ depot, pkgs, ... }:
+
+let
+  inherit (builtins) attrNames listToAttrs;
+
+  # Import agenix configuration file, this itself is not a readTree
+  # target but defines all valid secrets.
+  secrets = import ./secrets.nix;
+
+  # Import a secret to the Nix store
+  declareSecret = name: pkgs.runCommandNoCC name {} ''
+    cp ${./. + "/${name}"} $out
+  '';
+in depot.nix.readTree.drvTargets (listToAttrs (
+  map (name: { inherit name; value = declareSecret name; }) (attrNames secrets)
+))