diff options
| -rw-r--r-- | ops/secrets/default.nix | 24 | ||||
| -rw-r--r-- | ops/secrets/mkSecrets.nix | 19 |
2 files changed, 22 insertions, 21 deletions
diff --git a/ops/secrets/default.nix b/ops/secrets/default.nix index cafd605a4e9b..43f2a738bb6b 100644 --- a/ops/secrets/default.nix +++ b/ops/secrets/default.nix @@ -1,21 +1,3 @@ -# Expose secrets as part of the tree, making it possible to validate -# their paths at eval time. -# -# Note that encrypted secrets end up in the Nix store, but this is -# fine since they're publicly available anyways. -{ depot, pkgs, ... }: - -let - inherit (builtins) attrNames listToAttrs; - - # Import agenix configuration file, this itself is not a readTree - # target but defines all valid secrets. - secrets = import ./secrets.nix; - - # Import a secret to the Nix store - declareSecret = name: pkgs.runCommandNoCC name {} '' - cp ${./. + "/${name}"} $out - ''; -in depot.nix.readTree.drvTargets (listToAttrs ( - map (name: { inherit name; value = declareSecret name; }) (attrNames secrets) -)) +args: +let mkSecrets = import ./mkSecrets.nix args; in +mkSecrets ./. (import ./secrets.nix) // { inherit mkSecrets; } diff --git a/ops/secrets/mkSecrets.nix b/ops/secrets/mkSecrets.nix new file mode 100644 index 000000000000..7a39a418a884 --- /dev/null +++ b/ops/secrets/mkSecrets.nix @@ -0,0 +1,19 @@ +# Expose secrets as part of the tree, making it possible to validate +# their paths at eval time. +# +# Note that encrypted secrets end up in the Nix store, but this is +# fine since they're publicly available anyways. +{ depot, pkgs, ... }: +path: secrets: + +let + inherit (builtins) attrNames listToAttrs; + + # Import a secret to the Nix store + declareSecret = name: pkgs.runCommandNoCC name {} '' + cp ${path + "/${name}"} $out + ''; +in depot.nix.readTree.drvTargets (listToAttrs ( + map (name: { inherit name; value = declareSecret name; }) + (attrNames secrets) +)) |