diff options
| -rw-r--r-- | ops/machines/whitby/default.nix | 2 | ||||
| -rw-r--r-- | ops/secrets/default.nix | 21 |
2 files changed, 22 insertions, 1 deletions
diff --git a/ops/machines/whitby/default.nix b/ops/machines/whitby/default.nix index 3a41e1442c..f0e934c635 100644 --- a/ops/machines/whitby/default.nix +++ b/ops/machines/whitby/default.nix @@ -205,7 +205,7 @@ in { # Configure secrets for services that need them. age.secrets = let - secretFile = name: "${depot.path.origSrc}/ops/secrets/${name}.age"; + secretFile = name: depot.ops.secrets."${name}.age"; in { clbot.file = secretFile "clbot"; gerrit-queue.file = secretFile "gerrit-queue"; diff --git a/ops/secrets/default.nix b/ops/secrets/default.nix new file mode 100644 index 0000000000..cafd605a4e --- /dev/null +++ b/ops/secrets/default.nix @@ -0,0 +1,21 @@ +# Expose secrets as part of the tree, making it possible to validate +# their paths at eval time. +# +# Note that encrypted secrets end up in the Nix store, but this is +# fine since they're publicly available anyways. +{ depot, pkgs, ... }: + +let + inherit (builtins) attrNames listToAttrs; + + # Import agenix configuration file, this itself is not a readTree + # target but defines all valid secrets. + secrets = import ./secrets.nix; + + # Import a secret to the Nix store + declareSecret = name: pkgs.runCommandNoCC name {} '' + cp ${./. + "/${name}"} $out + ''; +in depot.nix.readTree.drvTargets (listToAttrs ( + map (name: { inherit name; value = declareSecret name; }) (attrNames secrets) +)) |