1 files changed, 3 insertions, 21 deletions
diff --git a/ops/secrets/default.nix b/ops/secrets/default.nix
index cafd605a4e..43f2a738bb 100644
--- a/ops/secrets/default.nix
+++ b/ops/secrets/default.nix
@@ -1,21 +1,3 @@
-# Expose secrets as part of the tree, making it possible to validate
-# their paths at eval time.
-#
-# Note that encrypted secrets end up in the Nix store, but this is
-# fine since they're publicly available anyways.
-{ depot, pkgs, ... }:
-
-let
-  inherit (builtins) attrNames listToAttrs;
-
-  # Import agenix configuration file, this itself is not a readTree
-  # target but defines all valid secrets.
-  secrets = import ./secrets.nix;
-
-  # Import a secret to the Nix store
-  declareSecret = name: pkgs.runCommandNoCC name {} ''
-    cp ${./. + "/${name}"} $out
-  '';
-in depot.nix.readTree.drvTargets (listToAttrs (
-  map (name: { inherit name; value = declareSecret name; }) (attrNames secrets)
-))
+args:
+let mkSecrets = import ./mkSecrets.nix args; in
+mkSecrets ./. (import ./secrets.nix) // { inherit mkSecrets; }