diff options
Diffstat (limited to 'ops/secrets/default.nix')
| -rw-r--r-- | ops/secrets/default.nix | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/ops/secrets/default.nix b/ops/secrets/default.nix new file mode 100644 index 0000000000..cafd605a4e --- /dev/null +++ b/ops/secrets/default.nix @@ -0,0 +1,21 @@ +# Expose secrets as part of the tree, making it possible to validate +# their paths at eval time. +# +# Note that encrypted secrets end up in the Nix store, but this is +# fine since they're publicly available anyways. +{ depot, pkgs, ... }: + +let + inherit (builtins) attrNames listToAttrs; + + # Import agenix configuration file, this itself is not a readTree + # target but defines all valid secrets. + secrets = import ./secrets.nix; + + # Import a secret to the Nix store + declareSecret = name: pkgs.runCommandNoCC name {} '' + cp ${./. + "/${name}"} $out + ''; +in depot.nix.readTree.drvTargets (listToAttrs ( + map (name: { inherit name; value = declareSecret name; }) (attrNames secrets) +)) |