sokai/mynixos-config
1
1
Fork 0
forked from mirrors_public/oddlama_nix-config
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: cache decrypted repository "secrets"

Browse source
This commit is contained in:
oddlama 2023-03-15 16:10:20 +01:00
parent 3111408f7d
commit 8947434a1e
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
2 changed files with 37 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
nix/extra-builtins.nix
View file

@ -22,8 +22,11 @@
in
lenContent >= lenSuffix && builtins.substring (lenContent - lenSuffix) lenContent content == suffix;
in {
# Instead of calling rage directly here, we call a wrapper script that will cache the output
# in a predictable path in /tmp, which allows us to only require the password for each encrypted
# file once.
rageImportEncrypted = identities: nixFile:
assert assertMsg (builtins.isPath nixFile) "The file to decrypt must be given as a path to prevent impurity.";
assert assertMsg (hasSuffix ".nix.age" nixFile) "The content of the decrypted file must be a nix expression and should therefore end in .nix.age";
exec (["rage" "-d"] ++ (builtins.concatMap (x: ["-i" x]) identities) ++ [nixFile]);
exec ([./rage-decrypt.sh nixFile] ++ identities);
}