sokai/mynixos-config
1
1
Fork 0
forked from mirrors_public/oddlama_nix-config
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: implement repository-wide secrets

Browse source
This commit is contained in:
oddlama 2023-03-14 23:55:59 +01:00
parent efa04063e6
commit b03c913349
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
9 changed files with 130 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

29
nix/extra-builtins.nix Normal file
View file

@ -0,0 +1,29 @@
# This file is intended to be used together with pkgs.nix-plugins,
# to provide rage decryption as an additional safe builtin.
#
# Make sure that nix-plugins is installed by adding the following
# statement to your configuration.nix:
#
# ```nix
# {
# nix.extraOptions = ''
# plugin-files = ${pkgs.nix-plugins}/lib/nix/plugins
# # Please adjust path accordingly, or leave this out and alternativaly
# # pass `--option extra-builtins-file ./extra-builtins.nix` to each invocation
# extra-builtins-file = ./extra-builtins.nix
# '';
# }
# ```
{exec, ...}: let
assertMsg = pred: msg: pred || builtins.throw msg;
hasSuffix = suffix: content: let
lenContent = builtins.stringLength content;
lenSuffix = builtins.stringLength suffix;
in
lenContent >= lenSuffix && builtins.substring (lenContent - lenSuffix) lenContent content == suffix;
in {
rageImportDecrypt = identities: nixFile:
assert assertMsg (builtins.isPath nixFile) "The file to decrypt must be given as a path to prevent impurity.";
assert assertMsg (hasSuffix ".nix.age" nixFile) "The content of the decrypted file must be a nix expression and should therefore end in .nix.age";
exec (["rage" "-d"] ++ (builtins.concatMap (x: ["-i" x]) identities) ++ [nixFile]);
}