Add secrets and cleanup

2026-07-07 09:25:07 +01:00
parent b5c495a094
commit 822f654d6a
9 changed files with 75 additions and 7 deletions
@@ -0,0 +1,26 @@
+{ pkgs, ... }:
+
+let
+  thisDir = ./.;
+
+  unlocker = pkgs.writeScriptBin "unlocker" ''
+    #!${pkgs.bash}/bin/bash
+    set -euo pipefail
+    if [[ -f "${thisDir}/secrets.age" && -f "${config.users.users."me".home}/.ssh/id_ed25519" ]]; then
+      ${pkgs.age}/bin/age -d -i "${config.users.users."me".home}/.ssh/id_ed25519" "${thisDir}/secrets.age"
+    end
+  '';
+in
+{
+  environment.systemPackages = [ unlocker ];
+
+  systemd.services.unlocker = {
+    description = "Secrets manager";
+    serviceConfig = {
+      Type = "oneshot";
+      StandardOutput = "file:/run/secrets.env";
+      RemainAfterExit = true;
+    };
+    script = "${unlocker}/bin/unlocker";
+  };
+}