41 lines
1.1 KiB
Nix
41 lines
1.1 KiB
Nix
{ config, pkgs, ... }:
|
|
|
|
let
|
|
thisDir = ./.;
|
|
|
|
unlocker = pkgs.writeScriptBin "unlocker" ''
|
|
#!${pkgs.bash}/bin/bash
|
|
set -euo pipefail
|
|
if [[ -f "${thisDir}/secrets.age" && -f "${config.users.users."me".home}/.ssh/id_ed25519" ]]; then
|
|
install -m 600 /dev/null /run/secrets.env
|
|
${pkgs.age}/bin/age -d -i "${config.users.users."me".home}/.ssh/id_ed25519" "${thisDir}/secrets.age" > /run/secrets.env
|
|
fi
|
|
|
|
mkdir -p /run/secrets/gpg
|
|
|
|
if [[ -f "${thisDir}/gpg.age" ]]; then
|
|
${pkgs.age}/bin/age -d \
|
|
-i "${config.users.users."me".home}/.ssh/id_ed25519" \
|
|
"${thisDir}/gpg.age" | \
|
|
${pkgs.gnupg}/bin/gpg --homedir /run/secrets/gpg --import
|
|
fi
|
|
|
|
chown -R me:users /run/secrets/gpg
|
|
chmod -R 700 /run/secrets/gpg
|
|
'';
|
|
in
|
|
{
|
|
environment.systemPackages = [ unlocker ];
|
|
|
|
systemd.services.unlocker = {
|
|
description = "Secrets manager";
|
|
wantedBy = [ "multi-user.target" ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
User = "root";
|
|
RemainAfterExit = true;
|
|
};
|
|
script = "${unlocker}/bin/unlocker";
|
|
};
|
|
}
|