27 lines
658 B
Nix
27 lines
658 B
Nix
{ pkgs, ... }:
|
|
|
|
let
|
|
thisDir = ./.;
|
|
|
|
unlocker = pkgs.writeScriptBin "unlocker" ''
|
|
#!${pkgs.bash}/bin/bash
|
|
set -euo pipefail
|
|
if [[ -f "${thisDir}/secrets.age" && -f "${config.users.users."me".home}/.ssh/id_ed25519" ]]; then
|
|
${pkgs.age}/bin/age -d -i "${config.users.users."me".home}/.ssh/id_ed25519" "${thisDir}/secrets.age"
|
|
end
|
|
'';
|
|
in
|
|
{
|
|
environment.systemPackages = [ unlocker ];
|
|
|
|
systemd.services.unlocker = {
|
|
description = "Secrets manager";
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
StandardOutput = "file:/run/secrets.env";
|
|
RemainAfterExit = true;
|
|
};
|
|
script = "${unlocker}/bin/unlocker";
|
|
};
|
|
}
|