danvics/selfhostblocks
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Refactor secret replacement script and arguments

Browse source 
Loop outside of Python.
This commit is contained in:
Dmitry 2026-06-04 11:02:26 +01:00
parent bbb47e24c3
commit f618cf0294
1 changed files with 17 additions and 26 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

43
lib/default.nix
View file

@ -81,43 +81,33 @@ let
generatedReplacements = map genReplacement replacements; generatedReplacements = map genReplacement replacements;
writeSecretFiles = concatMapStringsSep "\n" (pattern: '' writeSecretFiles = concatMapStringsSep "\n" (pattern: ''
printf '%s' "${pattern.value}" > "$tmpDir/secret-${pattern.name}" printf '%s' "${pattern.value}" > "$tmpDir"/${escapeShellArg ("secret-" + pattern.name)}
'') generatedReplacements; '') generatedReplacements;
replacementArgs = concatMapStringsSep " " ( replaceCommands = concatMapStringsSep "\n" (pattern: ''
pattern: "${escapeShellArg pattern.name} \"$tmpDir/secret-${pattern.name}\"" ${replaceScript} \
) generatedReplacements; --file ${escapeShellArg resultPath} \
--marker ${escapeShellArg pattern.name} \
--secret-file "$tmpDir"/${escapeShellArg ("secret-" + pattern.name)}
'') generatedReplacements;
replaceScript = pkgs.writers.writePython3 "replace-secrets" { } '' replaceScript = pkgs.writers.writePython3 "replace-secret" { } ''
import argparse import argparse
import pathlib import pathlib
def parse_args() -> argparse.Namespace: def parse_args() -> argparse.Namespace:
parser = argparse.ArgumentParser() parser = argparse.ArgumentParser()
parser.add_argument("template_path", type=pathlib.Path) parser.add_argument("--file", required=True, type=pathlib.Path)
parser.add_argument("result_path", type=pathlib.Path) parser.add_argument("--marker", required=True)
parser.add_argument( parser.add_argument("--secret-file", required=True, type=pathlib.Path)
"replacements", return parser.parse_args()
nargs="*",
help="marker/file pairs: MARKER SECRET_FILE [MARKER SECRET_FILE ...]",
)
args = parser.parse_args()
if len(args.replacements) % 2 != 0:
parser.error("replacements must be marker/file pairs")
return args
args = parse_args() args = parse_args()
content = args.template_path.read_text() content = args.file.read_text()
secret = args.secret_file.read_text()
for marker, secret_path in zip(args.replacements[0::2], args.replacements[1::2]): args.file.write_text(content.replace(args.marker, secret))
secret = pathlib.Path(secret_path).read_text()
content = content.replace(marker, secret)
args.result_path.write_text(content)
''; '';
replaceCmd = replaceCmd =
@ -127,8 +117,9 @@ let
'' ''
tmpDir=$(mktemp -d) tmpDir=$(mktemp -d)
trap 'rm -rf "$tmpDir"' EXIT trap 'rm -rf "$tmpDir"' EXIT
cat ${escapeShellArg templatePath} > ${escapeShellArg resultPath}
${writeSecretFiles} ${writeSecretFiles}
${replaceScript} ${escapeShellArg templatePath} ${escapeShellArg resultPath} ${replacementArgs} ${replaceCommands}
''; '';
in in
'' ''