59 lines
1.4 KiB
Nix
59 lines
1.4 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
shb,
|
|
...
|
|
}:
|
|
let
|
|
inherit (lib) mapAttrs mkOption;
|
|
inherit (lib.types) attrsOf anything submodule;
|
|
|
|
cfg = config.shb.sops;
|
|
in
|
|
{
|
|
imports = [
|
|
../../lib/module.nix
|
|
];
|
|
|
|
options.shb.sops = {
|
|
secret = mkOption {
|
|
description = "Secret following the [secret contract](./contracts-secret.html).";
|
|
default = { };
|
|
type = attrsOf (
|
|
submodule (
|
|
{ name, options, ... }:
|
|
{
|
|
options = shb.contracts.secret.mkProvider {
|
|
settings = mkOption {
|
|
description = ''
|
|
Settings specific to the Sops provider.
|
|
|
|
This is a passthrough option to set [sops-nix options](https://github.com/Mic92/sops-nix/blob/master/modules/sops/default.nix).
|
|
|
|
Note though that the `mode`, `owner`, `group`, and `restartUnits`
|
|
are managed by the [shb.sops.secret.<name>.request](#blocks-sops-options-shb.sops.secret._name_.request) option.
|
|
'';
|
|
|
|
type = attrsOf anything;
|
|
default = { };
|
|
};
|
|
|
|
resultCfg = {
|
|
path = "/run/secrets/${name}";
|
|
pathText = "/run/secrets/<name>";
|
|
};
|
|
};
|
|
}
|
|
)
|
|
);
|
|
};
|
|
};
|
|
|
|
config = {
|
|
sops.secrets =
|
|
let
|
|
mkSecret = n: secretCfg: secretCfg.request // secretCfg.settings;
|
|
in
|
|
mapAttrs mkSecret cfg.secret;
|
|
};
|
|
}
|