summaryrefslogtreecommitdiff
path: root/modules/default.nix
diff options
context:
space:
mode:
Diffstat (limited to 'modules/default.nix')
-rw-r--r--modules/default.nix52
1 files changed, 33 insertions, 19 deletions
diff --git a/modules/default.nix b/modules/default.nix
index 8c48542..d2f62f8 100644
--- a/modules/default.nix
+++ b/modules/default.nix
@@ -53,16 +53,21 @@ let
maybe0 = s: if s == "root" then "0" else escapeShellArg s;
secret = pathOf name;
in ''
- (
- set -eu
- trap "rm -f ${escapeShellArg path}; echo decrypting secret ${escapeShellArg name} failed" ERR
- umask 022
- mkdir -p ${escapeShellArg (dirOf path)}
- umask 377
- ${pkgs.age}/bin/age -d ${hostKeyArgs} -o ${escapeShellArg path} ${secret}
- chown ${maybe0 owner}:${maybe0 group} ${path}
- chmod ${escapeShellArg mode} ${escapeShellArg path}
- )
+ if [ "$NIXOS_ACTION" = dry-activate ]; then
+ echo would decrypt secret ${escapeShellArg name}
+ else
+ echo decrypting secret ${escapeShellArg name}
+ (
+ set -eu
+ trap "rm -f ${escapeShellArg path}; echo decrypting secret ${escapeShellArg name} failed" ERR
+ umask 022
+ mkdir -p ${escapeShellArg (dirOf path)}
+ umask 377
+ ${pkgs.age}/bin/age -d ${hostKeyArgs} -o ${escapeShellArg path} ${secret}
+ chown ${maybe0 owner}:${maybe0 group} ${path}
+ chmod ${escapeShellArg mode} ${escapeShellArg path}
+ )
+ fi
'';
activate = secrets: concatStringsSep "\n" (mapAttrsToList decrypt secrets);
@@ -196,18 +201,27 @@ in
system.activationScripts = {
# activate root secrets very early so we have access to them in the activation scripts
- seacrit-root = stringAfter [ "specialfs" ] ''
- rm -rf /run/seacrit
- mkdir -m 0755 /run/seacrit
- ${activate (filterAttrs (_: s: isRootSecret s) cfg.secrets)}
- '';
+ seacrit-root = {
+ # deps = [ "specialfs" ];
+ text = ''
+ if [ "$NIXOS_ACTION" != dry-activate ]; then
+ rm -rf /run/seacrit
+ mkdir -m 0755 /run/seacrit
+ fi
+ ${activate (filterAttrs (_: s: isRootSecret s) cfg.secrets)}
+ '';
+ supportsDryActivation = true;
+ };
users.deps = [ "seacrit-root" ];
- groups.deps = [ "seacrit-root" ];
- seacrit = stringAfter [ "users" "groups" ] ''
- ${activate (filterAttrs (_: s: ! isRootSecret s) cfg.secrets)}
- '';
+ seacrit = {
+ deps = [ "users" ];
+ text = ''
+ ${activate (filterAttrs (_: s: ! isRootSecret s) cfg.secrets)}
+ '';
+ supportsDryActivation = true;
+ };
};
};
}