ringofstorms/dotfiles
ringofstorms/dotfiles
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Use conditional identityFile in SSH host configs

Browse source
This commit is contained in:
RingOfStorms (Joshua Bell) 2026-01-06 16:11:04 -06:00
parent aef5e24b12
commit b8ae608af5
3 changed files with 62 additions and 67 deletions
Download patch file Download diff file Expand all files Collapse all files

29
flakes/secrets-bao/flake.nix
View file

@ -27,6 +27,35 @@
) secrets);
in
builtins.foldl' (acc: v: acc // v) { } fragments;
applyHmChanges = secrets:
let
substitute = secretPath: value:
if builtins.isAttrs value then
builtins.mapAttrs (_: v: substitute secretPath v) value
else if builtins.isList value then
map (v: substitute secretPath v) value
else if builtins.isString value then
builtins.replaceStrings [ "$SECRET_PATH" ] [ secretPath ] value
else
value;
fragments = builtins.attrValues (builtins.mapAttrs (
name: s:
let
secretPath = s.path or ("/run/secrets/" + name);
in
substitute secretPath (s.hmChanges or { })
) secrets);
merged = builtins.foldl' (acc: v: acc // v) { } fragments;
in
if merged == { } then
{ }
else
{
home-manager.sharedModules = [ (_: merged) ];
};
};
nixosModules = {

25
flakes/secrets-bao/nixos-module.nix
View file

@ -19,7 +19,7 @@ let
request_roles="${if cfg.requestProjectRoles then "true" else "false"}"
debug() {
if [ "$debug_enabled" = "true" ] || [ -n "${DEBUG:-}" ]; then
if [ "$debug_enabled" = "true" ] || [ -n "${"DEBUG:-"}" ]; then
echo "[zitadel-mint] $*" >&2
fi
}
@ -157,7 +157,7 @@ let
debug "selected=$token_source"
if [ "${toString cfg.debugMint}" = "true" ] || [ -n "${DEBUG:-}" ]; then
if [ "${toString cfg.debugMint}" = "true" ] || [ -n "${"DEBUG:-"}" ]; then
payload="$(decode_payload "$token")"
if [ -n "$payload" ]; then
debug "jwt.payload=$(echo "$payload" | ${pkgs.jq}/bin/jq -c '.')"
@ -354,7 +354,7 @@ in
kvPath = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = null;
default = "kv/data/machines/home_roaming/${name}";
description = "KV v2 secret API path (ex: kv/data/machines/home_roaming/nix2github).";
};
@ -373,7 +373,13 @@ in
configChanges = lib.mkOption {
type = lib.types.attrs;
default = { };
description = "Extra config applied when enabled; supports '$SECRET_PATH' string substitution.";
description = "Extra NixOS config applied when enabled; supports '$SECRET_PATH' string substitution.";
};
hmChanges = lib.mkOption {
type = lib.types.attrs;
default = { };
description = "Extra Home Manager config applied when enabled; supports '$SECRET_PATH' string substitution.";
};
template = lib.mkOption {
@ -397,7 +403,6 @@ in
message = "ringofstorms.secretsBao.secrets.${name} must set either template or kvPath";
}) cfg.secrets;
environment.systemPackages = [
pkgs.jq
pkgs.curl
@ -578,10 +583,12 @@ in
exit 1
fi
${lib.concatStringsSep "\n" (map (svc: ''
echo "Restarting ${svc} due to secret ${name}" >&2
systemctl try-restart ${lib.escapeShellArg (svc + ".service")} || true
'') secret.dependencies)}
${lib.concatStringsSep "\n" (
map (svc: ''
echo "Restarting ${svc} due to secret ${name}" >&2
systemctl try-restart ${lib.escapeShellArg (svc + ".service")} || true
'') secret.dependencies
)}
'';
};
}