secrets-bao: inline configchanges, remove file, make configChanges attrs

flakes/secrets-bao/flake.nix

@@ -5,13 +5,32 @@
 
   outputs = { ... }:
     {
-      nixosModules = {
+      lib = {
-        default = {
+        applyConfigChanges = secrets:
-          imports = [
+          let
-            (import ./nixos-module.nix)
+            substitute = secretPath: value:
-            (import ./nixos-configchanges.nix)
+              if builtins.isAttrs value then
-          ];
+                builtins.mapAttrs (_: v: substitute secretPath v) value
+              else if builtins.isList value then
+                map (v: substitute secretPath v) value
+              else if builtins.isString value then
+                builtins.replaceStrings [ "$SECRET_PATH" ] [ secretPath ] value
+              else
+                value;
+
+            fragments = builtins.attrValues (builtins.mapAttrs (
+              name: s:
+              let
+                secretPath = s.path or ("/run/secrets/" + name);
+              in
+              substitute secretPath (s.configChanges or { })
+            ) secrets);
+          in
+          builtins.foldl' (acc: v: acc // v) { } fragments;
       };
+
+      nixosModules = {
+        default = import ./nixos-module.nix;
       };
     };
 }

flakes/secrets-bao/nixos-configchanges.nix

@@ -1,10 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.ringofstorms.secretsBao;
-  secrets = cfg.secrets or { };
-in
-{
-  config = lib.mkIf cfg.enable (
-    lib.mkMerge (lib.mapAttrsToList (_: s: s.configChanges { path = s.path; }) secrets)
-  );
-}

flakes/secrets-bao/nixos-module.nix

@@ -371,9 +371,9 @@ in
               };
 
               configChanges = lib.mkOption {
-                type = lib.types.functionTo lib.types.attrs;
+                type = lib.types.attrs;
-                default = { path, ... }: { };
+                default = { };
-                description = "Function that returns extra config given { path = secret.path; }.";
+                description = "Extra config applied when enabled; supports '$SECRET_PATH' string substitution.";
               };
 
               template = lib.mkOption {
@@ -389,13 +389,15 @@ in
     };
   };
 
-  config = lib.mkIf cfg.enable (lib.mkMerge [
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
       {
         assertions = lib.mapAttrsToList (name: s: {
           assertion = (s.template != null) || (s.kvPath != null);
           message = "ringofstorms.secretsBao.secrets.${name} must set either template or kvPath";
         }) cfg.secrets;
 
+
         environment.systemPackages = [
           pkgs.jq
           pkgs.curl
@@ -594,5 +596,7 @@ in
           }
         ) cfg.secrets;
       }
-  ]);
+
+    ]
+  );
 }

hosts/juni/flake.nix

@@ -44,6 +44,7 @@
       nixosConfigurations = {
         "${configuration_name}" = (
            lib.nixosSystem {
+             specialArgs = { inherit inputs; };
              modules = [
               inputs.nixos-hardware.nixosModules.framework-12-13th-gen-intel
               inputs.impermanence.nixosModules.impermanence
@@ -90,27 +91,16 @@
               inputs.common.nixosModules.remote_lio_builds
 
                (
-                { config, ... }:
+                 { inputs, lib, ... }:
-                {
+                 let
-
-                  ringofstorms.secretsBao = {
-                    enable = true;
-                    zitadelKeyPath = "/machine-key.json";
-                    openBaoAddr = "https://sec.joshuabell.xyz";
-                    jwtAuthMountPath = "auth/zitadel-jwt";
-                    openBaoRole = "machines";
-                    zitadelIssuer = "https://sso.joshuabell.xyz";
-                    zitadelProjectId = "344379162166820867";
-                    debugMint = true;
                    secrets = {
                      headscale_auth = {
                        kvPath = "kv/data/machines/home_roaming/headscale_auth";
                        dependencies = [ "tailscaled" ];
-                        configChanges = { path, ... }: {
+                       configChanges = {
-                          services.tailscale.authKeyFile = path;
+                         services.tailscale.authKeyFile = "$SECRET_PATH";
                        };
                      };
-
                      nix2github = {
                        owner = "josh";
                        group = "users";
@@ -132,13 +122,22 @@
                        kvPath = "kv/data/machines/home_roaming/nix2lio";
                      };
                    };
-                  };
+                 in
-
+                 lib.mkMerge [
-                  systemd.services.tailscaled = {
+                   {
-                    after = [ "openbao-secret-headscale_auth.service" ];
+                     ringofstorms.secretsBao = {
-                    requires = [ "openbao-secret-headscale_auth.service" ];
+                       enable = true;
+                       zitadelKeyPath = "/machine-key.json";
+                       openBaoAddr = "https://sec.joshuabell.xyz";
+                       jwtAuthMountPath = "auth/zitadel-jwt";
+                       openBaoRole = "machines";
+                       zitadelIssuer = "https://sso.joshuabell.xyz";
+                       zitadelProjectId = "344379162166820867";
+                       inherit secrets;
                      };
                    }
+                   (inputs.secrets-bao.lib.applyConfigChanges secrets)
+                 ]
                )
 
               # inputs.beszel.nixosModules.agent