pkg/sops-nix
1
0
Fork 0
mirror of https://github.com/Mic92/sops-nix.git synced 2026-07-17 14:35:25 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

fix home-manager module

Browse source
This commit is contained in:
Pablo Ovelleiro Corral 2025-01-15 16:00:53 +01:00 • committed by Jörg Thalheim
parent 7eb645636c
commit 1f8e8fcf3f
2 changed files with 29 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

73
modules/home-manager/sops.nix
View file

@ -294,51 +294,34 @@ in
}; };
config = lib.mkIf (cfg.secrets != { }) { config = lib.mkIf (cfg.secrets != { }) {
assertions = assertions = [
[ {
{ assertion =
assertion = cfg.gnupg.home != null
cfg.gnupg.home != null || cfg.gnupg.sshKeyPaths != [ ]
|| cfg.gnupg.sshKeyPaths != [ ] || cfg.gnupg.qubes-split-gpg.enable == true
|| cfg.gnupg.qubes-split-gpg.enable == true || cfg.age.keyFile != null
|| cfg.age.keyFile != null || cfg.age.sshKeyPaths != [ ];
|| cfg.age.sshKeyPaths != [ ]; message = "No key source configured for sops. Either set services.openssh.enable or set sops.age.keyFile or sops.gnupg.home or sops.gnupg.qubes-split-gpg.enable";
message = "No key source configured for sops. Either set services.openssh.enable or set sops.age.keyFile or sops.gnupg.home or sops.gnupg.qubes-split-gpg.enable"; }
} {
{ assertion =
assertion = !(cfg.gnupg.home != null && cfg.gnupg.sshKeyPaths != [ ])
!(cfg.gnupg.home != null && cfg.gnupg.sshKeyPaths != [ ]) && !(cfg.gnupg.home != null && cfg.gnupg.qubes-split-gpg.enable == true)
&& !(cfg.gnupg.home != null && cfg.gnupg.qubes-split-gpg.enable == true) && !(cfg.gnupg.sshKeyPaths != [ ] && cfg.gnupg.qubes-split-gpg.enable == true);
&& !(cfg.gnupg.sshKeyPaths != [ ] && cfg.gnupg.qubes-split-gpg.enable == true); message = "Exactly one of sops.gnupg.home, sops.gnupg.qubes-split-gpg.enable and sops.gnupg.sshKeyPaths must be set";
message = "Exactly one of sops.gnupg.home, sops.gnupg.qubes-split-gpg.enable and sops.gnupg.sshKeyPaths must be set"; }
} {
{ assertion =
assertion = cfg.gnupg.qubes-split-gpg.enable == false
cfg.gnupg.qubes-split-gpg.enable == false || (
|| ( cfg.gnupg.qubes-split-gpg.enable == true
cfg.gnupg.qubes-split-gpg.enable == true && cfg.gnupg.qubes-split-gpg.domain != null
&& cfg.gnupg.qubes-split-gpg.domain != null && cfg.gnupg.qubes-split-gpg.domain != ""
&& cfg.gnupg.qubes-split-gpg.domain != "" );
); message = "sops.gnupg.qubes-split-gpg.domain is required when sops.gnupg.qubes-split-gpg.enable is set to true";
message = "sops.gnupg.qubes-split-gpg.domain is required when sops.gnupg.qubes-split-gpg.enable is set to true"; }
} ];
]
++ lib.optionals cfg.validateSopsFiles (
lib.concatLists (
lib.mapAttrsToList (name: secret: [
{
assertion = builtins.pathExists secret.sopsFile;
message = "Cannot find path '${secret.sopsFile}' set in sops.secrets.${lib.strings.escapeNixIdentifier name}.sopsFile";
}
{
assertion =
builtins.isPath secret.sopsFile
|| (builtins.isString secret.sopsFile && lib.hasPrefix builtins.storeDir secret.sopsFile);
message = "'${secret.sopsFile}' is not in the Nix store. Either add it to the Nix store or set sops.validateSopsFiles to false";
}
]) cfg.secrets
)
);
home.sessionVariables = lib.mkIf cfg.gnupg.qubes-split-gpg.enable { home.sessionVariables = lib.mkIf cfg.gnupg.qubes-split-gpg.enable {
# TODO: Add this package to nixpkgs and use it from the store # TODO: Add this package to nixpkgs and use it from the store

2
modules/sops/manifest-for.nix
View file

@ -24,7 +24,7 @@ let
) [ ] (builtins.attrValues secrets); ) [ ] (builtins.attrValues secrets);
in in
if failedAssertions != [ ] then if cfg.validateSopsFiles && failedAssertions != [ ] then
throw "\nFailed assertions:\n${lib.concatStringsSep "\n" (map (x: "- ${x}") failedAssertions)}" throw "\nFailed assertions:\n${lib.concatStringsSep "\n" (map (x: "- ${x}") failedAssertions)}"
else else
writeTextFile { writeTextFile {