pkg/sops-nix
1
0
Fork 0
mirror of https://github.com/Mic92/sops-nix.git synced 2026-07-17 14:35:25 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

HM: make secretsMountPoint and symlinkPath configurable

Browse source
This commit is contained in:
MidAutumnMoon 2023-03-20 22:55:10 +08:00 • committed by Shawn8901
parent de6514f8fe
commit 37400a275d
1 changed files with 20 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

23
modules/home-manager/sops.nix
View file

@ -25,7 +25,7 @@ let
path = lib.mkOption { path = lib.mkOption {
type = lib.types.str; type = lib.types.str;
default = "%r/secrets/${name}"; default = "${cfg.defaultSymlinkPath}/${name}";
description = '' description = ''
Path where secrets are symlinked to. Path where secrets are symlinked to.
If the default is kept no other symlink is created. If the default is kept no other symlink is created.
@ -66,8 +66,8 @@ let
name = "manifest${suffix}.json"; name = "manifest${suffix}.json";
text = builtins.toJSON { text = builtins.toJSON {
secrets = builtins.attrValues secrets; secrets = builtins.attrValues secrets;
secretsMountPoint = "%r/secrets.d"; secretsMountPoint = cfg.defaultSecretsMountPoint;
symlinkPath = "%r/secrets"; symlinkPath = cfg.defaultSymlinkPath;
keepGenerations = cfg.keepGenerations; keepGenerations = cfg.keepGenerations;
gnupgHome = cfg.gnupg.home; gnupgHome = cfg.gnupg.home;
sshKeyPaths = cfg.gnupg.sshKeyPaths; sshKeyPaths = cfg.gnupg.sshKeyPaths;
@ -133,6 +133,23 @@ in {
''; '';
}; };
defaultSymlinkPath = lib.mkOption {
type = lib.types.str;
default = "%r/secrets";
description = ''
Default place where the latest generation of decrypt secrets
can be found.
'';
};
defaultSecretsMountPoint = lib.mkOption {
type = lib.types.str;
default = "%r/secrets.d";
description = ''
Default place where generations of decrypted secrets are stored.
'';
};
keepGenerations = lib.mkOption { keepGenerations = lib.mkOption {
type = lib.types.ints.unsigned; type = lib.types.ints.unsigned;
default = 1; default = 1;