pkg/sops-nix
1
0
Fork 0
mirror of https://github.com/Mic92/sops-nix.git synced 2026-05-01 19:05:42 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge 1177a6f475 into de5f2d596e

Browse source
This commit is contained in:
Nicolas Dumazet 2026-04-08 15:57:58 +00:00 • committed by GitHub
commit 3c82cbd9fe
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 60 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

97
modules/sops/default.nix
View file

@ -430,56 +430,67 @@ in
];
config = lib.mkMerge [
(lib.mkIf (cfg.secrets != { }) {
assertions =
[
{
assertion =
cfg.gnupg.home != null
|| cfg.gnupg.sshKeyPaths != [ ]
|| cfg.age.keyFile != null
|| cfg.age.sshKeyPaths != [ ];
message = "No key source configured for sops. Either set services.openssh.enable or set sops.age.keyFile or sops.gnupg.home";
}
{
assertion = !(cfg.gnupg.home != null && cfg.gnupg.sshKeyPaths != [ ]);
message = "Exactly one of sops.gnupg.home and sops.gnupg.sshKeyPaths must be set";
}
]
++ lib.optionals cfg.validateSopsFiles (
lib.concatLists (
lib.mapAttrsToList (name: secret: [
{
assertion = secret.uid != null && secret.uid != 0 -> secret.owner == null;
message = "In ${secret.name} exactly one of sops.owner and sops.uid must be set";
}
{
assertion = secret.gid != null && secret.gid != 0 -> secret.group == null;
message = "In ${secret.name} exactly one of sops.group and sops.gid must be set";
}
]) cfg.secrets
)
);
assertions = [
{
assertion =
cfg.gnupg.home != null
|| cfg.gnupg.sshKeyPaths != [ ]
|| cfg.age.keyFile != null
|| cfg.age.sshKeyPaths != [ ];
message = "No key source configured for sops. Either set services.openssh.enable or set sops.age.keyFile or sops.gnupg.home";
}
{
assertion = !(cfg.gnupg.home != null && cfg.gnupg.sshKeyPaths != [ ]);
message = "Exactly one of sops.gnupg.home and sops.gnupg.sshKeyPaths must be set";
}
]
++ lib.optionals cfg.validateSopsFiles (
lib.concatLists (
lib.mapAttrsToList (name: secret: [
{
assertion = secret.uid != null && secret.uid != 0 -> secret.owner == null;
message = "In ${secret.name} exactly one of sops.owner and sops.uid must be set";
}
{
assertion = secret.gid != null && secret.gid != 0 -> secret.group == null;
message = "In ${secret.name} exactly one of sops.group and sops.gid must be set";
}
]) cfg.secrets
)
);
sops.environment.SOPS_GPG_EXEC = lib.mkIf (cfg.gnupg.home != null || cfg.gnupg.sshKeyPaths != [ ]) (
lib.mkDefault "${cfg.gnupg.package}/bin/gpg"
);
# When using sysusers we no longer are started as an activation script because those are started in initrd while sysusers is started later.
systemd.services.sops-install-secrets = lib.mkIf (regularSecrets != { } && cfg.useSystemdActivation) {
wantedBy = [ "sysinit.target" ];
after = [ "local-fs.target" "systemd-sysusers.service" "userborn.service" ];
requiredBy = [ "sysinit-reactivation.target" ];
before = [ "sysinit-reactivation.target" ];
environment = cfg.environment;
unitConfig.DefaultDependencies = "no";
path = cfg.age.plugins;
systemd.services.sops-install-secrets =
lib.mkIf (regularSecrets != { } && cfg.useSystemdActivation)
{
wantedBy = [ "sysinit.target" ];
after = [
"local-fs.target"
"systemd-sysusers.service"
"userborn.service"
];
requiredBy = [ "sysinit-reactivation.target" ];
before = [ "sysinit-reactivation.target" ];
environment = cfg.environment;
unitConfig.DefaultDependencies = "no";
path = cfg.age.plugins;
serviceConfig = {
Type = "oneshot";
ExecStart = [ "${cfg.package}/bin/sops-install-secrets ${manifest}" ];
RemainAfterExit = true;
};
};
serviceConfig = {
Type = "oneshot";
ExecStart = [ "${cfg.package}/bin/sops-install-secrets ${manifest}" ];
RemainAfterExit = true;
};
unitConfig.RequiresMountsFor = lib.concatLists [
(lib.lists.optional (cfg.gnupg.home != null) cfg.gnupg.home)
cfg.gnupg.sshKeyPaths
(lib.lists.optional (cfg.age.keyFile != null) cfg.age.keyFile)
cfg.age.sshKeyPaths
];
};
system.activationScripts = {
setupSecrets = lib.mkIf (regularSecrets != { } && !cfg.useSystemdActivation) (

6
modules/sops/secrets-for-users/default.nix
View file

@ -44,6 +44,12 @@ in
ExecStart = [ "${cfg.package}/bin/sops-install-secrets -ignore-passwd ${manifestForUsers}" ];
RemainAfterExit = true;
};
unitConfig.RequiresMountsFor = lib.concatLists [
(lib.lists.optional (cfg.gnupg.home != null) cfg.gnupg.home)
cfg.gnupg.sshKeyPaths
(lib.lists.optional (cfg.age.keyFile != null) cfg.age.keyFile)
cfg.age.sshKeyPaths
];
};
system.activationScripts = lib.mkIf (secretsForUsers != { } && !useSystemdActivation) {