pkg/sops-nix
1
0
Fork 0
mirror of https://github.com/Mic92/sops-nix.git synced 2025-12-26 14:14:58 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

feat: add age plugin and fido2 hmac support

Browse source 
Co-authored-by: brianmcgee <brian@41north.dev>
This commit is contained in:
NovaViper 2025-04-23 17:33:01 -05:00
parent 94d8af61d8
commit 88dd7997d9
No known key found for this signature in database
GPG key ID: 6A1809C2B88EDBBF
4 changed files with 26 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
flake.nix
View file

@ -60,6 +60,10 @@
;
# backward compatibility
inherit (prev) ssh-to-pgp;
sops = prev.sops.withAgePlugins (p: [
p.age-plugin-fido2-hmac
]);
};
nixosModules = {
sops = ./modules/sops;

10
modules/home-manager/sops.nix
View file

@ -249,6 +249,14 @@ in
'';
};
plugins = lib.mkOption {
type = lib.types.listOf lib.types.package;
default = [ ];
description = ''
List of plugins to use for sops decryption.
'';
};
generateKey = lib.mkOption {
type = lib.types.bool;
default = false;
@ -348,6 +356,8 @@ in
))
];
PATH = lib.makeBinPath cfg.age.plugins;
QUBES_GPG_DOMAIN = lib.mkIf cfg.gnupg.qubes-split-gpg.enable (
lib.mkDefault cfg.gnupg.qubes-split-gpg.domain
);

10
modules/sops/default.nix
View file

@ -39,6 +39,7 @@ let
# [1] https://github.com/getsops/sops/pull/1692
cfg = lib.recursiveUpdate cfg {
environment.HOME = "/var/empty";
environment.PATH = lib.makeBinPath cfg.age.plugins;
};
inherit lib;
};
@ -342,6 +343,14 @@ in
'';
};
plugins = lib.mkOption {
type = lib.types.listOf lib.types.package;
default = [ ];
description = ''
List of plugins to use for sops decryption.
'';
};
generateKey = lib.mkOption {
type = lib.types.bool;
default = false;
@ -453,6 +462,7 @@ in
before = [ "sysinit-reactivation.target" ];
environment = cfg.environment;
unitConfig.DefaultDependencies = "no";
path = cfg.age.plugins;
serviceConfig = {
Type = "oneshot";

2
modules/sops/secrets-for-users/default.nix
View file

@ -17,6 +17,7 @@ let
# See also the default NixOS module.
cfg = lib.recursiveUpdate cfg {
environment.HOME = "/var/empty";
environment.PATH = lib.makeBinPath cfg.age.plugins;
};
inherit lib;
};
@ -36,6 +37,7 @@ in
before = [ "systemd-sysusers.service" ];
environment = cfg.environment;
unitConfig.DefaultDependencies = "no";
path = cfg.age.plugins;
serviceConfig = {
Type = "oneshot";