pkg/sops-nix
1
0
Fork 0
mirror of https://github.com/Mic92/sops-nix.git synced 2026-01-13 10:07:55 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

feat: add age plugin and fido2 hmac support

Browse source 
Co-authored-by: brianmcgee <brian@41north.dev>
This commit is contained in:
NovaViper 2025-04-23 17:33:01 -05:00 • committed by Jörg Thalheim
parent d7593b87b0
commit 899e202643
4 changed files with 31 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
modules/home-manager/sops.nix
View file

@ -249,6 +249,14 @@ in
'';
};
plugins = lib.mkOption {
type = lib.types.listOf lib.types.package;
default = [ ];
description = ''
List of plugins to use for sops decryption.
'';
};
generateKey = lib.mkOption {
type = lib.types.bool;
default = false;
@ -357,6 +365,8 @@ in
))
];
PATH = lib.makeBinPath cfg.age.plugins;
QUBES_GPG_DOMAIN = lib.mkIf cfg.gnupg.qubes-split-gpg.enable (
lib.mkDefault cfg.gnupg.qubes-split-gpg.domain
);

9
modules/nix-darwin/default.nix
View file

@ -308,6 +308,14 @@ in
Paths to ssh keys added as age keys during sops description.
'';
};
plugins = lib.mkOption {
type = lib.types.listOf lib.types.package;
default = [ ];
description = ''
List of plugins to use for sops decryption.
'';
};
};
gnupg = {
@ -395,6 +403,7 @@ in
sops.environment.SOPS_GPG_EXEC = lib.mkIf (cfg.gnupg.home != null || cfg.gnupg.sshKeyPaths != [ ]) (
lib.mkDefault "${cfg.gnupg.package}/bin/gpg"
);
sops.environment.PATH = lib.mkIf (cfg.age.plugins != [ ]) (lib.makeBinPath cfg.age.plugins);
}
];
}

10
modules/sops/default.nix
View file

@ -39,6 +39,7 @@ let
# [1] https://github.com/getsops/sops/pull/1692
cfg = lib.recursiveUpdate cfg {
environment.HOME = "/var/empty";
environment.PATH = lib.makeBinPath cfg.age.plugins;
};
inherit lib;
};
@ -342,6 +343,14 @@ in
'';
};
plugins = lib.mkOption {
type = lib.types.listOf lib.types.package;
default = [ ];
description = ''
List of plugins to use for sops decryption.
'';
};
generateKey = lib.mkOption {
type = lib.types.bool;
default = false;
@ -463,6 +472,7 @@ in
before = [ "sysinit-reactivation.target" ];
environment = cfg.environment;
unitConfig.DefaultDependencies = "no";
path = cfg.age.plugins;
serviceConfig = {
Type = "oneshot";

2
modules/sops/secrets-for-users/default.nix
View file

@ -17,6 +17,7 @@ let
# See also the default NixOS module.
cfg = lib.recursiveUpdate cfg {
environment.HOME = "/var/empty";
environment.PATH = lib.makeBinPath cfg.age.plugins;
};
inherit lib;
};
@ -36,6 +37,7 @@ in
before = [ "systemd-sysusers.service" ];
environment = cfg.environment;
unitConfig.DefaultDependencies = "no";
path = cfg.age.plugins;
serviceConfig = {
Type = "oneshot";