mirrors/sops-nix
1
0
Fork 0
mirror of https://github.com/Mic92/sops-nix.git synced 2024-12-14 11:57:52 +00:00
Code Activity

{nixos,home-manager}: shell escape age key paths

Browse source
This commit is contained in:
Jörg Thalheim 2024-08-12 11:10:45 +02:00 committed by mergify[bot]
parent 8ae477955d
commit ab2d1ffeb5
2 changed files with 12 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
modules/home-manager/sops.nix
View file

@ -94,18 +94,20 @@ let
manifest = manifestFor "" cfg.secrets;
escapedAgeKeyFile = lib.escapeShellArg cfg.age.keyFile;
script = toString (pkgs.writeShellScript "sops-nix-user" ((lib.optionalString (cfg.gnupg.home != null) ''
export SOPS_GPG_EXEC=${pkgs.gnupg}/bin/gpg
'')
+ (lib.optionalString cfg.age.generateKey ''
if [[ ! -f '${cfg.age.keyFile}' ]]; then
if [[ ! -f ${escapedAgeKeyFile} ]]; then
echo generating machine-specific age key...
${pkgs.coreutils}/bin/mkdir -p $(${pkgs.coreutils}/bin/dirname ${cfg.age.keyFile})
${pkgs.coreutils}/bin/mkdir -p $(${pkgs.coreutils}/bin/dirname ${escapedAgeKeyFile})
# age-keygen sets 0600 by default, no need to chmod.
${pkgs.age}/bin/age-keygen -o ${cfg.age.keyFile}
${pkgs.age}/bin/age-keygen -o ${escapedAgeKeyFile}
fi
'' + ''
${sops-install-secrets}/bin/sops-install-secrets -ignore-passwd '${manifest}'
${sops-install-secrets}/bin/sops-install-secrets -ignore-passwd ${manifest}
'')));
in {
options.sops = {

10
modules/sops/default.nix
View file

@ -344,12 +344,14 @@ in {
supportsDryActivation = true;
});
generate-age-key = lib.mkIf (cfg.age.generateKey) (lib.stringAfter [] ''
if [[ ! -f '${cfg.age.keyFile}' ]]; then
generate-age-key = let
escapedKeyFile = lib.escapeShellArg cfg.age.keyFile;
in lib.mkIf cfg.age.generateKey (lib.stringAfter [] ''
if [[ ! -f ${escapedKeyFile} ]]; then
echo generating machine-specific age key...
mkdir -p $(dirname ${cfg.age.keyFile})
mkdir -p $(dirname ${escapedKeyFile})
# age-keygen sets 0600 by default, no need to chmod.
${pkgs.age}/bin/age-keygen -o ${cfg.age.keyFile}
${pkgs.age}/bin/age-keygen -o ${escapedKeyFile}
fi
'');
};