mirrors/sops-nix
mirrors/sops-nix
1
0
Fork 0
mirror of https://github.com/Mic92/sops-nix.git synced 2025-03-16 21:48:15 +00:00
Code Activity

{nixos,home-manager}: shell escape age key paths

Browse source
This commit is contained in:
Jörg Thalheim 2024-08-12 11:10:45 +02:00 • committed by mergify[bot]
parent 8ae477955d
commit ab2d1ffeb5
2 changed files with 12 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
modules/home-manager/sops.nix
View file

@ -94,18 +94,20 @@ let
manifest = manifestFor "" cfg.secrets; manifest = manifestFor "" cfg.secrets;
escapedAgeKeyFile = lib.escapeShellArg cfg.age.keyFile;
script = toString (pkgs.writeShellScript "sops-nix-user" ((lib.optionalString (cfg.gnupg.home != null) '' script = toString (pkgs.writeShellScript "sops-nix-user" ((lib.optionalString (cfg.gnupg.home != null) ''
export SOPS_GPG_EXEC=${pkgs.gnupg}/bin/gpg export SOPS_GPG_EXEC=${pkgs.gnupg}/bin/gpg
'') '')
+ (lib.optionalString cfg.age.generateKey '' + (lib.optionalString cfg.age.generateKey ''
if [[ ! -f '${cfg.age.keyFile}' ]]; then if [[ ! -f ${escapedAgeKeyFile} ]]; then
echo generating machine-specific age key... echo generating machine-specific age key...
${pkgs.coreutils}/bin/mkdir -p $(${pkgs.coreutils}/bin/dirname ${cfg.age.keyFile}) ${pkgs.coreutils}/bin/mkdir -p $(${pkgs.coreutils}/bin/dirname ${escapedAgeKeyFile})
# age-keygen sets 0600 by default, no need to chmod. # age-keygen sets 0600 by default, no need to chmod.
${pkgs.age}/bin/age-keygen -o ${cfg.age.keyFile} ${pkgs.age}/bin/age-keygen -o ${escapedAgeKeyFile}
fi fi
'' + '' '' + ''
${sops-install-secrets}/bin/sops-install-secrets -ignore-passwd '${manifest}' ${sops-install-secrets}/bin/sops-install-secrets -ignore-passwd ${manifest}
''))); '')));
in { in {
options.sops = { options.sops = {

10
modules/sops/default.nix
View file

@ -344,12 +344,14 @@ in {
supportsDryActivation = true; supportsDryActivation = true;
}); });
generate-age-key = lib.mkIf (cfg.age.generateKey) (lib.stringAfter [] '' generate-age-key = let
if [[ ! -f '${cfg.age.keyFile}' ]]; then escapedKeyFile = lib.escapeShellArg cfg.age.keyFile;
in lib.mkIf cfg.age.generateKey (lib.stringAfter [] ''
if [[ ! -f ${escapedKeyFile} ]]; then
echo generating machine-specific age key... echo generating machine-specific age key...
mkdir -p $(dirname ${cfg.age.keyFile}) mkdir -p $(dirname ${escapedKeyFile})
# age-keygen sets 0600 by default, no need to chmod. # age-keygen sets 0600 by default, no need to chmod.
${pkgs.age}/bin/age-keygen -o ${cfg.age.keyFile} ${pkgs.age}/bin/age-keygen -o ${escapedKeyFile}
fi fi
''); '');
}; };