ryantm/agenix
1
1
Fork 0
mirror of https://github.com/ryantm/agenix.git synced 2024-09-11 06:05:38 +03:00
Code Issues Projects Releases Wiki Activity

Merge pull request #146 from n8henrie/issue_143

Browse Source 
Skip missing or unreadable keys
This commit is contained in:
Ryan Mulligan 2023-02-11 08:54:07 -08:00 committed by GitHub
commit 6053c559c5
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 17 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
modules/age.nix
View File

@ -54,8 +54,6 @@ with lib; let
chown :${chownGroup} "${cfg.secretsMountPoint}" "${cfg.secretsMountPoint}/$_agenix_generation" chown :${chownGroup} "${cfg.secretsMountPoint}" "${cfg.secretsMountPoint}/$_agenix_generation"
''; '';
identities = builtins.concatStringsSep " " (map (path: "-i ${path}") cfg.identityPaths);
setTruePath = secretType: '' setTruePath = secretType: ''
${ ${
if secretType.symlink if secretType.symlink
@ -72,13 +70,23 @@ with lib; let
${setTruePath secretType} ${setTruePath secretType}
echo "decrypting '${secretType.file}' to '$_truePath'..." echo "decrypting '${secretType.file}' to '$_truePath'..."
TMP_FILE="$_truePath.tmp" TMP_FILE="$_truePath.tmp"
IDENTITIES=()
for identity in ${toString cfg.identityPaths}; do
test -r "$identity" || continue
IDENTITIES+=(-i)
IDENTITIES+=("$identity")
done
test "''${#IDENTITIES[@]}" -eq 0 && echo "[agenix] WARNING: no readable identities found!"
mkdir -p "$(dirname "$_truePath")" mkdir -p "$(dirname "$_truePath")"
[ "${secretType.path}" != "${cfg.secretsDir}/${secretType.name}" ] && mkdir -p "$(dirname "${secretType.path}")" [ "${secretType.path}" != "${cfg.secretsDir}/${secretType.name}" ] && mkdir -p "$(dirname "${secretType.path}")"
( (
umask u=r,g=,o= umask u=r,g=,o=
test -f "${secretType.file}" || echo '[agenix] WARNING: encrypted file ${secretType.file} does not exist!' test -f "${secretType.file}" || echo '[agenix] WARNING: encrypted file ${secretType.file} does not exist!'
test -d "$(dirname "$TMP_FILE")" || echo "[agenix] WARNING: $(dirname "$TMP_FILE") does not exist!" test -d "$(dirname "$TMP_FILE")" || echo "[agenix] WARNING: $(dirname "$TMP_FILE") does not exist!"
LANG=${config.i18n.defaultLocale or "C"} ${ageBin} --decrypt ${identities} -o "$TMP_FILE" "${secretType.file}" LANG=${config.i18n.defaultLocale or "C"} ${ageBin} --decrypt "''${IDENTITIES[@]}" -o "$TMP_FILE" "${secretType.file}"
) )
chmod ${secretType.mode} "$TMP_FILE" chmod ${secretType.mode} "$TMP_FILE"
mv -f "$TMP_FILE" "$_truePath" mv -f "$TMP_FILE" "$_truePath"

3
test/integration.nix
View File

@ -13,6 +13,7 @@ import "${nixpkgs}/nixos/tests/make-test-python.nix" ({pkgs, ...}: {
nodes.system1 = { nodes.system1 = {
config, config,
lib, lib,
options,
... ...
}: { }: {
imports = [ imports = [
@ -26,6 +27,8 @@ import "${nixpkgs}/nixos/tests/make-test-python.nix" ({pkgs, ...}: {
file = ../example/passwordfile-user1.age; file = ../example/passwordfile-user1.age;
}; };
age.identityPaths = options.age.identityPaths.default ++ ["/etc/ssh/this_key_wont_exist"];
users = { users = {
mutableUsers = false; mutableUsers = false;

3
test/integration_darwin.nix
View File

@ -1,6 +1,7 @@
{ {
config, config,
pkgs, pkgs,
options,
... ...
}: let }: let
secret = "hello"; secret = "hello";
@ -18,6 +19,8 @@ in {
services.nix-daemon.enable = true; services.nix-daemon.enable = true;
age.identityPaths = options.age.identityPaths.default ++ ["/etc/ssh/this_key_wont_exist"];
age.secrets.secret1.file = ../example/secret1.age; age.secrets.secret1.file = ../example/secret1.age;
environment.systemPackages = [testScript]; environment.systemPackages = [testScript];