mirror of
https://github.com/ryantm/agenix.git
synced 2024-09-11 06:05:38 +03:00
Merge pull request #146 from n8henrie/issue_143
Skip missing or unreadable keys
This commit is contained in:
commit
6053c559c5
@ -54,8 +54,6 @@ with lib; let
|
|||||||
chown :${chownGroup} "${cfg.secretsMountPoint}" "${cfg.secretsMountPoint}/$_agenix_generation"
|
chown :${chownGroup} "${cfg.secretsMountPoint}" "${cfg.secretsMountPoint}/$_agenix_generation"
|
||||||
'';
|
'';
|
||||||
|
|
||||||
identities = builtins.concatStringsSep " " (map (path: "-i ${path}") cfg.identityPaths);
|
|
||||||
|
|
||||||
setTruePath = secretType: ''
|
setTruePath = secretType: ''
|
||||||
${
|
${
|
||||||
if secretType.symlink
|
if secretType.symlink
|
||||||
@ -72,13 +70,23 @@ with lib; let
|
|||||||
${setTruePath secretType}
|
${setTruePath secretType}
|
||||||
echo "decrypting '${secretType.file}' to '$_truePath'..."
|
echo "decrypting '${secretType.file}' to '$_truePath'..."
|
||||||
TMP_FILE="$_truePath.tmp"
|
TMP_FILE="$_truePath.tmp"
|
||||||
|
|
||||||
|
IDENTITIES=()
|
||||||
|
for identity in ${toString cfg.identityPaths}; do
|
||||||
|
test -r "$identity" || continue
|
||||||
|
IDENTITIES+=(-i)
|
||||||
|
IDENTITIES+=("$identity")
|
||||||
|
done
|
||||||
|
|
||||||
|
test "''${#IDENTITIES[@]}" -eq 0 && echo "[agenix] WARNING: no readable identities found!"
|
||||||
|
|
||||||
mkdir -p "$(dirname "$_truePath")"
|
mkdir -p "$(dirname "$_truePath")"
|
||||||
[ "${secretType.path}" != "${cfg.secretsDir}/${secretType.name}" ] && mkdir -p "$(dirname "${secretType.path}")"
|
[ "${secretType.path}" != "${cfg.secretsDir}/${secretType.name}" ] && mkdir -p "$(dirname "${secretType.path}")"
|
||||||
(
|
(
|
||||||
umask u=r,g=,o=
|
umask u=r,g=,o=
|
||||||
test -f "${secretType.file}" || echo '[agenix] WARNING: encrypted file ${secretType.file} does not exist!'
|
test -f "${secretType.file}" || echo '[agenix] WARNING: encrypted file ${secretType.file} does not exist!'
|
||||||
test -d "$(dirname "$TMP_FILE")" || echo "[agenix] WARNING: $(dirname "$TMP_FILE") does not exist!"
|
test -d "$(dirname "$TMP_FILE")" || echo "[agenix] WARNING: $(dirname "$TMP_FILE") does not exist!"
|
||||||
LANG=${config.i18n.defaultLocale or "C"} ${ageBin} --decrypt ${identities} -o "$TMP_FILE" "${secretType.file}"
|
LANG=${config.i18n.defaultLocale or "C"} ${ageBin} --decrypt "''${IDENTITIES[@]}" -o "$TMP_FILE" "${secretType.file}"
|
||||||
)
|
)
|
||||||
chmod ${secretType.mode} "$TMP_FILE"
|
chmod ${secretType.mode} "$TMP_FILE"
|
||||||
mv -f "$TMP_FILE" "$_truePath"
|
mv -f "$TMP_FILE" "$_truePath"
|
||||||
|
@ -13,6 +13,7 @@ import "${nixpkgs}/nixos/tests/make-test-python.nix" ({pkgs, ...}: {
|
|||||||
nodes.system1 = {
|
nodes.system1 = {
|
||||||
config,
|
config,
|
||||||
lib,
|
lib,
|
||||||
|
options,
|
||||||
...
|
...
|
||||||
}: {
|
}: {
|
||||||
imports = [
|
imports = [
|
||||||
@ -26,6 +27,8 @@ import "${nixpkgs}/nixos/tests/make-test-python.nix" ({pkgs, ...}: {
|
|||||||
file = ../example/passwordfile-user1.age;
|
file = ../example/passwordfile-user1.age;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
age.identityPaths = options.age.identityPaths.default ++ ["/etc/ssh/this_key_wont_exist"];
|
||||||
|
|
||||||
users = {
|
users = {
|
||||||
mutableUsers = false;
|
mutableUsers = false;
|
||||||
|
|
||||||
|
@ -1,6 +1,7 @@
|
|||||||
{
|
{
|
||||||
config,
|
config,
|
||||||
pkgs,
|
pkgs,
|
||||||
|
options,
|
||||||
...
|
...
|
||||||
}: let
|
}: let
|
||||||
secret = "hello";
|
secret = "hello";
|
||||||
@ -18,6 +19,8 @@ in {
|
|||||||
|
|
||||||
services.nix-daemon.enable = true;
|
services.nix-daemon.enable = true;
|
||||||
|
|
||||||
|
age.identityPaths = options.age.identityPaths.default ++ ["/etc/ssh/this_key_wont_exist"];
|
||||||
|
|
||||||
age.secrets.secret1.file = ../example/secret1.age;
|
age.secrets.secret1.file = ../example/secret1.age;
|
||||||
|
|
||||||
environment.systemPackages = [testScript];
|
environment.systemPackages = [testScript];
|
||||||
|
Loading…
Reference in New Issue
Block a user