1
1
mirror of https://github.com/ryantm/agenix.git synced 2024-08-16 17:40:36 +03:00

Compare commits

...

4 Commits

Author SHA1 Message Date
oluceps
7224029c6a
Merge 2b558e9af1 into 8d37c5bdea 2024-05-11 15:39:17 +02:00
Nathan Henrie
8d37c5bdea
Merge pull request #259 from hansemschnokeloch/patch-1
Fix typo
2024-05-09 15:32:35 -06:00
hansemschnokeloch
63a57d8dfb
Fix typo 2024-05-09 22:25:29 +02:00
oluceps
2b558e9af1
feat: works with sysuser
fix: darwin compatible

chore: reformat

fix: infrec

chore: clean logic

Co-authored-by: Cole Helbling <cole.e.helbling@outlook.com>
2024-04-30 06:27:40 +00:00
2 changed files with 56 additions and 29 deletions

View File

@ -445,7 +445,7 @@ Example:
#### `age.secrets.<name>.symlink`
`age.secrets.<name>.symlink` is a boolean. If true (the default),
secrets are symlinked to `age.secrets.<name>.path`. If false, secerts
secrets are symlinked to `age.secrets.<name>.path`. If false, secrets
are copied to `age.secrets.<name>.path`. Usually, you want to keep
this as true, because it secure cleanup of secrets no longer
used. (The symlink will still be there, but it will be broken.) If

View File

@ -14,6 +14,11 @@ with lib; let
users = config.users.users;
sysusersEnabled =
if isDarwin
then false
else options.systemd ? sysusers && config.systemd.sysusers.enable;
mountCommand =
if isDarwin
then ''
@ -261,44 +266,66 @@ in {
}
];
}
(optionalAttrs (!isDarwin) {
# When using sysusers we no longer be started as an activation script
# because those are started in initrd while sysusers is started later.
systemd.services.agenix-install-secrets = mkIf sysusersEnabled {
wantedBy = ["sysinit.target"];
after = ["systemd-sysusers.service"];
unitConfig.DefaultDependencies = "no";
serviceConfig = {
Type = "oneshot";
ExecStart = pkgs.writeShellScript "agenix-install" (
builtins.concatStringsSep "\n" [
newGeneration
installSecrets
chownSecrets
]
);
RemainAfterExit = true;
};
};
# Create a new directory full of secrets for symlinking (this helps
# ensure removed secrets are actually removed, or at least become
# invalid symlinks).
system.activationScripts.agenixNewGeneration = {
text = newGeneration;
deps = [
"specialfs"
];
};
system.activationScripts = mkIf (!sysusersEnabled) {
agenixNewGeneration = {
text = newGeneration;
deps = [
"specialfs"
];
};
system.activationScripts.agenixInstall = {
text = installSecrets;
deps = [
"agenixNewGeneration"
"specialfs"
];
};
agenixInstall = {
text = installSecrets;
deps = [
"agenixNewGeneration"
"specialfs"
];
};
# So user passwords can be encrypted.
system.activationScripts.users.deps = ["agenixInstall"];
# So user passwords can be encrypted.
users.deps = ["agenixInstall"];
# Change ownership and group after users and groups are made.
system.activationScripts.agenixChown = {
text = chownSecrets;
deps = [
"users"
"groups"
];
};
# Change ownership and group after users and groups are made.
agenixChown = {
text = chownSecrets;
deps = [
"users"
"groups"
];
};
# So other activation scripts can depend on agenix being done.
system.activationScripts.agenix = {
text = "";
deps = ["agenixChown"];
# So other activation scripts can depend on agenix being done.
agenix = {
text = "";
deps = ["agenixChown"];
};
};
})
(optionalAttrs isDarwin {
launchd.daemons.activate-agenix = {
script = ''