secrets: use CLAN_DIR instead of clanCore.clanDir for fact storage
This commit is contained in:
parent
6b7301cefb
commit
0132abc547
|
@ -59,10 +59,10 @@
|
|||
description = ''
|
||||
path to a fact which is generated by the generator
|
||||
'';
|
||||
default = "${config.clanCore.clanDir}/machines/${config.clanCore.machineName}/facts/${fact.config._module.args.name}";
|
||||
default = "machines/${config.clanCore.machineName}/facts/${fact.config._module.args.name}";
|
||||
};
|
||||
value = lib.mkOption {
|
||||
default = builtins.readFile fact.config.path;
|
||||
default = builtins.readFile "${config.clanCore.clanDir}/fact.config.path";
|
||||
};
|
||||
};
|
||||
}));
|
||||
|
|
|
@ -1,6 +1,6 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
let
|
||||
passwordstoreDir = "$HOME/.password-store";
|
||||
passwordstoreDir = "\${PASSWORD_STORE_DIR:-$HOME/.password-store}";
|
||||
in
|
||||
{
|
||||
options.clan.password-store.targetDirectory = lib.mkOption {
|
||||
|
@ -14,8 +14,8 @@ in
|
|||
system.clan.generateSecrets = pkgs.writeScript "generate-secrets" ''
|
||||
#!/bin/sh
|
||||
set -efu
|
||||
set -x # remove for prod
|
||||
|
||||
test -d "$CLAN_DIR"
|
||||
PATH=${lib.makeBinPath [
|
||||
pkgs.pass
|
||||
]}:$PATH
|
||||
|
@ -36,7 +36,7 @@ in
|
|||
|
||||
${lib.concatMapStrings (fact: ''
|
||||
mkdir -p "$(dirname ${fact.path})"
|
||||
cp "$facts"/${fact.name} ${fact.path}
|
||||
cp "$facts"/${fact.name} "$CLAN_DIR"/${fact.path}
|
||||
'') (lib.attrValues v.facts)}
|
||||
|
||||
${lib.concatMapStrings (secret: ''
|
||||
|
@ -48,7 +48,6 @@ in
|
|||
system.clan.uploadSecrets = pkgs.writeScript "upload-secrets" ''
|
||||
#!/bin/sh
|
||||
set -efu
|
||||
set -x # remove for prod
|
||||
|
||||
target=$1
|
||||
|
||||
|
|
|
@ -25,7 +25,8 @@ in
|
|||
system.clan.generateSecrets = pkgs.writeScript "generate-secrets" ''
|
||||
#!/bin/sh
|
||||
set -efu
|
||||
set -x # remove for prod
|
||||
|
||||
test -d "$CLAN_DIR"
|
||||
|
||||
PATH=$PATH:${lib.makeBinPath [
|
||||
config.clanCore.clanPkgs.clan-cli
|
||||
|
@ -55,7 +56,7 @@ in
|
|||
|
||||
${lib.concatMapStrings (fact: ''
|
||||
mkdir -p "$(dirname ${fact.path})"
|
||||
cp "$facts"/${fact.name} ${fact.path}
|
||||
cp "$facts"/${fact.name} "$CLAN_DIR"/${fact.path}
|
||||
'') (lib.attrValues v.facts)}
|
||||
|
||||
${lib.concatMapStrings (secret: ''
|
||||
|
|
|
@ -1,44 +1,18 @@
|
|||
import json
|
||||
import os
|
||||
import tempfile
|
||||
from pathlib import Path
|
||||
|
||||
from .dirs import get_clan_flake_toplevel, nixpkgs_flake, nixpkgs_source, unfree_nixpkgs
|
||||
from .dirs import nixpkgs_flake, nixpkgs_source, unfree_nixpkgs
|
||||
|
||||
|
||||
def nix_build_machine(
|
||||
machine: str, attr: list[str], flake_url: Path | None = None
|
||||
def nix_build(
|
||||
flags: list[str],
|
||||
) -> list[str]:
|
||||
if flake_url is None:
|
||||
flake_url = get_clan_flake_toplevel()
|
||||
payload = json.dumps(
|
||||
dict(
|
||||
clan_flake=flake_url.as_posix(),
|
||||
machine=machine,
|
||||
attr=attr,
|
||||
)
|
||||
)
|
||||
escaped_payload = json.dumps(payload)
|
||||
return [
|
||||
"nix",
|
||||
"build",
|
||||
"--no-link",
|
||||
"--impure",
|
||||
"--print-out-paths",
|
||||
"--expr",
|
||||
f"let args = builtins.fromJSON {escaped_payload}; in "
|
||||
"""
|
||||
let
|
||||
flake = builtins.getFlake args.clan_flake;
|
||||
config = flake.nixosConfigurations.${args.machine}.extendModules {
|
||||
modules = [{
|
||||
clanCore.clanDir = args.clan_flake;
|
||||
}];
|
||||
};
|
||||
in
|
||||
flake.inputs.nixpkgs.lib.getAttrFromPath args.attr config
|
||||
""",
|
||||
]
|
||||
] + flags
|
||||
|
||||
|
||||
def nix_eval(flags: list[str]) -> list[str]:
|
||||
|
|
|
@ -1,22 +1,24 @@
|
|||
import argparse
|
||||
import os
|
||||
import subprocess
|
||||
import sys
|
||||
|
||||
from clan_cli.errors import ClanError
|
||||
|
||||
from ..nix import nix_build_machine
|
||||
from ..dirs import get_clan_flake_toplevel
|
||||
from ..nix import nix_build
|
||||
|
||||
|
||||
def generate_secrets(machine: str) -> None:
|
||||
clan_dir = get_clan_flake_toplevel().as_posix().strip()
|
||||
env = os.environ.copy()
|
||||
env["CLAN_DIR"] = clan_dir
|
||||
|
||||
proc = subprocess.run(
|
||||
nix_build_machine(
|
||||
machine=machine,
|
||||
attr=[
|
||||
"config",
|
||||
"system",
|
||||
"clan",
|
||||
"generateSecrets",
|
||||
],
|
||||
nix_build(
|
||||
[
|
||||
f'path:{clan_dir}#nixosConfigurations."{machine}".config.system.clan.generateSecrets'
|
||||
]
|
||||
),
|
||||
capture_output=True,
|
||||
text=True,
|
||||
|
@ -29,6 +31,7 @@ def generate_secrets(machine: str) -> None:
|
|||
print(secret_generator_script)
|
||||
secret_generator = subprocess.run(
|
||||
[secret_generator_script],
|
||||
env=env,
|
||||
)
|
||||
|
||||
if secret_generator.returncode != 0:
|
||||
|
|
|
@ -4,19 +4,18 @@ import sys
|
|||
|
||||
from clan_cli.errors import ClanError
|
||||
|
||||
from ..nix import nix_build_machine
|
||||
from ..dirs import get_clan_flake_toplevel
|
||||
from ..nix import nix_build
|
||||
|
||||
|
||||
def upload_secrets(machine: str) -> None:
|
||||
clan_dir = get_clan_flake_toplevel().as_posix()
|
||||
|
||||
proc = subprocess.run(
|
||||
nix_build_machine(
|
||||
machine=machine,
|
||||
attr=[
|
||||
"config",
|
||||
"system",
|
||||
"clan",
|
||||
"uploadSecrets",
|
||||
],
|
||||
nix_build(
|
||||
[
|
||||
f'{clan_dir}#nixosConfigurations."{machine}".config.system.clan.uploadSecrets'
|
||||
]
|
||||
),
|
||||
capture_output=True,
|
||||
text=True,
|
||||
|
|
Loading…
Reference in New Issue
Block a user