pinpox
3ae8f8e238
Instead of pre-committing sops/ and vars/ directories, generators now run at build time in bubblewrap and their outputs are age-encrypted into a merged test directory via IFD. This tests generator scripts on every build and uses the age secret backend throughout. Core changes: - Add generateVarsDerivation to vars-executor.nix (runs generators, encrypts secrets with age, produces proper directory structure) - Add lib/test/age.nix module (replaces sopsModule: provisions test age key, sets secretStore=age) - Update flake-module.nix to build merged test dir via IFD using clanInternals.machines (avoids circular dependency with config.nodes) - Add clan.varsDirectory option that overrides 'directory' for service modules, so getPublicValue reads from the generated vars directory Per-test changes: - Fix sshd test to use config-derived secret path instead of hardcoded sops path - Delete sshd pre-committed sops/ and vars/ directories - Fix nixos-test-age-backend to use mkForce on settings.directory
25 lines
518 B
TOML
25 lines
518 B
TOML
[files]
|
|
extend-exclude = [
|
|
"**/secret",
|
|
"**/value",
|
|
"**.rev",
|
|
"**/facter-report.nix",
|
|
"**/key.json",
|
|
"pkgs/clan-cli/clan_lib/machines/test_suggestions.py",
|
|
]
|
|
|
|
[default]
|
|
extend-ignore-re = [
|
|
"age1[a-z0-9]+", # age public keys (bech32)
|
|
]
|
|
|
|
[default.extend-words]
|
|
facter = "facter"
|
|
metalness = "metalness" # would be corrected to metallicity, not sure which one's preferred
|
|
hda = "hda" # snd_hda_intel
|
|
dynamicdns = "dynamicdns"
|
|
substituters = "substituters"
|
|
|
|
[default.extend-identifiers]
|
|
pn = "pn"
|