81 lines
3.0 KiB
Nix
81 lines
3.0 KiB
Nix
{ inputs, ... }:
|
|
let
|
|
inputs' = inputs; # save a reference before it's shadowed
|
|
in
|
|
{
|
|
flake-file.inputs = {
|
|
# Adding sops-nix to the flake-file inputs causes it to get added to the inputs in flake.nix when it gets generated.
|
|
# This also makes the sops-nix module available
|
|
sops-nix.url = "github:Mic92/sops-nix";
|
|
sops-nix.inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
|
|
# Define the homeModules that are used by flake-parts
|
|
# https://flake.parts/options/home-manager.html#opt-flake.homeModules
|
|
flake.homeModules.sops = { inputs, config, pkgs, lib, ... }:
|
|
let
|
|
sopsBin = lib.getExe pkgs.sops;
|
|
sopsConfigPath = ../../../.sops.yaml;
|
|
sopsSecretsPath = ../../../keys/secrets.yaml;
|
|
ageKeyFile = "${config.xdg.configHome}/sops/age/keys.txt";
|
|
in
|
|
{
|
|
home.packages = with pkgs; [
|
|
eza
|
|
age
|
|
sops # This is necessary to make the sops binary available
|
|
ssh-to-age
|
|
(writeShellScriptBin "gen-age-key" ''
|
|
${lib.getExe pkgs.ssh-to-age} -i ${config.ssh.IdentityFile} -private-key > ${ageKeyFile}
|
|
echo -n "Created ${ageKeyFile}: "
|
|
echo $(show-age-key)
|
|
'')
|
|
(writeShellScriptBin "show-age-key" "${lib.getExe' pkgs.age "age-keygen"} -y ${ageKeyFile}")
|
|
(writeShellScriptBin "edit-secrets" "${sopsBin} --config ${sopsConfigPath} ${sopsSecretsPath}")
|
|
(writeShellScriptBin "ls-secrets" "${lib.getExe pkgs.eza} -alT --follow-symlinks ~/.config/sops-nix/secrets")
|
|
];
|
|
|
|
home.shellAliases.sops = "${sopsBin} --config ${sopsConfigPath}";
|
|
|
|
imports = [
|
|
# This import makes the sops config attribute available below
|
|
inputs'.sops-nix.homeManagerModules.sops
|
|
];
|
|
|
|
home.sessionVariables = {
|
|
GMAIL_CREDS_PATH = "${config.xdg.configHome}/sops-nix/gmail_api_credentials.json";
|
|
};
|
|
|
|
# Option definitions for the sops home-manager module:
|
|
# https://github.com/Mic92/sops-nix/blob/master/modules/home-manager/sops.nix
|
|
sops = {
|
|
defaultSopsFile = sopsSecretsPath;
|
|
defaultSopsFormat = "yaml";
|
|
age.sshKeyPaths = [ "${config.ssh.IdentityFile}" ];
|
|
# age.keyFile = "${ageKeyFile}";
|
|
# age.generateKey = true;
|
|
|
|
secrets."api/gmail_client_secret" = {
|
|
path = "${config.xdg.configHome}/resticprofile/dendrite.txt";
|
|
};
|
|
|
|
templates."gmail_creds" = {
|
|
path = "${config.xdg.configHome}/sops-nix/gmail_api_credentials.json";
|
|
content = ''
|
|
{
|
|
"installed": {
|
|
"client_id": "499012320469-vtml6emu6bmujpsj9lud2b44jqu7h26j.apps.googleusercontent.com",
|
|
"project_id": "python-apis-423500",
|
|
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
|
|
"token_uri": "https://oauth2.googleapis.com/token",
|
|
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
|
|
"client_secret": "${config.sops.placeholder."api/gmail_client_secret"}",
|
|
"redirect_uris": [ "http://localhost" ]
|
|
}
|
|
}
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
}
|