27 lines
1.5 KiB
Nix
27 lines
1.5 KiB
Nix
# INACTIVE TEMPLATE. Not imported by the development flake or any deployed host.
|
|
# Requires an owner-reviewed sops-nix NixOS module import in the host flake.
|
|
{ config, lib, ... }:
|
|
let cfg = config.aia.portalSecrets;
|
|
in {
|
|
options.aia.portalSecrets = {
|
|
enable = lib.mkEnableOption "owner-reviewed portal deployment secrets";
|
|
encryptedFile = lib.mkOption { type = lib.types.path; description = "SOPS-encrypted YAML only; never a plaintext file"; };
|
|
ageKeyFile = lib.mkOption { type = lib.types.str; description = "Private persisted host age key path outside the Nix store"; };
|
|
readerUser = lib.mkOption { type = lib.types.str; description = "Approved resource authorization service user"; };
|
|
};
|
|
config = lib.mkIf cfg.enable {
|
|
assertions = [{ assertion = lib.hasPrefix "/" cfg.ageKeyFile && !(lib.hasPrefix "/nix/store/" cfg.ageKeyFile);
|
|
message = "The host age identity must be an absolute runtime path outside the Nix store."; }];
|
|
sops.defaultSopsFile = cfg.encryptedFile;
|
|
sops.age.keyFile = cfg.ageKeyFile;
|
|
sops.age.generateKey = false;
|
|
sops.age.sshKeyPaths = [];
|
|
sops.gnupg.sshKeyPaths = [];
|
|
sops.secrets."portal/staff-credentials" = { owner = cfg.readerUser; mode = "0400"; };
|
|
sops.secrets."portal/management-credentials" = { owner = cfg.readerUser; mode = "0400"; };
|
|
# Consumers reference config.sops.secrets.<name>.path at runtime.
|
|
# Do not use builtins.readFile on a decrypted secret, environment.etc.text,
|
|
# PUBLIC_* values, or Astro/Vite imports to transport secrets.
|
|
};
|
|
}
|