nix-config/secrets/nixos_sopsnix.nix at main · Program-Learning/nix-config · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
# NOTE: this file is for sops-nix
{
  lib,
  config,
  pkgs,
  sops-nix,
  mysecrets,
  myvars,
  ...
}:
with lib; let
  cfg = config.modules.secrets;

  enabledServerSecrets =
    cfg.server.application.enable
    || cfg.server.network.enable
    || cfg.server.operation.enable
    || cfg.server.kubernetes.enable
    || cfg.server.webserver.enable
    || cfg.server.storage.enable;

  noaccess = {
    mode = "0000";
    owner = "root";
  };
  high_security = {
    mode = "0500";
    owner = "root";
  };
  user_readable = {
    mode = "0500";
    owner = myvars.username;
  };
  MkPermAttr = username: mode: {
    mode = mode;
    owner = username;
  };
in {
  imports = [
    sops-nix.nixosModules.sops
  ];

  config = mkIf (cfg.desktop.enable || enabledServerSecrets) (mkMerge [
    {
      environment.systemPackages = [
        pkgs.sops
        sops-nix.packages.${pkgs.system}.sops-init-gpg-key
        sops-nix.packages.${pkgs.system}.ssh-to-pgp
      ];

      assertions = [
        {
          # This expression should be true to pass the assertion
          # WARNING: we bypass this on my secret bcs we only have a computer without surrounding facilities
          assertion = !(cfg.desktop.enable && enabledServerSecrets);
          message = "Enable either desktop or server's secrets, not both!";
        }
      ];
      warnings =
        if cfg.desktop.enable && enabledServerSecrets
        then [
          ''
            Enable either desktop or server's secrets, not both!
          ''
        ]
        else [];
    }

    (mkIf cfg.desktop.enable {
      })

    (mkIf cfg.server.network.enable {
      })

    (mkIf cfg.server.application.enable {
      })

    (mkIf cfg.server.operation.enable {
      })

    (mkIf cfg.server.kubernetes.enable {
      })

    (mkIf cfg.server.webserver.enable {
      })

    (mkIf cfg.server.storage.enable {
      })
  ]);
}