me/nixos-system
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: remove old agenix-rekey wrapper

Browse source
This commit is contained in:
Adriano Caloiaro 2026-07-16 21:49:57 -06:00
parent f284aa4a7f
commit f38f2a730c
No known key found for this signature in database
1 changed files with 1 additions and 27 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
flake.nix
View file

@ -91,6 +91,7 @@
inputs.lsp-mux.overlays.default
inputs.adiff.overlays.default
nur.overlays.default
(import ./common/overlays/age-plugin-gopass.nix {inherit inputs;})
];
system = "x86_64-linux";
pkgs = import nixpkgs {
@ -103,35 +104,8 @@
inherit overlays system;
};
# Wrapper to handle the dynamic master key
mkRekeyApp = system: pkgs: let
rekeyPackage = inputs.agenix-rekey.packages.${system}.default;
in {
type = "app";
program = "${pkgs.writeShellScript "rekey-wrapper" ''
# Create the file expected by the config
# We use /dev/shm (RAM-based tmpfs) to ensure the key never touches disk
REPO_ROOT=$(git rev-parse --show-toplevel)
MASTER_KEY_FILE="/dev/shm/agenix-master-$$.key"
# Cleanup on exit
trap 'rm -f "$MASTER_KEY_FILE"' EXIT
# Get the master key from gopass and write to RAM only
echo "Retrieving master key from gopass..."
${pkgs.gopass}/bin/gopass show -o systems/age.master > "$MASTER_KEY_FILE"
chmod 600 "$MASTER_KEY_FILE"
# Run the actual rekey command from the repo root with symlink
cd "$REPO_ROOT"
ln -sf "$MASTER_KEY_FILE" master.key
trap 'rm -f "$MASTER_KEY_FILE" master.key' EXIT
${rekeyPackage}/bin/agenix rekey "$@"
''}";
};
in {
inherit lib;
apps.${system}.rekey = mkRekeyApp system pkgs;
homeConfigurations = {
"adriano@zw" = lib.homeManagerConfiguration {
inherit pkgs;