15 lines
696 B
Nix
15 lines
696 B
Nix
|
{ inputs, outputs, lib, pkgs, config, options, ... }:
|
||
|
|
let
|
||
|
|
# NOTE: synced with <https://github.com/oddlama/agenix-rekey/blob/c071067f7d972552f5170cf8665643ed0ec19a6d/modules/agenix-rekey.nix#L38>
|
||
|
|
dummyPubkey = "age1qyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqs3290gq";
|
||
|
|
in {
|
||
|
|
# TODO: cleaner deep check
|
||
|
|
config = lib.mkIf (lib.all lib.id [(builtins.hasAttr "age" options) (builtins.hasAttr "rekey" options.age)]) {
|
||
|
|
age.rekey = lib.mkIf (config.age.rekey.hostPubkey != dummyPubkey) {
|
||
|
|
masterIdentities = [ "${inputs.self}/secrets/privkey.age" ];
|
||
|
|
storageMode = "local";
|
||
|
|
localStorageDir = "${inputs.self}/secrets/rekeyed/${config.networking.hostName}";
|
||
|
|
};
|
||
|
|
};
|
||
|
|
}
|