- if [ -f /run/keys/secrets.tar ]; then
- if [ ! -f ${location}/currentSecrets ] || ! sha512sum -c --status "${location}/currentSecrets"; then
- echo "rebuilding secrets"
- TMP=$(${pkgs.coreutils}/bin/mktemp -d)
- if [ -n "$TMP" ]; then
- install -m0750 -o root -g keys -d $TMP
- ${pkgs.gnutar}/bin/tar --strip-components 1 -C $TMP -xf /run/keys/secrets.tar
- sha512sum /run/keys/secrets.tar > $TMP/currentSecrets
- find $TMP -type d -exec chown root:keys {} \; -exec chmod o-rx {} \;
- ${pkgs.rsync}/bin/rsync -O -c -av --delete $TMP/ ${location}
- rm -rf $TMP
- fi
+ TMP=$(${pkgs.coreutils}/bin/mktemp -d)
+ TMPWORK=$(${pkgs.coreutils}/bin/mktemp -d)
+ chmod go-rwx $TMPWORK
+ if [ -n "$TMP" -a -n "$TMPWORK" ]; then
+ install -m0750 -o root -g keys -d $TMP
+ ${pkgs.ssh-to-age}/bin/ssh-to-age -private-key -i ${config.secrets.decryptKey} -o $TMPWORK/keys.txt
+ SOPS_AGE_KEY_FILE=$TMPWORK/keys.txt ${pkgs.sops}/bin/sops -d ${secrets} | ${pkgs.gnutar}/bin/tar --strip-components 1 -C $TMP -x
+ if [ -f ${config.secrets.secretsVars} ]; then
+ SOPS_AGE_KEY_FILE=$TMPWORK/keys.txt ${pkgs.sops}/bin/sops -d ${config.secrets.secretsVars} > $TMPWORK/vars.yml