- if [ -f /run/keys/secrets.tar ]; then
- if [ ! -f ${location}/currentSecrets ] || ! sha512sum -c --status "${location}/currentSecrets"; then
- echo "rebuilding secrets"
- rm -rf ${location}
- install -m0750 -o root -g keys -d ${location}
- ${pkgs.gnutar}/bin/tar --strip-components 1 -C ${location} -xf /run/keys/secrets.tar
- sha512sum /run/keys/secrets.tar > ${location}/currentSecrets
- find ${location} -type d -exec chown root:keys {} \; -exec chmod o-rx {} \;
+ TMP=$(${pkgs.coreutils}/bin/mktemp -d)
+ TMPWORK=$(${pkgs.coreutils}/bin/mktemp -d)
+ chmod go-rwx $TMPWORK
+ if [ -n "$TMP" -a -n "$TMPWORK" ]; then
+ install -m0750 -o root -g keys -d $TMP
+ ${pkgs.ssh-to-age}/bin/ssh-to-age -private-key -i ${config.secrets.decryptKey} -o $TMPWORK/keys.txt
+ SOPS_AGE_KEY_FILE=$TMPWORK/keys.txt ${pkgs.sops}/bin/sops -d ${secrets} | ${pkgs.gnutar}/bin/tar --strip-components 1 -C $TMP -x
+ if [ -f ${config.secrets.secretsVars} ]; then
+ SOPS_AGE_KEY_FILE=$TMPWORK/keys.txt ${pkgs.sops}/bin/sops -d ${config.secrets.secretsVars} > $TMPWORK/vars.yml
+ fi
+ if [ -f $TMPWORK/vars.yml ]; then
+ find $TMP -name "*.gucci.tpl" -exec \
+ /bin/sh -c 'f="{}"; ${pkgs.gucci}/bin/gucci -f '$TMPWORK'/vars.yml "$f" > "''${f%.gucci.tpl}"; touch --reference "$f" ''${f%.gucci.tpl} ; chmod --reference="$f" ''${f%.gucci.tpl} ; chown --reference="$f" ''${f%.gucci.tpl}' \;