- dumpOldKey = k: v: let
- dest = if v.destDir == "/run/keys"
- then k
- else (builtins.replaceStrings ["/run/keys/"] [""] v.destDir) + "/" + k;
- in ''
- mkdir -p secrets/$(dirname ${dest})
- echo -n ${lib.strings.escapeShellArg v.text} > secrets/${dest}
- cat >> mods <<EOF
- ${v.user or "root"} ${v.group or "root"} ${v.permissions or "0600"} secrets/${dest}
- EOF
- '';