Fix secrets closure

diff --git a/flakes/private/openarc/flake.lock b/flakes/private/openarc/flake.lock
index aa7904c966da6a8710ac1d1d1afc23d416f717f3..6ca846f41271576dfa5c54eb144e53e7f9edbfd8 100644 (file)
--- a/flakes/private/openarc/flake.lock
+++ b/flakes/private/openarc/flake.lock
@@ -146,7 +146,7 @@
     },
     "secrets": {
       "locked": {
-        "narHash": "sha256-X2waGhgIUDWbxCE5uvnscvlKni8Esbwaj6NncDShOnQ=",
+        "narHash": "sha256-C1BA1I+pw/xVkeKo8nJu5x2ijJENzLebWXVR1hfcK7Y=",
         "path": "../../secrets",
         "type": "path"
       },

diff --git a/flakes/private/opendmarc/flake.lock b/flakes/private/opendmarc/flake.lock
index 6bc1482e09ba5bdaf1bf266d578abb9fca7610be..ffb740752c37d8207b2a90fcc83be8a7f7ecc173 100644 (file)
--- a/flakes/private/opendmarc/flake.lock
+++ b/flakes/private/opendmarc/flake.lock
@@ -129,7 +129,7 @@
     },
     "secrets": {
       "locked": {
-        "narHash": "sha256-X2waGhgIUDWbxCE5uvnscvlKni8Esbwaj6NncDShOnQ=",
+        "narHash": "sha256-C1BA1I+pw/xVkeKo8nJu5x2ijJENzLebWXVR1hfcK7Y=",
         "path": "../../secrets",
         "type": "path"
       },

diff --git a/flakes/secrets/flake.nix b/flakes/secrets/flake.nix
index f2ebefb4c86a6ae3f2e2bc33a5da8b5299a9b613..4ba63d9e1783299b1d47bffca1516c96e824b80b 100644 (file)
--- a/flakes/secrets/flake.nix
+++ b/flakes/secrets/flake.nix
@@ -101,6 +101,11 @@
             ${v.user} ${v.group} ${v.permissions} ${fpath v}
             EOF
             '';
+        toOutputs = n: v: if v.path or false then n else pkgs.lib.flatten (map (v': (import n)."${v'}") v.outputs);
+        inputs = pkgs.lib.unique (pkgs.lib.flatten (map (v:
+          if v.isDir then []
+          else pkgs.lib.mapAttrsToList toOutputs (builtins.getContext v.text)
+        ) keys));
         secrets = pkgs.runCommand "secrets.tar.enc" {
           buildInputs = [ pkgs.gnupg pkgs.sops ];
           } ''
@@ -118,6 +123,7 @@
           done
 
           sops --age ${builtins.concatStringsSep "," config.secrets.ageKeys} --pgp ''${fingerprints#,} --input-type binary -i -e $out 2>/dev/null
+          cat $out | ${pkgs.jq}/bin/jq --argjson inputs '${builtins.toJSON inputs}' '.sops.nixInputs = $inputs' | ${pkgs.moreutils}/bin/sponge $out
           '';
         pathChmodExcl =
           let