nixos/secrets.nix

{ config, ... }:
let
  canaryHash = builtins.hashFile "sha256" ./secrets/canary;
  expectedHash =
    "bc6f38a927602241c5e0996b61ebd3a90d5356ca76dc968ec14df3cd45c6612c";
in if (canaryHash != expectedHash && config.my.features.secrets) then
  abort "Secrets are not readable. Have you run `git-crypt unlock`?"
else {
  hashed-password = builtins.readFile ./secrets/hashed-password;
}
Minor changes Untested VF2 config, basic "user", option to enable users, option to enable git, basic graphics role, unfinished `router` role, global features Signed-off-by: Ivan Bushchik <ivabus@ivabus.dev> 2023-10-03 17:15:14 +03:00			`{ config, ... }:`
uhhhhhhhhh add secrets refactor things 2023-07-28 15:39:50 +03:00			`let`
			`canaryHash = builtins.hashFile "sha256" ./secrets/canary;`
Call nixfmt for the first time Signed-off-by: Ivan Bushchik <ivabus@ivabus.dev> 2023-09-06 16:10:11 +03:00			`expectedHash =`
			`"bc6f38a927602241c5e0996b61ebd3a90d5356ca76dc968ec14df3cd45c6612c";`
Minor changes Untested VF2 config, basic "user", option to enable users, option to enable git, basic graphics role, unfinished `router` role, global features Signed-off-by: Ivan Bushchik <ivabus@ivabus.dev> 2023-10-03 17:15:14 +03:00			`in if (canaryHash != expectedHash && config.my.features.secrets) then`
Call nixfmt for the first time Signed-off-by: Ivan Bushchik <ivabus@ivabus.dev> 2023-09-06 16:10:11 +03:00			abort "Secrets are not readable. Have you run `git-crypt unlock`?"
			`else {`
			`hashed-password = builtins.readFile ./secrets/hashed-password;`
			`}`