init

nix/flakeModule.nix

@@ -0,0 +1,149 @@
+{
+  config,
+  lib,
+  flake-parts-lib,
+  inputs,
+  den,
+  ...
+}:
+let
+  inherit (lib) mkOption types;
+  cfg = config.secrets;
+in
+{
+  options.secrets = {
+    masterKeys = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      description = "A list of master keys for encrypting secrets.";
+    };
+    secretsDir = mkOption {
+      type = types.str;
+      default = null;
+      description = "Path to the directory containing secrets relative to flake root.";
+    };
+    formatter = mkOption {
+      type = lib.types.functionTo lib.types.unspecified;
+      default = pkgs: pkgs.prettier;
+      description = "The formatter function to use for formatting sops file";
+    };
+    nixosModule = mkOption {
+      type = types.deferredModule;
+      readOnly = true;
+      description = "NixOS module configuration for managing sops secrets.";
+    };
+  };
+
+  config =
+    let
+      secrets = builtins.fromJSON (builtins.readFile "${inputs.self}/${cfg.secretsDir}/secrets.json");
+      all_keys = lib.flatten (lib.concatAttrValues per_host_keys);
+      per_host_keys = lib.mergeAttrsList (
+        lib.flatten (
+          map (
+            x:
+            builtins.mapAttrs (
+              name: value:
+              let
+                v = value.sopsPublic or [ ];
+                type = builtins.typeOf v;
+                vv =
+                  if type == "string" then
+                    [ v ]
+                  else if type == "list" then
+                    v
+                  else
+                    throw "Unexpected type ${type} for sopsPublic in host ${name}";
+              in
+              vv
+            ) x
+          ) (builtins.attrValues den.hosts)
+        )
+      );
+      secret_map = lib.mapAttrs (
+        name: value:
+        let
+          keys = lib.unique (
+            lib.flatten (map (k: per_host_keys.${k}) value.hosts)
+            ++ (lib.optionals value.global all_keys)
+            ++ cfg.masterKeys
+          );
+        in
+        {
+          inherit (value)
+            format
+            neededForUsers
+            hosts
+            global
+            ;
+          inherit keys;
+        }
+      ) secrets;
+      rules = lib.mapAttrsToList (name: value: {
+        path_regex = "${cfg.secretsDir}/${name}$";
+        key_groups = [ { age = value.keys; } ];
+      }) secret_map;
+      sops_secrets_map = lib.concatMapAttrs (
+        name: value:
+        let
+          hasHost = (lib.elem "wawa" value.hosts) || value.global;
+        in
+        if hasHost then
+          {
+            ${name} = {
+              inherit (value) format neededForUsers;
+              sopsFile = inputs.self + "/${cfg.secretsDir}/${name}";
+            };
+          }
+        else
+          { }
+      ) secret_map;
+    in
+    {
+      secrets.nixosModule =
+        { ... }:
+        {
+          config.sops.secrets = sops_secrets_map;
+        };
+      perSystem =
+        { pkgs, self', ... }:
+        let
+          formatted =
+            let
+              unformatted = (pkgs.formats.yaml { }).generate ".sops.yaml" {
+                creation_rules = rules;
+              };
+            in
+            pkgs.stdenvNoCC.mkDerivation {
+              name = ".sops-yaml-formatted";
+              src = unformatted;
+              phases = [ "format" ];
+              format = ''
+                cp $src .sops.yaml
+                chmod +w .sops.yaml
+                ${lib.getExe (cfg.formatter pkgs)} .sops.yaml
+                cp .sops.yaml $out
+              '';
+            };
+        in
+        {
+          packages.write-sops-config = pkgs.writeShellApplication {
+            name = "write-sops-config";
+            text = ''
+              cp ${formatted} .sops.yaml
+              find ${cfg.secretsDir} -type f ! -name "secrets.json" -exec ${pkgs.lib.getExe pkgs.sops} updatekeys -y {} \;
+            '';
+          };
+          checks.check-sops-config =
+            pkgs.runCommand "check-sops-config"
+              {
+                nativeBuildInputs = [ pkgs.diffutils ];
+              }
+              ''
+                set -e
+                diff -u ${inputs.self}/.sops.yaml ${formatted}
+                touch $out
+              '';
+        };
+    };
+}