mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:36 +01:00
25 lines
986 B
Makefile
25 lines
986 B
Makefile
# just is a command runner; Justfile is like Makefile but simpler.
|
|
# The agenix operations run against the private secrets repository at ~/codes/nix-secrets.
|
|
# Uses nushell: nix shell nixpkgs#just nixpkgs#nushell
|
|
set shell := ["nu", "-c"]
|
|
set working-directory := "../../codes/nix-secrets"
|
|
|
|
identity := "/etc/ssh/ssh_host_ed25519_key"
|
|
# `sudo` resets the environment, so the invoking user's `EDITOR` never reaches `agenix`.
|
|
# Pin the editor here instead of using `sudo -E`, which would trust the caller's environment.
|
|
editor := "hx"
|
|
|
|
# List all recipes
|
|
default:
|
|
@just --list --justfile {{justfile()}}
|
|
|
|
# Edit or create a secret (interactive); pipe the plaintext to write non-interactively
|
|
edit file:
|
|
sudo env EDITOR={{quote(editor)}} agenix -i {{identity}} -e {{quote(file)}}
|
|
|
|
# Re-encrypt every secret after adding or changing a recipient key
|
|
[confirm("Re-encrypt every secret in ~/codes/nix-secrets?")]
|
|
rekey:
|
|
sudo agenix -r -i {{identity}}
|
|
sudo chown -R ryan:ryan *
|