starred/nix-config
1
0 Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-11-13 12:13:46 +01:00
Code Issues Packages Projects Releases 10 Wiki Activity

chore: rename the nushell secret, and forbid reading decrypted secrets

Browse Source
This commit is contained in:
ryan4yin | 二花 authored and GitHub committed 2026-09-21 21:13:50 +08:00
1 parent bc6748d021
commit 260da1ee20
4 files changed
+15 -14
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

secrets/darwin.nix
+5 -5
View File
@@ -77,9 +77,9 @@
}
// user_readable;
# alias-for-work
"alias-for-work.nushell" = {
file = "${mysecrets}/alias-for-work.nushell.age";
# decrypted secret: AI agents must not read it, only reference the path
"nushell-secrets.nu" = {
file = "${mysecrets}/nushell-secrets.nu.age";
}
// user_readable;
};
@@ -102,8 +102,8 @@
# The following secrets are used by home-manager modules
# But nix-darwin doesn't support environment.etc.<name>.mode
# So we need to change its mode manually
"agenix/alias-for-work.nushell" = {
source = config.age.secrets."alias-for-work.nushell".path;
"agenix/nushell-secrets.nu" = {
source = config.age.secrets."nushell-secrets.nu".path;
};
};
secrets/nixos.nix
+5 -5
View File
@@ -121,9 +121,9 @@ in
}
// user_readable;
# alias-for-work
"alias-for-work.nushell" = {
file = "${mysecrets}/alias-for-work.nushell.age";
# decrypted secret: AI agents must not read it, only reference the path
"nushell-secrets.nu" = {
file = "${mysecrets}/nushell-secrets.nu.age";
}
// user_readable;
};
@@ -147,8 +147,8 @@ in
# The following secrets are used by home-manager modules
# So we need to make then readable by the user
"agenix/alias-for-work.nushell" = {
source = config.age.secrets."alias-for-work.nushell".path;
"agenix/nushell-secrets.nu" = {
source = config.age.secrets."nushell-secrets.nu".path;
mode = "0644"; # both the original file and the symlink should be readable and executable by the user
};
};