starred/nix-config
1
0
Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-07-14 16:42:43 +02:00
Code Issues Packages Projects Releases 10 Wiki Activity

fix(secrets/nixos): assertion

Browse Source
This commit is contained in:
Ryan Yin
2024-11-17 21:31:31 +08:00
parent 2eb37b34ea
commit 4503964146
1 changed files with 214 additions and 220 deletions
Download Patch File Download Diff File Expand all files Collapse all files
secrets/nixos.nix
+10 -16
View File
@@ -10,6 +10,14 @@
with lib; let with lib; let
cfg = config.modules.secrets; cfg = config.modules.secrets;
enabledServerSecrets =
cfg.server.application.enable
|| cfg.server.network.enable
|| cfg.server.operation.enable
|| cfg.server.kubernetes.enable
|| cfg.server.webserver.enable
|| cfg.server.storage.enable;
noaccess = { noaccess = {
mode = "0000"; mode = "0000";
owner = "root"; owner = "root";
@@ -40,14 +48,7 @@ in {
impermanence.enable = mkEnableOption "whether use impermanence and ephemeral root file system"; impermanence.enable = mkEnableOption "whether use impermanence and ephemeral root file system";
}; };
config = config = mkIf (cfg.desktop.enable || enabledServerSecrets) (mkMerge [
mkIf (
cfg.desktop.enable
|| cfg.server.application.enable
|| cfg.server.network.enable
|| cfg.server.operation.enable
|| cfg.server.kubernetes.enable
) (mkMerge [
{ {
environment.systemPackages = [ environment.systemPackages = [
agenix.packages."${pkgs.system}".default agenix.packages."${pkgs.system}".default
@@ -68,14 +69,7 @@ in {
assertions = [ assertions = [
{ {
# This expression should be true to pass the assertion # This expression should be true to pass the assertion
assertion = assertion = !(cfg.desktop.enable && enabledServerSecrets);
!(cfg.desktop.enable
&& (
cfg.server.application.enable
|| cfg.server.network.enable
|| cfg.server.operation.enable
|| cfg.server.kubernetes.enable
));
message = "Enable either desktop or server's secrets, not both!"; message = "Enable either desktop or server's secrets, not both!";
} }
]; ];