starred/nix-config
1
0
Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-04-26 02:38:30 +02:00
Code Issues Packages Projects Releases 10 Wiki Activity

fix(secrets/nixos): assertion

Browse Source
This commit is contained in:
Ryan Yin
2024-11-17 21:31:31 +08:00
parent 2eb37b34ea
commit 4503964146
1 changed files with 214 additions and 220 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
secrets/nixos.nix
View File

@@ -10,6 +10,14 @@
with lib; let
cfg = config.modules.secrets;
enabledServerSecrets =
cfg.server.application.enable
|| cfg.server.network.enable
|| cfg.server.operation.enable
|| cfg.server.kubernetes.enable
|| cfg.server.webserver.enable
|| cfg.server.storage.enable;
noaccess = {
mode = "0000";
owner = "root";
@@ -40,14 +48,7 @@ in {
impermanence.enable = mkEnableOption "whether use impermanence and ephemeral root file system";
};
config =
mkIf (
cfg.desktop.enable
|| cfg.server.application.enable
|| cfg.server.network.enable
|| cfg.server.operation.enable
|| cfg.server.kubernetes.enable
) (mkMerge [
config = mkIf (cfg.desktop.enable || enabledServerSecrets) (mkMerge [
{
environment.systemPackages = [
agenix.packages."${pkgs.system}".default
@@ -68,14 +69,7 @@ in {
assertions = [
{
# This expression should be true to pass the assertion
assertion =
!(cfg.desktop.enable
&& (
cfg.server.application.enable
|| cfg.server.network.enable
|| cfg.server.operation.enable
|| cfg.server.kubernetes.enable
));
assertion = !(cfg.desktop.enable && enabledServerSecrets);
message = "Enable either desktop or server's secrets, not both!";
}
];