mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:46 +01:00
ryan4yin | 二花
0c8f0fe0c3
* feat(secrets): add work gitconfig secret, symlink it in home-manager * feat(secrets): add a no-sudo replace recipe for new secrets * refactor(secrets): move work gitconfig symlink into the desktop layer
30 lines
1.1 KiB
Makefile
30 lines
1.1 KiB
Makefile
# just is a command runner; Justfile is like Makefile but simpler.
|
|
# The agenix operations run against the private secrets repository at ~/codes/nix-secrets.
|
|
# Uses nushell: nix shell nixpkgs#just nixpkgs#nushell
|
|
set shell := ["nu", "-c"]
|
|
set working-directory := "../../codes/nix-secrets"
|
|
|
|
identity := "/etc/ssh/ssh_host_ed25519_key"
|
|
# `sudo` resets the environment, so the invoking user's `EDITOR` never reaches `agenix`.
|
|
# Pin the editor here instead of using `sudo -E`, which would trust the caller's environment.
|
|
editor := "hx"
|
|
|
|
# List all recipes
|
|
default:
|
|
@just --list --justfile {{justfile()}}
|
|
|
|
# Partially edit an existing secret (interactive, needs sudo)
|
|
edit file:
|
|
sudo env EDITOR={{quote(editor)}} agenix -i {{identity}} -e {{quote(file)}}
|
|
|
|
# Create a secret, or fully replace one, from plaintext on stdin (no sudo)
|
|
replace file:
|
|
rm -f {{quote(file)}}
|
|
agenix -e {{quote(file)}}
|
|
|
|
# Re-encrypt every secret after adding or changing a recipient key
|
|
[confirm("Re-encrypt every secret in ~/codes/nix-secrets?")]
|
|
rekey:
|
|
sudo agenix -r -i {{identity}}
|
|
sudo chown -R ryan:ryan *
|