chore: implemented warning

apps/rekey.nix

@@ -7,29 +7,30 @@ with nixpkgs.lib; let
   pkgs = import nixpkgs {inherit system;};
 
   rekeyCommandForHost = hostName: hostAttrs: let
-    secretPath = "/tmp/nix-rekey.d/${hostName}/";
     masterIdentities = strings.concatMapStrings (x: "-i ${x} ") hostAttrs.config.rekey.masterIdentityPaths;
 
+    pubKeyStr = let
+      pubKey = hostAttrs.config.rekey.pubKey;
+    in
+      if isPath pubKey
+      then readFile pubKey
+      else pubKey;
+    secretPath = "/tmp/nix-rekey.d/${builtins.hashString "sha1" pubKeyStr}/";
+
     rekeyCommand = secretName: secretAttrs: let
-      pubKeyStr = let
-        key = hostAttrs.config.rekey.pubKey;
-      in
-        if isPath key
-        then readFile key
-        else key;
     in ''
-         echo "Rekeying secret ${secretName} for host ${hostName}"
+      echo "Rekeying secret ${secretName} for host ${hostName}"
       echo "${secretAttrs.file}"
-         ${pkgs.rage}/bin/rage ${masterIdentities} -d ${secretAttrs.file} \
+      ${pkgs.rage}/bin/rage ${masterIdentities} -d ${secretAttrs.file} \
-         | ${pkgs.rage}/bin/rage -r "${pubKeyStr}" -o "${secretPath}/${secretName}.age" -e \
+      | ${pkgs.rage}/bin/rage -r "${pubKeyStr}" -o "${secretPath}/${secretName}.age" -e \
-         || { echo "Could not rekey secrets. Inserting dummy values" \
+      || { echo "Could not rekey secrets. Inserting dummy values" \
-         ; echo "Invalide due to failure when rekeying." \
+      ; echo "Invalide due to failure when rekeying." \
-         | ${pkgs.rage}/bin/rage -r "${pubKeyStr}" -o "${secretPath}/${secretName}.age" -e ;}
+      | ${pkgs.rage}/bin/rage -r "${pubKeyStr}" -o "${secretPath}/${secretName}.age" -e ;}
     '';
   in
     if masterIdentities == ""
     then ''
-      echo "No Identities set for host ${hostName}. Can not decrypt.\n\
+      echo -e "No Identities set for host ${hostName}. Cannot decrypt.\n\
       Make sure you set 'config.rekey.masterIdentityPaths'"
     ''
     else if
@@ -38,15 +39,12 @@ with nixpkgs.lib; let
       in
         isPath key && (! pathExists key)
     then ''
-      echo "No public keys available for host ${hostName}. Can not decrypt.\n\
+      echo -e "No public keys available for host ${hostName}. Can not decrypt.\n\
       Make sure the public keys are reachable by the building system'"
     ''
     else ''
-         mkdir -p ${secretPath}
+      mkdir -p ${secretPath}
-         # TODO
+      ${concatStringsSep "\n" (mapAttrsToList rekeyCommand (hostAttrs.config.rekey.secrets))}
-         ${concatStringsSep "\n" (mapAttrsToList rekeyCommand (hostAttrs.config.rekey.secrets))}
-
-      nix run --extra-sandbox-paths /tmp/nix-rekey.d/ "${../.}#rekey-copy-secrets"
     '';
 
   rekeyScript = ''
@@ -54,15 +52,16 @@ with nixpkgs.lib; let
 
     ${concatStringsSep "\n" (mapAttrsToList rekeyCommandForHost self.nixosConfigurations)}
 
+    nix run --extra-sandbox-paths /tmp/nix-rekey.d/ "${../.}#rekey-copy-secrets"
+
   '';
 
   rekey-exe = pkgs.writeShellScript "rekey.sh" rekeyScript;
 
   rekey-copy-secretsForHost = hostName: hostAttrs: let
-    secretFiles = mapAttrsToList (_: x: x.file) hostAttrs.config.rekey.secrets;
+    drv = import ../modules/rekey-drv.nix pkgs hostAttrs.config;
-    drv = import ../modules/rekey-drv.nix pkgs secretFiles;
   in ''
-    echo ${drv}
+    echo "Copied secrets for ${hostName} to ${drv}"
   '';
   rekey-copy-secrets-exe = pkgs.writeShellScript "rekey-copy-secrets.sh" ''
     ${concatStringsSep "\n" (mapAttrsToList rekey-copy-secretsForHost self.nixosConfigurations)}

configuration.nix

@@ -39,6 +39,9 @@
     file = ./secrets/iwd/devolo-og.psk.age;
     path = "/etc/iwd/devolo-og.psk";
   };
+  rekey.secrets.test = {
+    file = ./secrets/test.age;
+  };
 
   networking.useNetworkd = true;
   networking.dhcpcd.enable = false;

modules/rekey-drv.nix

@@ -1,20 +1,26 @@
-pkgs: secretFiles:
+pkgs: config: (
-(
+  pkgs.stdenv.mkDerivation rec {
-	pkgs.stdenv.mkDerivation rec {
+    pname = "host-secrets";
-	pname = "host-secrets";
+    version = "1";
-	version = "1";
+    description = "Rekeyed secrets for this host";
-	description = "Rekeyed secrets for this host";
+    pubKeyStr = let
+      pubKey = config.rekey.pubKey;
+    in
+      if builtins.isPath pubKey
+      then builtins.readFile pubKey
+      else pubKey;
 
-	srcs = secretFiles;
+    secretFiles = pkgs.lib.mapAttrsToList (_: x: x.file) config.rekey.secrets;
-	sourceRoot = ".";
+    srcs = secretFiles;
+    sourceRoot = ".";
 
-	dontMakeSourcesWriteable = true;
+    dontMakeSourcesWriteable = true;
-	dontUnpack = true;
+    dontUnpack = true;
-	dontConfigure = true;
+    dontConfigure = true;
-	dontBuild = true;
+    dontBuild = true;
 
-	installPhase = ''
+    installPhase = ''
-      cp -r /tmp/nix-rekey.d/ $out
+      cp -r /tmp/nix-rekey.d/${builtins.hashString "sha1" pubKeyStr}/. $out
-	'';
+    '';
   }
 )

modules/rekey.nix

@@ -8,17 +8,20 @@
 }: {
   config = with lib; let
     secretFiles = mapAttrsToList (_: x: x.file) config.rekey.secrets;
-    drv = import ./rekey-drv.nix pkgs secretFiles;
+    drv = import ./rekey-drv.nix pkgs config;
   in
     mkIf (config.rekey.secrets != {}) {
       age = {
         secrets = let
-          hostName = config.networking.hostName;
+          secretPath = "${drv}/";
-          secretPath = "${drv}/${hostName}/";
           newPath = x: "${secretPath}/${x}.age";
         in
           mapAttrs (name: value: value // {file = newPath name;}) config.rekey.secrets;
       };
+	  warnings = optional (! pathExists (removeSuffix ".drv" drv.drvPath)) ''
+	    Rekeyed secrets not available.
+		Maybe you forgot to run "nix run '.#rekey'" to rekey them?
+	  '';
     };
 
   options = with lib; {

secrets/test.age

@@ -0,0 +1,12 @@
+age-encryption.org/v1
+-> X25519 6PjX+qZyPYWTisaNUryJ12t/CEOrfLd+K1/wyKGFixM
+S5IV+M+l5LleLoXM3SUDioBCJiaHcwZslERVj5L0ygE
+-> piv-p256 XTQkUA A1py15wjDt5uwgw2/s2/ueM2JMcT4RFMa+5fx+d2UhG8
+xIdD5DNoxvu3T0873Qv2hl9rHatWi4GhAGcWT/cxNE8
+-> piv-p256 ZFgiIw AsSMYe/35S/b3kTqriw9Ur2eg2iB8dDSt4qtFzbMqTMz
+WnBSoehEmLtX9SEawmQIxsV8dReZPJRNq5oSLH6UWSU
+-> bHCG/L-grease -|u
+77tuo6s/XdK97pc73YTUh/OShs4jX/01ODcQT/80LaoCI0bt+yVBIOwNPrLwHVIV
+iiqROaIIp+mRDQj6JUB7hlaPoiNJcfO6ozA
+--- 7W4CK2idSDKwMlYi/FmPZVLPZZKv+5nyp0mpysWXork
+ÅH\”úŽÅ‚úbwõŒÑžug+uU+Ñ‚?<3F>\))	Wï6æ}¥ÿ'öÌQH¹/'§ÅÐ><3E>

test.lol

@@ -0,0 +1 @@
+cetiscienrst gnrs ciet