fix derived secrets (all were failing)
This commit is contained in:
parent
464db2c118
commit
3bbc4aecbb
|
@ -1,16 +1,14 @@
|
||||||
{ config, lib, pkgs, ... }:
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
let
|
let
|
||||||
inherit (builtins) toString;
|
|
||||||
inherit (lib) mapAttrs mkOption types;
|
|
||||||
|
|
||||||
hash-path-with-salt = pkgs.static-nix-shell.mkBash {
|
hash-path-with-salt = pkgs.static-nix-shell.mkBash {
|
||||||
pname = "hash-path-with-salt";
|
pname = "hash-path-with-salt";
|
||||||
src = ./.;
|
src = ./.;
|
||||||
};
|
};
|
||||||
|
|
||||||
cfg = config.sane.derived-secrets;
|
cfg = config.sane.derived-secrets;
|
||||||
secret = types.submodule {
|
secret = with lib; types.submodule {
|
||||||
options = {
|
options = {
|
||||||
len = mkOption {
|
len = mkOption {
|
||||||
type = types.int;
|
type = types.int;
|
||||||
|
@ -23,7 +21,7 @@ let
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
options = {
|
options = {
|
||||||
sane.derived-secrets = mkOption {
|
sane.derived-secrets = with lib; mkOption {
|
||||||
type = types.attrsOf secret;
|
type = types.attrsOf secret;
|
||||||
default = {};
|
default = {};
|
||||||
description = ''
|
description = ''
|
||||||
|
@ -36,11 +34,12 @@ in
|
||||||
};
|
};
|
||||||
|
|
||||||
config = {
|
config = {
|
||||||
sane.fs = mapAttrs (path: c: {
|
sane.fs = lib.mapAttrs (path: c: {
|
||||||
generated.command = [
|
generated.command = [
|
||||||
"${hash-path-with-salt}/bin/hash-path-with-salt"
|
"${hash-path-with-salt}/bin/hash-path-with-salt"
|
||||||
path
|
path
|
||||||
c.encoding
|
c.encoding
|
||||||
|
(builtins.toString (c.len * 2))
|
||||||
];
|
];
|
||||||
generated.acl.mode = "0600";
|
generated.acl.mode = "0600";
|
||||||
}) cfg;
|
}) cfg;
|
||||||
|
|
|
@ -2,9 +2,10 @@
|
||||||
#!nix-shell -i bash
|
#!nix-shell -i bash
|
||||||
file="$1"
|
file="$1"
|
||||||
enc="$2"
|
enc="$2"
|
||||||
|
nibbles="$3"
|
||||||
echo "$file" | cat /dev/stdin /etc/ssh/host_keys/ssh_host_ed25519_key \
|
echo "$file" | cat /dev/stdin /etc/ssh/host_keys/ssh_host_ed25519_key \
|
||||||
| sha512sum \
|
| sha512sum \
|
||||||
| cut -c 1-${toString (c.len * 2)} \
|
| cut -c "1-$nibbles" \
|
||||||
| tr a-z A-Z \
|
| tr a-z A-Z \
|
||||||
| basenc -d --base16 \
|
| basenc -d --base16 \
|
||||||
| basenc "--$enc" \
|
| basenc "--$enc" \
|
||||||
|
|
Loading…
Reference in New Issue
Block a user