clan-cli secrets upload: secrets are populated into tmpdir

nixosModules/clanCore/secrets/default.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, ... }:
 {
   options.clanCore.secretStore = lib.mkOption {
     type = lib.types.enum [ "sops" "password-store" "custom" ];
@@ -17,6 +17,13 @@
     '';
   };
 
+  options.clanCore.secretsUploadDirectory = lib.mkOption {
+    type = lib.types.path;
+    description = ''
+      The directory where secrets are uploaded into, This is backend specific.
+    '';
+  };
+
   options.clanCore.secretsPrefix = lib.mkOption {
     type = lib.types.str;
     default = "";
@@ -106,10 +113,6 @@
         };
       }));
   };
-  config.system.build.generateUploadSecrets = pkgs.writeScript "generate_upload_secrets" ''
-    ${config.system.clan.generateSecrets}
-    ${config.system.clan.uploadSecrets}
-  '';
   imports = [
     ./sops.nix
     ./password-store.nix

nixosModules/clanCore/secrets/password-store.nix

@@ -12,6 +12,7 @@ in
   };
   config = lib.mkIf (config.clanCore.secretStore == "password-store") {
     clanCore.secretsDirectory = config.clan.password-store.targetDirectory;
+    clanCore.secretsUploadDirectory = config.clan.password-store.targetDirectory;
     system.clan.generateSecrets = pkgs.writeScript "generate-secrets" ''
       #!/bin/sh
       set -efu
@@ -33,7 +34,7 @@ in
           trap "rm -rf $facts" EXIT
           secrets=$(mktemp -d)
           trap "rm -rf $secrets" EXIT
-          ${v.generator}
+          ( ${v.generator} )
 
           ${lib.concatMapStrings (fact: ''
             mkdir -p "$(dirname ${fact.path})"
@@ -50,8 +51,6 @@ in
       #!/bin/sh
       set -efu
 
-      target=$1
-
       umask 0077
 
       PATH=${lib.makeBinPath [
@@ -71,7 +70,7 @@ in
             sort |
             xargs -r -n 1 git -C ${passwordstoreDir} log -1 --format=%H
         )
-        remote_pass_info=$(ssh "$target" -- ${lib.escapeShellArg ''
+        remote_pass_info=$(ssh ${config.clan.networking.deploymentAddress} -- ${lib.escapeShellArg ''
           cat ${config.clan.password-store.targetDirectory}/.pass_info || :
         ''})
 
@@ -81,12 +80,6 @@ in
         fi
       fi
 
-      tmp_dir=$(mktemp -dt populate-pass.XXXXXXXX)
-      trap cleanup EXIT
-      cleanup() {
-        rm -fR "$tmp_dir"
-      }
-
       find ${passwordstoreDir}/machines/${config.clanCore.machineName} -type f -follow ! -name .gpg-id |
       while read -r gpg_path; do
 
@@ -99,7 +92,7 @@ in
           fi
         )
         pass_name=$rel_name
-        tmp_path=$tmp_dir/$(basename $rel_name)
+        tmp_path="$SECRETS_DIR"/$(basename $rel_name)
 
         mkdir -p "$(dirname "$tmp_path")"
         pass show "$pass_name" > "$tmp_path"
@@ -109,10 +102,8 @@ in
       done
 
       if test -n "''${local_pass_info-}"; then
-        echo "$local_pass_info" > "$tmp_dir"/.pass_info
+        echo "$local_pass_info" > "$SECRETS_DIR"/.pass_info
       fi
-
-      rsync --mkpath --delete -a "$tmp_dir"/ "$target":${config.clan.password-store.targetDirectory}/
     '';
   };
 }

nixosModules/clanCore/secrets/sops.nix

@@ -37,12 +37,10 @@ in
       uploadSecrets = pkgs.writeScript "upload-secrets" ''
         #!${pkgs.python3}/bin/python
         import json
-        import sys
         from clan_cli.secrets.sops_generate import upload_age_key_from_nix
         # the second toJSON is needed to escape the string for the python
-        deployment_address = sys.argv[1]
-        args = json.loads(${builtins.toJSON (builtins.toJSON { machine_name = config.clanCore.machineName; age_key_file = config.sops.age.keyFile; })})
-        upload_age_key_from_nix(**args, deployment_address=deployment_address)
+        args = json.loads(${builtins.toJSON (builtins.toJSON { machine_name = config.clanCore.machineName; })})
+        upload_age_key_from_nix(**args)
       '';
     };
     sops.secrets = builtins.mapAttrs
@@ -56,5 +54,6 @@ in
 
     sops.age.keyFile = lib.mkIf (builtins.pathExists (config.clanCore.clanDir + "/sops/secrets/${config.clanCore.machineName}-age.key/secret"))
       (lib.mkDefault "/var/lib/sops-nix/key.txt");
+    clanCore.secretsUploadDirectory = lib.mkDefault "/var/lib/sops-nix";
   };
 }