From 10bc9e3e441bddb2db5d5aed275c9f2b822d8958 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= Date: Thu, 8 May 2025 17:06:49 +0200 Subject: [PATCH] vars: improve warnings for non-public secrets --- nixosModules/clanCore/vars/default.nix | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/nixosModules/clanCore/vars/default.nix b/nixosModules/clanCore/vars/default.nix index 4f8538e90..7d935f46f 100644 --- a/nixosModules/clanCore/vars/default.nix +++ b/nixosModules/clanCore/vars/default.nix @@ -58,7 +58,16 @@ in ) ) '' - The config.clan.core.vars.generators.${generator.name}.files.${file.name} is not secret, but has non-default owner/group/mode set. + The config.clan.core.vars.generators.${generator.name}.files.${file.name} is not secret: + ${lib.optionalString (file.owner != "root") '' + The owner is set to ${file.owner}, but should be root. + ''} + ${lib.optionalString (file.group != (if _class == "darwin" then "wheel" else "root")) '' + The group is set to ${file.group}, but should be ${if _class == "darwin" then "wheel" else "root"}. + ''} + ${lib.optionalString (file.mode != "0400") '' + The mode is set to ${file.mode}, but should be 0400. + ''} This doesn't work because the file will be added to the nix store '' ) [ ] (lib.attrValues generator.files)