automatically import secrets into nixos

checks/secrets/clan-secrets

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+set -eux -o pipefail
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+export SOPS_AGE_KEY_FILE="${SCRIPT_DIR}/key.age"
+nix run .# -- secrets "$@"

checks/secrets/default.nix

@@ -0,0 +1,16 @@
+(import ../lib/test-base.nix) {
+  name = "secrets";
+
+  nodes.machine = { self, config, ... }: {
+    imports = [
+      self.nixosModules.secrets
+    ];
+    environment.etc."secret".source = config.sops.secrets.foo.path;
+    sops.age.keyFile = ./key.age;
+    clan.sops.sopsDirectory = ./sops;
+    networking.hostName = "machine";
+  };
+  testScript = ''
+    machine.succeed("cat /etc/secret >&2")
+  '';
+}

checks/secrets/key.age

@@ -0,0 +1 @@
+AGE-SECRET-KEY-1UCXEUJH6JXF8LFKWFHDM4N9AQE2CCGQZGXLUNV4TKR5KY0KC8FDQ2TY4NX

checks/secrets/sops/machines/machine/key.json

@@ -0,0 +1,4 @@
+{
+  "publickey": "age15x8u838dwqflr3t6csf4tlghxm4tx77y379ncqxav7y2n8qp7yzqgrwt00",
+  "type": "age"
+}

checks/secrets/sops/secrets/foo/machines/machine

@@ -0,0 +1 @@
+../../../machines/machine

checks/secrets/sops/secrets/foo/secret

@@ -0,0 +1,20 @@
+{
+	"data": "ENC[AES256_GCM,data:bhxF,iv:iNs+IfSU/7EwssZ0GVTF2raxJkVlddfQEPGIBeUYAy8=,tag:JMOKTMW3/ic3UTj9eT9YFQ==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age15x8u838dwqflr3t6csf4tlghxm4tx77y379ncqxav7y2n8qp7yzqgrwt00",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxS0g4TEt4S09LQnFKdCtk\nZTlUQWhNUHZmcmZqdGtuZkhhTkMzZDVaWWdNCi9vNnZQeklNaFBBU2x0ditlUDR0\nNGJlRmFFb09WSUFGdEh5TGViTWtacFEKLS0tIE1OMWdQMHhGeFBwSlVEamtHUkcy\ndzI1VHRkZ1o4SStpekVNZmpQSnRkeUkKYmPS9sR6U0NHxd55DjRk29LNFINysOl6\nEM2MTrntLxOHFWZ1QgNx34l4rYIIXx97ONvR0SRpxN0ECL9VonQeZg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2023-08-23T09:11:08Z",
+		"mac": "ENC[AES256_GCM,data:8z819mP4FJXE/ExWM1+/dhaXIXzCglhBuZwE6ikl/jNLUAnv3jYL9c9vPrPFl2by3wXSNzqB4AOiTKDQoxDx2SBQKxeWaUnOajD6hbzskoLqCCBfVx7qOHrk/BULcBvMSxBca4RnzXXoMFTwKs2A1fXqAPvSQd1X4gX6Xm9VXWM=,iv:3YxZX+gaEcRKDN0Kuf9y1oWL+sT/J5B/5CtCf4iur9Y=,tag:0dwyjpvjCqbm9vIrz6WSWQ==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.7.3"
+	}
+}

checks/secrets/sops/secrets/foo/users/admin

@@ -0,0 +1 @@
+../../../users/admin

checks/secrets/sops/users/admin/key.json

@@ -0,0 +1,4 @@
+{
+  "publickey": "age15x8u838dwqflr3t6csf4tlghxm4tx77y379ncqxav7y2n8qp7yzqgrwt00",
+  "type": "age"
+}