yadunut/clan-core
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge pull request 'vars: fix - upload machines own secrets only' (#1949) from DavHau/clan-core:DavHau-dave into main

Browse Source
This commit is contained in:
clan-bot
2024-08-21 12:51:28 +00:00
parent dab39476e1 2a8958f494
commit 9b929f6f0d
4 changed files with 18 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
nixosModules/clanCore/vars/secret/sops/default.nix
View File

@@ -10,17 +10,11 @@ let
inherit (import ./funcs.nix { inherit lib; }) listVars;
varsDirMachines = config.clan.core.clanDir + "/sops/vars/per-machine";
varsDirMachines =
config.clan.core.clanDir + "/sops/vars/per-machine/${config.clan.core.machineName}";
varsDirShared = config.clan.core.clanDir + "/sops/vars/shared";
varsUnfiltered = (listVars varsDirMachines) ++ (listVars varsDirShared);
filterVars =
vars:
builtins.elem vars.machine [
config.clan.core.machineName
"shared"
];
vars = lib.filter filterVars varsUnfiltered;
vars = lib.traceValSeq (listVars varsDirMachines) ++ (listVars varsDirShared);
in
{

9
nixosModules/clanCore/vars/secret/sops/eval-tests/default.nix
View File

@@ -21,23 +21,24 @@ in
};
test_listSecrets = {
expr = listVars ./populated/vars;
expr = listVars "per_machine" ./populated/vars/my_machine;
expected = [
{
machine = "my_machine";
generator = "my_generator";
name = "my_secret";
id = "per_machine/my_generator/my_secret";
sopsFile = "${./populated/vars/my_machine}/my_generator/my_secret/secret";
}
];
};
test_listSecrets_no_vars = {
expr = listVars noVars;
expr = listVars "per_machine" noVars;
expected = [ ];
};
test_listSecrets_empty_vars = {
expr = listVars emtpyVars;
expr = listVars "per_machine" emtpyVars;
expected = [ ];
};
}

12
nixosModules/clanCore/vars/secret/sops/funcs.nix
View File

@@ -14,17 +14,13 @@ rec {
listVars =
varsDir:
flip concatMap (readDirNames varsDir) (
machine_name:
flip concatMap (readDirNames (varsDir + "/${machine_name}")) (
flip concatMap (readDirNames (varsDir)) (
generator_name:
flip map (readDirNames (varsDir + "/${machine_name}/${generator_name}")) (secret_name: {
machine = machine_name;
flip map (readDirNames (varsDir + "/${generator_name}")) (secret_name: {
generator = generator_name;
name = secret_name;
id = "${machine_name}/${generator_name}/${secret_name}";
sopsFile = "${varsDir}/${machine_name}/${generator_name}/${secret_name}/secret";
id = "${generator_name}/${secret_name}";
sopsFile = "${varsDir}/${generator_name}/${secret_name}/secret";
})
)
);
}

4
pkgs/clan-cli/tests/test_vars_deployment.py
View File

@@ -35,8 +35,8 @@ def test_vm_deployment(
cli.run(["vars", "generate", "my_machine"])
run_vm_in_thread("my_machine")
qga = qga_connect("my_machine")
qga.run("ls /run/secrets/my_machine/my_generator/my_secret", check=True)
_, out, _ = qga.run("cat /run/secrets/my_machine/my_generator/my_secret")
qga.run("ls /run/secrets/my_generator/my_secret", check=True)
_, out, _ = qga.run("cat /run/secrets/my_generator/my_secret")
assert out == "hello\n"
qga.exec_cmd("poweroff")
wait_vm_down("my_machine")