vars: eval finalScript lazy

nixosModules/clanCore/vars/default.nix

@@ -41,7 +41,6 @@ in
           inherit (generator)
             name
             dependencies
-            finalScript
             validationHash
             migrateFact
             prompts

nixosModules/clanCore/vars/generator.nix

@@ -24,7 +24,8 @@ let
   filePromptNames = attrNames (filterAttrs (_name: prompt: prompt.createFile) config.prompts);
 in
 {
-  finalScript = mkOptionDefault ''
+  finalScript = mkOptionDefault (
+    pkgs.writeScript "generator-${config.name}" ''
       set -eu -o pipefail
 
       export PATH="${makeBinPath config.runtimeInputs}:${pkgs.coreutils}/bin"
@@ -52,7 +53,8 @@ in
       ''}
       ${promptsToFilesScript filePromptNames}
       ${config.script}
-  '';
+    ''
+  );
 
   files = genAttrs filePromptNames (_name: { });
 }

nixosModules/clanCore/vars/interface.nix

@@ -322,7 +322,7 @@ in
                   - all required programs are in PATH
                   - sandbox is set up correctly
               '';
-              type = lib.types.str;
+              type = lib.types.path;
               readOnly = true;
               internal = true;
             };

nixosModules/clanCore/vars/secret/on-machine.nix

@@ -0,0 +1,25 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  sortedGenerators = lib.toposort (a: b: builtins.elem a.name b.dependencies) (
+    lib.attrValues config.clan.core.vars.generators
+  );
+  generateSecrets = ''
+    ${lib.concatStringsSep "\n" (_gen: ''
+      v
+    '') sortedGenerators}
+  '';
+in
+{
+  config = lib.mkIf (config.clan.core.vars.settings.secretStore == "on-machine") {
+    environment.systemPackages = [
+      (pkgs.writeShellApplication {
+        text = generateSecrets;
+      })
+    ];
+  };
+}

pkgs/clan-cli/clan_cli/machines/machines.py

@@ -166,7 +166,11 @@ class Machine:
         generators: dict[str, Any] = clan_vars.get("generators")
         if generators is None:
             return []
-        return [Generator.from_json(gen) for gen in generators.values()]
+        _generators = [Generator.from_json(gen) for gen in generators.values()]
+        for gen in _generators:
+            gen.machine(self)
+
+        return _generators
 
     @property
     def secrets_upload_directory(self) -> str:

pkgs/clan-cli/clan_cli/vars/generate.py

@@ -40,7 +40,6 @@ class Generator:
     files: list[Var] = field(default_factory=list)
     share: bool = False
     validation: str | None = None
-    final_script: str = ""
     prompts: list[Prompt] = field(default_factory=list)
     dependencies: list[str] = field(default_factory=list)
 
@@ -62,7 +61,6 @@ class Generator:
         return cls(
             name=data["name"],
             share=data["share"],
-            final_script=data["finalScript"],
             files=[Var.from_json(data["name"], f) for f in data["files"].values()],
             validation=data["validationHash"],
             dependencies=data["dependencies"],
@@ -70,6 +68,14 @@ class Generator:
             prompts=[Prompt.from_json(p) for p in data["prompts"].values()],
         )
 
+    @property
+    def final_script(self) -> Path:
+        assert self._machine is not None
+        final_script = self._machine.build_nix(
+            f"config.clan.core.vars.generators.{self.name}.finalScript"
+        )
+        return final_script
+
 
 def bubblewrap_cmd(generator: str, tmpdir: Path) -> list[str]:
     # fmt: off
@@ -188,7 +194,7 @@ def execute_generator(
                 prompt_file.write_text(value)
 
         if sys.platform == "linux":
-            cmd = bubblewrap_cmd(generator.final_script, tmpdir)
+            cmd = bubblewrap_cmd(str(generator.final_script), tmpdir)
         else:
             cmd = ["bash", "-c", generator.final_script]
         run(cmd, RunOpts(env=env))
@@ -201,7 +207,7 @@ def execute_generator(
             secret_file = tmpdir_out / file.name
             if not secret_file.is_file():
                 msg = f"did not generate a file for '{file.name}' when running the following command:\n"
-                msg += generator.final_script
+                msg += str(generator.final_script)
                 raise ClanError(msg)
             if file.secret:
                 file_path = secret_vars_store.set(