m3tam3re/m3ta-home
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor: dynamic nushell secrets path via config.home.username #2

Merged
m3tam3re merged 1 commits from feat/dynamic-secrets into master 2026-07-02 19:08:43 +02:00
Conversation 0 Commits 1 Files Changed 1
+7 -4
1 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 7febc62f50 - Show all commits
profiles/base/shell/nushell.nix
+7 -4
View File
@@ -6,6 +6,8 @@
}: }:
with lib; let with lib; let
cfg = config.base.shell.nushell; cfg = config.base.shell.nushell;
# User-specific secrets file from agenix, resolved at build time.
secretsFile = "/run/agenix/${config.home.username}-secrets";
in { in {
# Enabled by default — base modules are always-on. # Enabled by default — base modules are always-on.
options.base.shell.nushell.enable = (mkEnableOption "enable nushell") // {default = true;}; options.base.shell.nushell.enable = (mkEnableOption "enable nushell") // {default = true;};
@@ -42,15 +44,16 @@ in {
| load-env | load-env
} }
# Load m3tam3re secrets from agenix. The secret file is Nushell code # Load user-specific secrets from agenix. The secret file is Nushell code
# containing a `load-env { ... }` block, not KEY=VALUE lines. # containing a `load-env { ... }` block, not KEY=VALUE lines.
# `source` resolves literal paths at parse time, so use `null` when absent. # `source` resolves literal paths at parse time, so use `null` when absent.
const m3tam3re_secrets_file = if ("/run/agenix/m3tam3re-secrets" | path exists) { # Path is resolved at Nix build time via config.home.username.
"/run/agenix/m3tam3re-secrets" const user_secrets_file = if ("${secretsFile}" | path exists) {
"${secretsFile}"
} else { } else {
null null
} }
source $m3tam3re_secrets_file source $user_secrets_file
''; '';
configFile.text = '' configFile.text = ''