aubergine: creds: add ssh host key

[julm/julm-nix.git] / nixos / modules / security / systemd-creds.nix

diff --git a/nixos/modules/security/systemd-creds.nix b/nixos/modules/security/systemd-creds.nix
index 60e6fd06452e4437257113ad0f3f76db771239ed..cb1db0949537ecafd82451edcf332b8862833035 100644 (file)
--- a/nixos/modules/security/systemd-creds.nix
+++ b/nixos/modules/security/systemd-creds.nix
@@ -90,14 +90,26 @@ let cfg = config.security.systemd-creds; in
         ```
 
         ```nix
+        { config, pkgs, lib, inputs, ... }:
+        {
         systemd.services."wireguard-wg-intra".serviceConfig.LoadCredentialEncrypted =
           [ "privateKey:''${inputs.self}/wireguard/wg-intra/privateKey.cred" ];
+        }
         ```
 
         ```console
         $ nix run .#nixosConfigurations.''${hostName}.config.security.systemd-creds.script
         $ git add wireguard/wg-intra/privateKey.cred
         ```
+
+        ::: {.warning}
+        To be able to access the relative path of the `.cred` file,
+        `inputs.self` has to be used in `LoadCredentialEncrypted`.
+        Note that `inputs` is a `config._module.args` or `specialArgs`
+        usually set in your `flake.nix`.
+        Using `''${wireguard/wg-intra/privatekey}`
+        would not work, because it drops the `wireguard/wg-intra/` part.
+        :::
       '';
     };
   };
@@ -119,14 +131,14 @@ let cfg = config.security.systemd-creds; in
               credID=${escapeShellArg credID}
               credPath=${escapeShellArg credPath}
               credBase=''${credPath#${storeDir}/*/}
-              if test ! -e "$credBase"; then
+              if test ! -s "$credBase"; then
                 { ${cfg.decrypt}; } |
                 { ${cfg.shell} -- ${cfg.encrypt} - -; } |
                 { ${cfg.install}; }
               fi
             ''
           )
-          service.serviceConfig.LoadCredentialEncrypted)
+          (toList service.serviceConfig.LoadCredentialEncrypted))
       (attrValues
         (filterAttrs
           (_serviceName: service: