forked from Fediversity/Fediversity
Kiara Grouwstra
dd5a6335b1
pass in description fix syntax configure proxmox provider typo add doc comment in existing modules add comment allow insecure proxmox connection for use in dev wip proxmox progress use service configurations moved to machine-independent location wire settings directly without option block terraform adjust cwd try tf on null input update .envrc.sample with sample proxmox credentials
37 lines
1 KiB
Nix
37 lines
1 KiB
Nix
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
|
|
let
|
|
inherit (lib) attrValues elem mkDefault;
|
|
inherit (lib.attrsets) concatMapAttrs optionalAttrs;
|
|
inherit (lib.strings) removeSuffix;
|
|
|
|
secretsPrefix = ../../secrets;
|
|
secrets = import (secretsPrefix + "/secrets.nix");
|
|
keys = import ../../keys;
|
|
|
|
in
|
|
{
|
|
imports = [
|
|
./options.nix
|
|
./nixos
|
|
];
|
|
|
|
fediversityVm.hostPublicKey = mkDefault keys.systems.${config.fediversityVm.name};
|
|
## Read all the secrets, filter the ones that are supposed to be readable
|
|
## with this host's public key, and add them correctly to the configuration
|
|
## as `age.secrets.<name>.file`.
|
|
age.secrets = concatMapAttrs (
|
|
name: secret:
|
|
optionalAttrs (elem config.fediversityVm.hostPublicKey secret.publicKeys) {
|
|
${removeSuffix ".age" name}.file = secretsPrefix + "/${name}";
|
|
}
|
|
) secrets;
|
|
|
|
## FIXME: Remove direct root authentication once the NixOps4 NixOS provider
|
|
## supports users with password-less sudo.
|
|
users.users.root.openssh.authorizedKeys.keys = attrValues keys.contributors;
|
|
}
|