feat: Make modules evauluate without dependencies
Previously, module checks would stop us from evaluating if we didn't
include all of our dependencies' modules too. This became cumbersome if
someone was importing our flake, especially since as Nix doesn't stop
duplicate dependencies from being imported twice...
...by using optionalAttrs anywhere a dependency is needed, we stop Nix
being able to check that our options are valid, working around the issue
---
It's way too easy to make a mistake here, a first version of this change
had a bug where due to something like this...
x = lib.mkIf cfg.enable { } // { foo = lib.optionalAttrs ... }
...which evaluates as...
x = { _type = "if"; value = ...; foo = lib.optionalAttrs ...; ...; }
...we ended up dropping the impermanence options which mount our storage
It's really critical, therefore, to check that you aren't munging
attrsets into mkIf statements when you start using a mix of them
Change-Id: I7b786af965b3fd1012d956262aea72305b60db27
Reviewed-on: https://git.clicks.codes/c/Infra/NixFiles/+/811
Reviewed-by: Skyler Grey <minion@clicks.codes>
Tested-by: Skyler Grey <minion@clicks.codes>
diff --git a/modules/nixos/clicks/security/secrets/default.nix b/modules/nixos/clicks/security/secrets/default.nix
index 332efbe..8a120f9 100644
--- a/modules/nixos/clicks/security/secrets/default.nix
+++ b/modules/nixos/clicks/security/secrets/default.nix
@@ -12,8 +12,10 @@
default = config.clicks.defaults.enable;
};
- config = lib.mkIf cfg.enable {
- age.rekey = {
+ options.age = {}; # Required definition for lib.optionalAttrs...
+
+ config.age = lib.optionalAttrs cfg.enable {
+ rekey = {
masterIdentities = [
"${inputs.self}/secrets/keys/minion/collabora-yubikey.pub"
"${inputs.self}/secrets/keys/minion/tiny-yubikey.pub"
@@ -24,7 +26,7 @@
localStorageDir = lib.snowfall.fs.get-snowfall-file "secrets/rekeyed/${config.networking.hostName}";
};
- age.identityPaths = lib.mkIf config.clicks.storage.impermanence.enable [
+ identityPaths = lib.mkIf config.clicks.storage.impermanence.enable [
"/persist/data/etc/ssh/ssh_host_ed25519_key"
"/persist/data/etc/ssh/ssh_host_rsa_key"
];