1{
 2  inputs,
 3  self,
 4  den,
 5  lib,
 6  withSystem,
 7  ...
 8}: {
 9  flake-file.inputs.vaultix = {
10    url = "github:HPCesia/vaultix";
11    inputs.nixpkgs.follows = "nixpkgs";
12    inputs.flake-parts.follows = "flake-parts";
13    inputs.pre-commit-hooks.inputs.flake-compat.follows = "flake-compat";
14  };
15
16  imports = [(inputs.vaultix.flakeModules.default or {})];
17
18  flake.vaultix = {
19    identity = ./age-yubikey.pub;
20    cache = "./.secrets/cache";
21    defaultSecretDirectory = "./.secrets";
22    nodes = lib.filterAttrs (_: nixos: nixos.config ? vaultix) self.nixosConfigurations;
23  };
24  perSystem = {
25    pkgs,
26    system,
27    ...
28  }: {
29    vaultix = {
30      extraPackages = [pkgs.age-plugin-yubikey];
31    };
32    devshells.default = {
33      commands = [
34        {
35          name = "edit-secret";
36          help = "view and edit secrets managed by vaultix";
37          command = ''nix run .#vaultix.app.${system}.edit "$@"'';
38          category = "secret";
39        }
40        {
41          help = "cache secrets managed by vaultix for all hosts";
42          name = "cache-secret";
43          command = ''nix run .#vaultix.app.${system}.renc "$@"'';
44          category = "secret";
45        }
46      ];
47    };
48  };
49
50  den.aspects.secret = {
51    settings = {
52      host.pubKey = lib.mkOption {
53        type = lib.types.nullOr lib.types.str;
54        default = null;
55      };
56    };
57
58    nixos = {
59      host,
60      pkgs,
61      lib,
62      config,
63      ...
64    } @ args: let
65      cfg = host.settings.secret;
66      dummyPubkey = "age1qyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqs3290gq";
67      persistPrefix = lib.optionalString (host.hasAspect den.aspects.disk.preservation) "/persist";
68    in {
69      imports = [
70        (import (inputs.vaultix.outPath + "/module") (args // {inherit self;}))
71      ];
72
73      vaultix = {
74        package = withSystem host.system (
75          {inputs', ...}: inputs'.vaultix.packages.default
76        );
77        settings = {
78          hostPubkey =
79            if (cfg.pubKey != null)
80            then cfg.pubKey
81            else dummyPubkey;
82
83          hostKeys = map (key: key // {path = persistPrefix + key.path;}) config.services.openssh.hostKeys;
84        };
85      };
86
87      services.userborn.enable = true;
88      users.mutableUsers = false;
89    };
90  };
91
92  den.default.includes = [den.aspects.secret];
93}