1{
 2  den,
 3  inputs,
 4  config,
 5  self,
 6  withSystem,
 7  lib,
 8  ...
 9}: {
10  # Use my fork version for some flake module improve
11  flake-file.inputs.vaultix = {
12    url = "github:HPCesia/vaultix";
13    inputs.nixpkgs.follows = "nixpkgs";
14    inputs.flake-parts.follows = "flake-parts";
15    inputs.pre-commit-hooks.inputs.flake-compat.follows = "flake-compat";
16  };
17
18  imports = [(inputs.vaultix.flakeModules.default or {})];
19
20  flake.vaultix = {
21    identity = ./age-yubikey-identity.pub;
22    extraPackages = pkgs: [pkgs.age-plugin-yubikey];
23    nodes = lib.filterAttrs (_: nixos: nixos.config ? vaultix) self.nixosConfigurations;
24  };
25  den.schema.flake-parts.includes = [den.aspects.secrets.vaultix];
26
27  den.aspects.secrets._.vaultix.includes = [
28    den.aspects.secrets.vaultix.flake
29    den.aspects.secrets.vaultix.os
30  ];
31
32  den.aspects.secrets._.vaultix._.flake = {
33    devshell = {system, ...}: {
34      commands = [
35        {
36          package = config.flake.vaultix.app.${system}.edit;
37          help = "view and edit secrets managed by vaultix";
38          category = "[secret management]";
39        }
40        {
41          help = "cache secrets managed by vaultix for all hosts";
42          name = "cache-secret";
43          command = "nix run .#vaultix.app.${system}.renc";
44          category = "[secret management]";
45        }
46      ];
47    };
48  };
49
50  den.aspects.secrets._.vaultix._.os = {host, ...}: let
51    hasImpermanence = host.hasAspect den.aspects.core.impermanence;
52    persistPrefix = lib.optionalString hasImpermanence "/persist";
53  in {
54    nixos = {
55      pkgs,
56      config,
57      ...
58    } @ args: {
59      imports = [
60        (import (inputs.vaultix.outPath + "/module") (args // {inherit self;}))
61      ];
62
63      vaultix = {
64        package = withSystem host.system (
65          {inputs', ...}: inputs'.vaultix.packages.default
66        );
67        settings = {
68          hostPubkey = host.pubKey;
69          hostKeys = map (key: key // {path = persistPrefix + key.path;}) config.services.openssh.hostKeys;
70        };
71      };
72
73      services.userborn.enable = true;
74      users.mutableUsers = false;
75    };
76  };
77}