nyx/modules/flake/lib/secrets.nix

{ inputs }:
let
  inherit (inputs) self;

  /**
    Create secrets for use with `agenix`.

    # Arguments

    - [file] the age file to use for the secret
    - [owner] the owner of the secret, this defaults to "root"
    - [group] the group of the secret, this defaults to "root"
    - [mode] the permissions of the secret, this defaults to "400"

    # Type

    ```
    mkSecret :: (String -> String -> String -> String) -> AttrSet
    ```

    # Example

    ```nix
    mkSecret { file = "./my-secret.age"; }
    => {
      file = "./my-secret.age";
      owner = "root";
      group = "root";
      mode = "400";
    }
    ```
  */
  mkSecret =
    {
      file,
      owner ? "root",
      group ? "root",
      mode ? "400",
      ...
    }:
    {
      file = "${self}/secrets/${file}.age";
      inherit owner group mode;
    };

  /**
    A light wrapper around mkSecret that allows you to specify the output path

    # Arguments

    - [file] the age file to use for the secret
    - [owner] the owner of the secret, this defaults to "root"
    - [group] the group of the secret, this defaults to "root"
    - [mode] the permissions of the secret, this defaults to "400"
    - [path] the path to output the secret to

    # Type

    ```
    mkSecretWithPath :: (String -> String -> String -> String -> String) -> AttrSet
    ```

    # Example

    ```nix
    mkSecret { file = "./my-secret.age"; path = "/etc/my-secret"; }
    => {
      file = "./my-secret.age";
      path = "/etc/my-secret";
      owner = "root";
      group = "root";
      mode = "400";
    }
    ```
  */
  mkSecretWithPath =
    {
      file,
      path,
      owner ? "root",
      group ? "root",
      mode ? "400",
      ...
    }:
    mkSecret {
      inherit
        file
        owner
        group
        mode
        ;
    }
    // {
      inherit path;
    };
in
{
  inherit mkSecret mkSecretWithPath;
}