82 lines
2.2 KiB
Nix
82 lines
2.2 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
{
|
|
systemd.services.agenix-install-secrets.after = [ "usb-secrets.service" ];
|
|
|
|
# Extract USB secrets key in main system before agenix
|
|
systemd.services.usb-secrets = {
|
|
description = "Extract USB secrets key";
|
|
wantedBy = [ "sysinit.target" ];
|
|
before = [ "sysinit.target" ];
|
|
wants = [ "local-fs.target" ];
|
|
after = [
|
|
"local-fs.target"
|
|
"systemd-udev-settle.service"
|
|
];
|
|
unitConfig.DefaultDependencies = false;
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
};
|
|
script = ''
|
|
mkdir -p /run/secrets /mnt/usb
|
|
|
|
# Check if key already exists
|
|
if [ -f /run/secrets/usb-secrets-key ]; then
|
|
echo "USB secrets key already loaded"
|
|
exit 0
|
|
fi
|
|
|
|
# Wait for USB devices
|
|
echo "Waiting for USB device /dev/disk/by-label/SECRETS..."
|
|
for i in {1..30}; do
|
|
if [ -e /dev/disk/by-label/SECRETS ]; then
|
|
echo "USB device found after $i seconds"
|
|
break
|
|
fi
|
|
echo "Attempt $i: USB device not found, waiting..."
|
|
sleep 1
|
|
done
|
|
|
|
if [ ! -e /dev/disk/by-label/SECRETS ]; then
|
|
echo "ERROR: USB device /dev/disk/by-label/SECRETS not found after 30 seconds"
|
|
echo "Available devices:"
|
|
ls -la /dev/disk/by-label/ || true
|
|
exit 1
|
|
fi
|
|
|
|
# Give device a moment to be fully ready for mounting
|
|
echo "Device found, waiting 2 seconds for device to be ready..."
|
|
sleep 2
|
|
|
|
# Mount USB and copy key
|
|
echo "Attempting to mount /dev/disk/by-label/SECRETS to /mnt/usb..."
|
|
if ${pkgs.util-linux}/bin/mount /dev/disk/by-label/SECRETS /mnt/usb; then
|
|
echo "Mount successful"
|
|
if [ -f /mnt/usb/usb-secrets-key ]; then
|
|
${pkgs.coreutils}/bin/install -m 600 /mnt/usb/usb-secrets-key /run/secrets/usb-secrets-key
|
|
${pkgs.util-linux}/bin/umount /mnt/usb
|
|
echo "USB secrets key loaded"
|
|
else
|
|
${pkgs.util-linux}/bin/umount /mnt/usb
|
|
echo "Key file not found"
|
|
exit 1
|
|
fi
|
|
else
|
|
echo "USB not found"
|
|
exit 1
|
|
fi
|
|
'';
|
|
};
|
|
|
|
age.identityPaths = [ "/run/secrets/usb-secrets-key" ];
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d /run/secrets 0700 root root -"
|
|
];
|
|
}
|