diff options
Diffstat (limited to 'modules/security/gopass')
| -rw-r--r-- | modules/security/gopass/default.nix | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/modules/security/gopass/default.nix b/modules/security/gopass/default.nix index 4d223e9..5650c4b 100644 --- a/modules/security/gopass/default.nix +++ b/modules/security/gopass/default.nix @@ -47,6 +47,26 @@ in description = "The gopass-ssh-load script package."; }; }; + sync = { + enable = lib.mkEnableOption "Enables git-backed syncing of the gopass data directory."; + remote = lib.mkOption { + type = lib.types.nullOr lib.types.str; + default = null; + description = "Git remote URL for the gopass data directory. Use an https:// URL if 'credential' is configured."; + }; + credential = { + username = lib.mkOption { + type = lib.types.nullOr lib.types.str; + default = null; + description = "Username for HTTPS git authentication against the gopass remote."; + }; + passwordGopassPath = lib.mkOption { + type = lib.types.nullOr lib.types.str; + default = null; + description = "gopass entry path holding the password or token used."; + }; + }; + }; }; config = lib.mkMerge [ @@ -75,6 +95,9 @@ in tag = { gpgSign = false; }; + } + // lib.optionalAttrs (config.security.gopass.sync.credential.passwordGopassPath != null) { + credential.helper = "!f() { echo username=${lib.escapeShellArg config.security.gopass.sync.credential.username}; echo password=\"$(${config.security.gopass.package}/bin/gopass show -o ${lib.escapeShellArg config.security.gopass.sync.credential.passwordGopassPath})\"; }; f"; }; } ]; |