zaphyra's git: nixfiles

lib/replaceSecrets: init

diff --git a/lib/replaceSecrets.nix b/lib/replaceSecrets.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  ...
+}:
+
+let
+  attr = "_secret";
+  isSecret = v: lib.isAttrs v && v ? _secret && (lib.isString v._secret || builtins.isPath v._secret);
+
+in
+{
+  inherit isSecret;
+
+  replaceSecrets =
+    unitName: set:
+    let
+      # Sanitize path to create a valid credential tag
+      sanitizePath =
+        path: lib.stringAsChars (c: if builtins.match "[a-zA-Z0-9_.#=!-]" c != null then c else "_") path;
+
+      credentialTag = path: sanitizePath (lib.concatStringsSep "_" path);
+      credentialPath = path: "/run/credentials/${unitName}/${credentialTag path}";
+    in
+    {
+      output = lib.mapAttrsRecursiveCond (as: !(isSecret as)) (
+        path: value: if (builtins.isAttrs value) then (credentialPath path) else value
+      ) set;
+      credentials = lib.filter (elem: elem != null) (
+        lib.mapAttrsToListRecursiveCond (path: as: !(isSecret as)) (
+          path: value: if (builtins.isAttrs value) then "${credentialTag path}:${value."${attr}"}" else null
+        ) set
+      );
+    };
+
+}