1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
lib,
...
}:
let
attr = "_secret";
isSecret = v: lib.isAttrs v && v ? _secret && (lib.isString v._secret || builtins.isPath v._secret);
in
{
inherit isSecret;
replaceSecrets =
unitName: set:
let
# Sanitize path to create a valid credential tag
sanitizePath =
path: lib.stringAsChars (c: if builtins.match "[a-zA-Z0-9_.#=!-]" c != null then c else "_") path;
credentialTag = path: sanitizePath (lib.concatStringsSep "_" path);
credentialPath = path: "/run/credentials/${unitName}/${credentialTag path}";
in
{
output = lib.mapAttrsRecursiveCond (as: !(isSecret as)) (
path: value: if (builtins.isAttrs value) then (credentialPath path) else value
) set;
credentials = lib.filter (elem: elem != null) (
lib.mapAttrsToListRecursiveCond (path: as: !(isSecret as)) (
path: value: if (builtins.isAttrs value) then "${credentialTag path}:${value."${attr}"}" else null
) set
);
};
}