Secrets for hercules-ci style effects #307
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
antifuchs
force-pushed
the
hercules-secrets
branch
2 times, most recently
from
07c462a
to
1b2d7eb
Compare
|
This PR might address the question around secrets in #115. It's not public-key encrypted (and there remains the question on whether this unduly exposes secrets to forks, if we ever make other branches have effects), but it's a start I think. |
antifuchs
force-pushed
the
hercules-secrets
branch
2 times, most recently
from
6461241
to
10945ae
Compare
Mic92
reviewed
Oct 2, 2024
Mic92
reviewed
Oct 2, 2024
antifuchs
force-pushed
the
hercules-secrets
branch
from
10945ae
to
85491d9
Compare
|
Updated to address the TMPDIR comment. |
A mere .write doesn't flush the write out (it's fully-buffered), so the bwrapped secrets remain empty. Tricky!
* Add a nixpkgs configuration setting effects.perRepoSecretFiles, which associates a repository with a path containing a hci secrets.json-style file (that could be sourced from sops-nix or agenix). * Configure that and pass the secrets to effects running in projects for the respective repositories.
`nix develop` sets TMPDIR, TMP, TEMP, TEMPDIR to a directory that doesn't exist in the new tmpfs, which some programs don't take too kindly to. Instead, let's override the TMPDIR variable with a temporary dir that we know exists & is good. Just for hygiene reasons (and to keep others from tearing their hair out), just unset the other temporary directory variables.
antifuchs
force-pushed
the
hercules-secrets
branch
from
85491d9
to
b90a18d
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR to another PR (sorry for the complexity) is what I use currently to build and deploy my flake-based personal system configuration. This holds all the changes I had to make to get
flyctl deployworking for docker images built in my flake:/var/tmpas a tmpfs mount point in the bwrapped effects runnerbwrap(otherwise that file would be empty, thanks python buffering).With these changes, I have successfully run a flyctl deploy with the access token sourced from secrets passed in on that per-repo basis.