tarball-mirror: load credentials from agenix secret
Pierre Bourdon committed
Feb 20, 2024 at 23:51 UTC
8265915b4d2e47e126c850439cdcf5f56a6f600e
1 file changed
+6
-5
modules/tarball-mirror.nix
+6
-5
@@ -1,9 +1,6 @@
1
# This module mirrors most tarballs reachable from Nixpkgs's
2
# release.nix to the content-addressed tarball cache at
3
# tarballs.nixos.org.
4
-#
5
-# Note: this service expects AWS credentials for uploading to
6
-# s3://nixpkgs-tarballs in /home/tarball-mirror/.aws/credentials.
4
5
{ config, lib, pkgs, ... }:
6
@@ -23,6 +20,10 @@ let
20
in
21
22
{
23
+ age.secrets.tarball-mirror-aws-credentials = {
24
+ file = ../delft/secrets/tarball-mirror-aws-credentials.age;
25
+ owner = "tarball-mirror";
26
+ };
27
28
users.extraUsers.tarball-mirror =
29
{ description = "Nixpkgs tarball mirroring user";
@@ -47,8 +48,8 @@ in
48
git remote update origin
49
git checkout origin/${branch}
50
# FIXME: use IAM role.
50
- export AWS_ACCESS_KEY_ID=$(sed 's/aws_access_key_id=\(.*\)/\1/ ; t; d' ~/.aws/credentials)
51
- export AWS_SECRET_ACCESS_KEY=$(sed 's/aws_secret_access_key=\(.*\)/\1/ ; t; d' ~/.aws/credentials)
51
+ export AWS_ACCESS_KEY_ID=$(sed 's/aws_access_key_id=\(.*\)/\1/ ; t; d' ${config.age.secrets.tarball-mirror-aws-credentials.path})
52
+ export AWS_SECRET_ACCESS_KEY=$(sed 's/aws_secret_access_key=\(.*\)/\1/ ; t; d' ${config.age.secrets.tarball-mirror-aws-credentials.path})
53
NIX_PATH=nixpkgs=. ./maintainers/scripts/copy-tarballs.pl \
54
--expr 'import <nixpkgs/maintainers/scripts/all-tarballs.nix>' \
55
--exclude 'registry.npmjs.org|mirror://kde|mirror://xorg|mirror://kernel|mirror://hackage|mirror://gnome|mirror://apache|mirror://mozilla|pypi.python.org'