darmanandClaude Sonnet 5
6f24ab69ad
Comments had drifted into multi-paragraph narrative (git commit lineage, debugging stories, restated code) in several hot spots (scripts/deploy, hermes-agent.nix, flake.nix, gitea.nix, headscale.nix). Trim every comment to its load-bearing "why" — gotchas, safety warnings, and non-obvious rationale survive verbatim in substance, just tightened to 1-2 sentences; historical narrative and anything already covered in CLAUDE.md is cut. No code/logic changed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UJqEmY1y3AYX3JoX4Y6b21
53 lines
1.8 KiB
Bash
Executable File
53 lines
1.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Edit (or view) a sops-encrypted secrets file with the admin age key.
|
|
#
|
|
# Usage:
|
|
# ./edit_secrets # edit secrets/jupiter.yaml
|
|
# ./edit_secrets secrets/other.yaml # edit another file
|
|
# ./edit_secrets --show # decrypt to stdout, no edit
|
|
#
|
|
# The admin age PRIVATE key must be at $SOPS_AGE_KEY_FILE
|
|
# (default ~/.config/sops/age/keys.txt). Never commit that key.
|
|
set -euo pipefail
|
|
|
|
# Locate the repo root (flake dir) regardless of where this script lives on disk.
|
|
SCRIPT_DIR="$(cd "$(dirname "$(realpath "$0")")" && pwd)"
|
|
REPO="$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null || dirname "$SCRIPT_DIR")"
|
|
cd "$REPO"
|
|
export PATH="/nix/var/nix/profiles/default/bin:$PATH"
|
|
|
|
export SOPS_AGE_KEY_FILE="${SOPS_AGE_KEY_FILE:-$HOME/.config/sops/age/keys.txt}"
|
|
if [ ! -f "$SOPS_AGE_KEY_FILE" ]; then
|
|
echo "error: admin age key not found at $SOPS_AGE_KEY_FILE" >&2
|
|
echo "set SOPS_AGE_KEY_FILE or generate one with age-keygen." >&2
|
|
exit 1
|
|
fi
|
|
|
|
show=0
|
|
file="secrets/jupiter.yaml"
|
|
for arg in "$@"; do
|
|
case "$arg" in
|
|
--show) show=1 ;;
|
|
*) file="$arg" ;;
|
|
esac
|
|
done
|
|
|
|
if [ "$show" -eq 1 ]; then
|
|
exec nix shell nixpkgs#sops -c sops --decrypt "$file"
|
|
fi
|
|
|
|
# sops re-encrypts only if the $EDITOR session actually changed the temp file.
|
|
# GUI editors (code/zed) return instantly unless forced to --wait, and if
|
|
# $EDITOR is unset no editor exists on the `nix shell` PATH, so bundle one.
|
|
editor="${VISUAL:-${EDITOR:-}}"
|
|
extra=()
|
|
case "$editor" in
|
|
"") editor="nano"; extra=(nixpkgs#nano) ;; # sane default, bundled
|
|
code|code\ *) editor="code --wait" ;; # VS Code must block
|
|
codium|codium\ *) editor="codium --wait" ;;
|
|
zeditor|zeditor\ *) editor="zeditor --wait" ;;
|
|
esac
|
|
|
|
export EDITOR="$editor"
|
|
exec nix shell nixpkgs#sops "${extra[@]}" -c sops "$file"
|