Unverified Commit 210ab761 authored by Ilan Joselevich's avatar Ilan Joselevich Committed by GitHub
Browse files

Merge pull request #276294 from phaer/cachix-signing-key 

cachix-watch-store: allow to set a signing key
parents 86e2edaa 25e5dfd1

nixos/modules/services/system/cachix-watch-store.nix

+11 −1
Original line number Diff line number Diff line
@@ -23,6 +23,14 @@ in 
      '';

    };



    signingKeyFile = mkOption {

      type = types.nullOr types.path;

      description = lib.mdDoc ''

        Optional file containing a self-managed signing key to sign uploaded store paths.

      '';

      default = null;

    };



    compressionLevel = mkOption {

      type = types.nullOr types.int;

      description = lib.mdDoc "The compression level for ZSTD compression (between 0 and 16)";
@@ -69,7 +77,8 @@ in 
        DynamicUser = true;

        LoadCredential = [

          "cachix-token:${toString cfg.cachixTokenFile}"

        ];

        ]

        ++ lib.optional (cfg.signingKeyFile != null) "signing-key:${toString cfg.signingKeyFile}";

      };

      script =

        let
@@ -80,6 +89,7 @@ in 
        in

        ''

          export CACHIX_AUTH_TOKEN="$(<"$CREDENTIALS_DIRECTORY/cachix-token")"

          ${lib.optionalString (cfg.signingKeyFile != null) ''export CACHIX_SIGNING_KEY="$(<"$CREDENTIALS_DIRECTORY/signing-key")"''}

          ${lib.escapeShellArgs command}

        '';

    };