cachix-watch-store: allow to set a signing key (25e5dfd1) · Commits · nix / nixpkgs

nixos/modules/services/system/cachix-watch-store.nix

+11 −1

Original line number	Diff line number	Diff line
		@@ -23,6 +23,14 @@ in
		'';
		};

		signingKeyFile = mkOption {
		type = types.nullOr types.path;
		description = lib.mdDoc ''
		Optional file containing a self-managed signing key to sign uploaded store paths.
		'';
		default = null;
		};

		compressionLevel = mkOption {
		type = types.nullOr types.int;
		description = lib.mdDoc "The compression level for ZSTD compression (between 0 and 16)";
		@@ -69,7 +77,8 @@ in
		DynamicUser = true;
		LoadCredential = [
		"cachix-token:${toString cfg.cachixTokenFile}"
		];
		]
		++ lib.optional (cfg.signingKeyFile != null) "signing-key:${toString cfg.signingKeyFile}";
		};
		script =
		let
		@@ -80,6 +89,7 @@ in
		in
		''
		export CACHIX_AUTH_TOKEN="$(<"$CREDENTIALS_DIRECTORY/cachix-token")"
		${lib.optionalString (cfg.signingKeyFile != null) ''export CACHIX_SIGNING_KEY="$(<"$CREDENTIALS_DIRECTORY/signing-key")"''}
		${lib.escapeShellArgs command}
		'';
		};