This repository has no description
917 B
37 lines
1{ self, inputs, ... }:
2{
3 perSystem =
4 {
5 pkgs,
6 system,
7 ...
8 }:
9 {
10 packages.deploy = pkgs.writeShellApplication {
11 name = "deploy";
12 runtimeInputs = [
13 self.packages.${system}.pass
14 inputs.clan-core.packages.${system}.clan-cli
15 ];
16 text = ''
17 set -x
18 DEPLOY_TMPDIR=$(mktemp -d)
19 chmod 700 "$DEPLOY_TMPDIR"
20 trap 'rm -rf "$DEPLOY_TMPDIR"' EXIT
21
22 # Set bulk key path so the pass wrapper can lazily extract it
23 # on the first actual decryption (if any secrets need uploading).
24 export PASS_BULK_KEY_FILE="$DEPLOY_TMPDIR/bulk-key"
25
26 # Sync password store before deploy
27 pass git pull --rebase
28
29 # Deploy
30 clan machines update --debug "$@"
31
32 # Push any secret changes after deploy
33 pass git push
34 '';
35 };
36 };
37}