+2 -3

tools/deploy/flake-module.nix

View file Reviewed

··· 19 19 chmod 700 "$DEPLOY_TMPDIR" 20 20 trap 'rm -rf "$DEPLOY_TMPDIR"' EXIT 21 21 22 22 + # Set bulk key path so the pass wrapper can lazily extract it 23 23 + # on the first actual decryption (if any secrets need uploading). 22 24 export PASS_BULK_KEY_FILE="$DEPLOY_TMPDIR/bulk-key" 23 25 24 26 # Sync password store before deploy 25 27 pass git pull --rebase 26 26 - 27 27 - # Extract bulk key for fast decryption during deploy 28 28 - pass show bulk-operations/age-key > "$PASS_BULK_KEY_FILE" 2>/dev/null || true 29 28 30 29 # Deploy 31 30 clan machines update "$@"

+2

tools/pass/flake-module.nix

View file Reviewed

··· 94 94 # Switch to bulk key for subsequent operations if available 95 95 if [[ -f "$PASS_BULK_KEY_FILE" ]] && [[ -s "$PASS_BULK_KEY_FILE" ]]; then 96 96 export PASSAGE_IDENTITIES_FILE="$PASS_BULK_KEY_FILE" 97 97 + # Bulk key is a plain age key, no TPM PIN needed for decryption 98 98 + KEY_TYPE=bulk 97 99 fi 98 100 fi 99 101 }