feat: switch to git-crypt
This commit is contained in:
parent
a8eb075c5a
commit
771896ffd9
21 changed files with 17 additions and 24 deletions
4
.git-crypt/.gitattributes
vendored
Normal file
4
.git-crypt/.gitattributes
vendored
Normal file
|
@ -0,0 +1,4 @@
|
|||
# Do not edit this file. To specify the files to encrypt, create your own
|
||||
# .gitattributes file in the directory where your files are.
|
||||
* !filter !diff
|
||||
*.gpg binary
|
Binary file not shown.
10
.gitattributes
vendored
10
.gitattributes
vendored
|
@ -1,4 +1,12 @@
|
|||
# noisy diffs
|
||||
flake.lock -diff
|
||||
home/secrets/**/*.json -diff
|
||||
lazy-lock.json -diff
|
||||
|
||||
# git lfs
|
||||
*.png filter=lfs diff=lfs merge=lfs -text
|
||||
|
||||
# git crypt
|
||||
home/secrets/fonts/* filter=git-crypt diff=git-crypt
|
||||
home/secrets/*.nix filter=git-crypt diff=git-crypt
|
||||
home/secrets/fallback.nix !filter !diff
|
||||
home/secrets/sops.nix !filter !diff
|
||||
|
|
7
.gitignore
vendored
7
.gitignore
vendored
|
@ -1,11 +1,4 @@
|
|||
# secrets
|
||||
.gitsecret/keys/random_seed
|
||||
!*.secret
|
||||
home/secrets/default.nix
|
||||
home/secrets/fonts.tgz
|
||||
|
||||
# Generated by nix-pre-commit-hooks
|
||||
/.pre-commit-config.yaml
|
||||
|
||||
# generated nix files
|
||||
/result
|
||||
|
|
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
@ -1 +0,0 @@
|
|||
home/secrets/default.nix:0e6b6e9c57743af34dd280dbafc83d5c27ca599e60c267f9eb63201ab7510856
|
BIN
home/secrets/default.nix
Normal file
BIN
home/secrets/default.nix
Normal file
Binary file not shown.
Binary file not shown.
BIN
home/secrets/fonts/Berkeley_Bold.otf
Normal file
BIN
home/secrets/fonts/Berkeley_Bold.otf
Normal file
Binary file not shown.
BIN
home/secrets/fonts/Berkeley_Bold_Italic.otf
Normal file
BIN
home/secrets/fonts/Berkeley_Bold_Italic.otf
Normal file
Binary file not shown.
BIN
home/secrets/fonts/Berkeley_Italic.otf
Normal file
BIN
home/secrets/fonts/Berkeley_Italic.otf
Normal file
Binary file not shown.
BIN
home/secrets/fonts/Berkeley_Regular.otf
Normal file
BIN
home/secrets/fonts/Berkeley_Regular.otf
Normal file
Binary file not shown.
BIN
home/secrets/fonts/Comic_Code_Bold.otf
Normal file
BIN
home/secrets/fonts/Comic_Code_Bold.otf
Normal file
Binary file not shown.
BIN
home/secrets/fonts/Comic_Code_Bold_Italic.otf
Normal file
BIN
home/secrets/fonts/Comic_Code_Bold_Italic.otf
Normal file
Binary file not shown.
BIN
home/secrets/fonts/Comic_Code_Italic.otf
Normal file
BIN
home/secrets/fonts/Comic_Code_Italic.otf
Normal file
Binary file not shown.
BIN
home/secrets/fonts/Comic_Code_Medium.otf
Normal file
BIN
home/secrets/fonts/Comic_Code_Medium.otf
Normal file
Binary file not shown.
BIN
home/secrets/fonts/Comic_Code_Medium_Italic.otf
Normal file
BIN
home/secrets/fonts/Comic_Code_Medium_Italic.otf
Normal file
Binary file not shown.
BIN
home/secrets/fonts/Comic_Code_Regular.otf
Normal file
BIN
home/secrets/fonts/Comic_Code_Regular.otf
Normal file
Binary file not shown.
19
justfile
19
justfile
|
@ -22,7 +22,7 @@ check:
|
|||
|
||||
# build {{{
|
||||
[macos]
|
||||
switch: secret-stage && secret-unstage
|
||||
switch:
|
||||
#!/usr/bin/env bash
|
||||
set -euxo pipefail
|
||||
if [[ -x "./result/sw/bin/darwin-rebuild" ]]; then
|
||||
|
@ -33,29 +33,18 @@ switch: secret-stage && secret-unstage
|
|||
fi
|
||||
|
||||
[linux]
|
||||
switch: secret-stage && secret-unstage
|
||||
switch:
|
||||
sudo nixos-rebuild switch --flake .
|
||||
[linux]
|
||||
boot: secret-stage && secret-unstage
|
||||
boot:
|
||||
sudo nixos-rebuild boot --flake .
|
||||
# }}}
|
||||
|
||||
# secrets {{{
|
||||
secretExists := path_exists("./home/secrets/default.nix")
|
||||
|
||||
secret-stage:
|
||||
{{secretExists}} && git add -f home/secrets/default.nix || exit 0
|
||||
secret-unstage:
|
||||
{{secretExists}} && git restore --staged home/secrets/default.nix || exit 0
|
||||
|
||||
fontdir := if os() == "macos" {"$HOME/Library/Fonts"} else {"${XDG_DATA_HOME:-$HOME/.local/share}/fonts"}
|
||||
|
||||
install-fonts:
|
||||
#!/usr/bin/env bash
|
||||
set -euxo pipefail
|
||||
mkdir -p "{{fontdir}}"
|
||||
gpg --decrypt home/secrets/fonts.tgz.gpg | tar -xz -C "{{fontdir}}" --strip-components=1
|
||||
# }}}
|
||||
install -Dm644 home/secrets/fonts/* "{{fontdir}}"
|
||||
|
||||
fetch:
|
||||
@nix run nixpkgs\#onefetch -- --true-color never --no-bots -d lines-of-code
|
||||
|
|
Loading…
Reference in a new issue