social.coop is one of the many independent Mastodon servers you can use to participate in the fediverse.
A Fediverse instance for people interested in cooperative and collective projects. If you are interested in joining our community, please apply at https://join.social.coop/registration-form.html.

Administered by:

Server stats:

488
active users

#blah

0 posts0 participants0 posts today
Continued thread

In this current case I've been banging my head against, I'm doing some funky #systemd & #NixOS magic.

The idea is that the NixOS module for this particular app will have a config and a secret-files option set for the services.$program attribute. The latter is something to fill with sops-nix file paths and stuff.

At build time, I will replace any values in secret-files with #path.to.key (eg, secret-files.something.token = "blah" will become secret-files.something.token = "#something.token#).

Then, the systemd service fille will have an ExecStartPre=, which calls a script that replaces all the #blah# tokens in the config file template, and shoves it in $RUNTIME_DIR/etc/config.toml, and the program will use that.

This way the secrets aren't in the store, aren't in environment variables, and the config file only lives as long as the service is running, and is pretty much bound to it in every possible way.

I wouldn't have to do this, if said app would be able to load secrets from files itself, but alas... I could just encrypt the entire configuration file, but that's going to be a big fat nope.

Working with encrypted files is a pain in the ass, and I want most of my configuration in the clear, and documented - not something I can reasonably do when the entire config file is encrypted. Not in a way I want to, anyway (embedded comments are not documentation).

Replied in thread

@philz42 ooh I love this, with `set -T` it seems to even work if you `source` another script

function _trap_DEBUG() {
local cmd="${BASH_COMMAND}"
local line="${BASH_LINENO}"
local filename="${BASH_SOURCE[1]}"
# check if cmd includes 'PATH'
if [[ "${cmd}" == *"PATH"* ]]; then
#blah.sh line 1: `PATH=$PATH:/usr/local/bin`
echo "${filename} line ${line}: '${cmd}'"
fi
}

trap '_trap_DEBUG' DEBUG
set -T

8 years ago I had double #jawsurgery As you see the white lines above my teeth are where they cut my skull. They then put metal brackets and screws in my skull to piece it back together. As a result they severed nerves then put them back and prayed for the best. 🤷🏾‍♀️ for 8years I was fine. In June, 6 of the nerves died causing all this crazy swelling. I had to get rid of them and now I’m in second half of my dental implant journey. I’ve got Screws in my mouth that you can see poking through my gum and this retainer clip on prosthetic so I can eat and look like I have teeth. Im very excited. This has been tougher than I expected. First the shock of losing SIX teeth, then the pain and gore of having them pulled. I had to get screws put in my face and though I was medicated I was not asleep. I feel so unattractive right now and I keep letting my #insecurities get the best of me. I don’t feel #sexy, I don’t feel #funny, I don’t feel like me. 😵‍💫 #mastodon #teeth #implants #alttxt #alttext #gay #queer #blah