849 lines
36 KiB
Text
849 lines
36 KiB
Text
|
#!/usr/bin/env nu
|
||
|
|
# Workspace secret management — SOPS/age encrypted secrets from Nickel component configs.
|
||
|
|
#
|
||
|
|
# Required workspace structure:
|
||
|
|
# <workspace-root>/
|
||
|
|
# ├── templates/ YAML templates with PLACEHOLDER values (one per secret)
|
||
|
|
# └── infra/<infra>/
|
||
|
|
# ├── sops.yaml SOPS creation rules (age recipient + encrypted_regex)
|
||
|
|
# ├── .kage Age private key — NEVER commit, back up securely
|
||
|
|
# ├── secrets/ Encrypted *.sops.yaml files (safe to commit)
|
||
|
|
# └── components/<name>.ncl Nickel component config (used by `new`)
|
||
|
|
#
|
||
|
|
# Infra target resolution (first wins):
|
||
|
|
# 1. --infra <name> flag
|
||
|
|
# 2. WORKSPACE_INFRA env var
|
||
|
|
#
|
||
|
|
# Workspace root resolution (first wins):
|
||
|
|
# 1. WORKSPACE_ROOT env var
|
||
|
|
# 2. Current working directory ($env.PWD)
|
||
|
|
#
|
||
|
|
# Output format (--out/-o, default text; get only):
|
||
|
|
# text KEY: value listing (all-keys) or bare value (single-key) — default
|
||
|
|
# json structured — supported by: list, pending, info, get
|
||
|
|
#
|
||
|
|
# --env-var/-e (get only): emit `export KEY='value'` lines instead of --out.
|
||
|
|
# --env-prefix/-p <string> prepends a prefix to each KEY (e.g. -p MYAPP_ -> MYAPP_FOO=...);
|
||
|
|
# passing --env-prefix with a non-empty value implies -e, so -e itself is optional then.
|
||
|
|
# The resulting var name (prefix + key) is always upper-cased regardless of the
|
||
|
|
# secret's own key casing — text/json output is unaffected and keeps original casing.
|
||
|
|
# Both are mutually exclusive with --out json.
|
||
|
|
# Note: Nushell reserves the bare identifier `env` for its builtin $env record,
|
||
|
|
# so the long flag is --env-var rather than --env — the short form -e is unaffected.
|
||
|
|
#
|
||
|
|
# Usage:
|
||
|
|
# nu secrets.nu --infra libre-wuji gen
|
||
|
|
# nu secrets.nu --infra libre-wuji make postgresql POSTGRES_PASSWORD=secret
|
||
|
|
# nu secrets.nu --infra libre-wuji new postgresql POSTGRES_PASSWORD=secret
|
||
|
|
# nu secrets.nu --infra libre-wuji list
|
||
|
|
# nu secrets.nu --infra libre-wuji --out json list
|
||
|
|
# nu secrets.nu --infra libre-wuji show postgresql # human-readable decrypt
|
||
|
|
# nu secrets.nu --infra libre-wuji get postgresql # all keys, plain KEY: value
|
||
|
|
# nu secrets.nu --infra libre-wuji get postgresql POSTGRES_PASSWORD # single key, bare value
|
||
|
|
# nu secrets.nu --infra libre-wuji -o json get postgresql # all keys, JSON
|
||
|
|
# source <(nu secrets.nu --infra libre-wuji -e get wireguard) # export lines, no prefix
|
||
|
|
# source <(nu secrets.nu --infra libre-wuji -p WG_ get wireguard) # export WG_KEY=value lines
|
||
|
|
# nu secrets.nu --infra libre-wuji edit docker_mailserver
|
||
|
|
#
|
||
|
|
# WORKSPACE_INFRA=libre-wuji nu secrets.nu make postgresql POSTGRES_PASSWORD=secret
|
||
|
|
|
||
|
|
def main [
|
||
|
|
--infra (-i): string = "" # Infra name; falls back to WORKSPACE_INFRA env var
|
||
|
|
--out (-o): string = "text" # Output format: text | json (list, pending, info, get)
|
||
|
|
--env-var (-e) # get only: emit `export KEY='value'` lines
|
||
|
|
--env-prefix (-p): string = "" # get only: prefix prepended to each KEY in -e output (implies -e)
|
||
|
|
cmd?: string # gen | make | new | list | show | get | edit
|
||
|
|
...args: string
|
||
|
|
]: nothing -> nothing {
|
||
|
|
let infra_name = if ($infra | is-not-empty) {
|
||
|
|
$infra
|
||
|
|
} else {
|
||
|
|
$env.WORKSPACE_INFRA? | default ""
|
||
|
|
}
|
||
|
|
|
||
|
|
if ($infra_name | is-empty) {
|
||
|
|
show-help
|
||
|
|
error make --unspanned { msg: "Infra name required — pass --infra <name> or set WORKSPACE_INFRA" }
|
||
|
|
}
|
||
|
|
|
||
|
|
if $out not-in ["text" "json"] {
|
||
|
|
error make --unspanned { msg: $"Invalid --out '($out)' — must be 'text' or 'json'" }
|
||
|
|
}
|
||
|
|
let env_mode = ($env_var or ($env_prefix | is-not-empty))
|
||
|
|
if $env_mode and $out == "json" {
|
||
|
|
error make --unspanned { msg: "--env-var/-e (or --env-prefix) and --out json are mutually exclusive" }
|
||
|
|
}
|
||
|
|
|
||
|
|
let ws_root = ($env.WORKSPACE_ROOT? | default $env.PWD)
|
||
|
|
let infra_dir = ($ws_root | path join "infra" $infra_name)
|
||
|
|
let infra_root = ($ws_root | path join "infra")
|
||
|
|
let secrets_dir = ($infra_dir | path join "secrets")
|
||
|
|
let templates_dir = ($ws_root | path join "templates")
|
||
|
|
|
||
|
|
# sops.yaml and .kage may live in infra/<name>/ or fall back to infra/
|
||
|
|
let sops_yaml = do {
|
||
|
|
let specific = ($infra_dir | path join "sops.yaml")
|
||
|
|
if ($specific | path exists) { $specific } else { $infra_root | path join "sops.yaml" }
|
||
|
|
}
|
||
|
|
let kage_file = do {
|
||
|
|
let specific = ($infra_dir | path join ".kage")
|
||
|
|
if ($specific | path exists) { $specific } else { $infra_root | path join ".kage" }
|
||
|
|
}
|
||
|
|
|
||
|
|
let ctx = {
|
||
|
|
infra_name: $infra_name,
|
||
|
|
ws_root: $ws_root,
|
||
|
|
infra_dir: $infra_dir,
|
||
|
|
secrets_dir: $secrets_dir,
|
||
|
|
templates_dir: $templates_dir,
|
||
|
|
sops_yaml: $sops_yaml,
|
||
|
|
kage_file: $kage_file,
|
||
|
|
out_format: $out,
|
||
|
|
env_var: $env_mode,
|
||
|
|
env_prefix: $env_prefix,
|
||
|
|
}
|
||
|
|
|
||
|
|
let c = ($cmd | default "help")
|
||
|
|
match $c {
|
||
|
|
"gen" => { cmd-gen $ctx }
|
||
|
|
"make" => { cmd-make $ctx $args }
|
||
|
|
"new" => { cmd-new $ctx $args }
|
||
|
|
"info" => { cmd-info $ctx ($args | get 0? | default "") }
|
||
|
|
"list" => { cmd-list $ctx }
|
||
|
|
"pending" => { cmd-pending $ctx }
|
||
|
|
"show" => { cmd-show $ctx ($args | get 0? | default "") }
|
||
|
|
"get" => { cmd-get $ctx $args }
|
||
|
|
"edit" => { cmd-edit $ctx ($args | get 0? | default "") }
|
||
|
|
_ => { show-help }
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
def show-help [] {
|
||
|
|
print "
|
||
|
|
Workspace secret management (shared tool)
|
||
|
|
|
||
|
|
Required workspace structure:
|
||
|
|
<workspace-root>/
|
||
|
|
├── templates/ YAML templates — one file per secret, keys with PLACEHOLDER values
|
||
|
|
└── infra/<infra>/
|
||
|
|
├── sops.yaml SOPS creation rules (age recipient, encrypted_regex)
|
||
|
|
├── .kage Age private key (NEVER commit — back up to vault)
|
||
|
|
├── secrets/ Encrypted *.sops.yaml output (safe to commit)
|
||
|
|
└── components/<name>.ncl Nickel component config (required by `new`)
|
||
|
|
|
||
|
|
Infra target (first wins): --infra <name> | WORKSPACE_INFRA env var
|
||
|
|
Workspace root (first wins): WORKSPACE_ROOT env var | current directory
|
||
|
|
Output format: --out/-o text|json (default text) — list, pending, info, get
|
||
|
|
--env-var/-e — get only: 'export KEY=value' lines
|
||
|
|
--env-prefix/-p <string> — get only: prefix each KEY (implies -e)
|
||
|
|
(-e/-p and --out json are mutually exclusive)
|
||
|
|
|
||
|
|
Commands:
|
||
|
|
gen Generate age keypair, write .kage, update sops.yaml
|
||
|
|
make <name> [KEY=value ...] Create SOPS-encrypted secret; prefers infra/<infra>/secrets/<name>.sops.yaml.template
|
||
|
|
over templates/<name>.yaml; staged template is deleted on success
|
||
|
|
new <name> [KEY=value ...] Derive template from component requires.credentials, then encrypt
|
||
|
|
Keys with credential_generators are auto-generated (no KEY=value needed)
|
||
|
|
Override any auto-generated key by supplying KEY=value explicitly
|
||
|
|
info <name> Show credentials and generators declared by a component
|
||
|
|
list List encrypted secrets; appends ??? section for pending staged templates
|
||
|
|
pending List only staged templates (*.sops.yaml.template) without encrypted secret
|
||
|
|
show <name> Decrypt and print for a human — plaintext, warning banner, no --out/-e
|
||
|
|
get <name> [key] Decrypt for script consumption — all keys or one key
|
||
|
|
text (default): KEY: value listing, or bare value for a single key
|
||
|
|
--out json: {name, values} or {name, key, value}
|
||
|
|
--env-var/-e: export KEY='value' lines (all keys or the one key)
|
||
|
|
--env-prefix/-p <string>: same, with <string> prepended to each KEY
|
||
|
|
edit <name> Open SOPS secret in \$EDITOR (decrypt/re-encrypt transparently)
|
||
|
|
|
||
|
|
Credential generators (declared in component NCL as credential_generators):
|
||
|
|
random_password Generates a random URL-safe password (length configurable)
|
||
|
|
wg_privkey Calls `wg genkey` — requires wireguard-tools
|
||
|
|
wg_pubkey Derives public key from an already-generated private key
|
||
|
|
bcrypt_password Calls `htpasswd -nbB` — derives bcrypt hash from a source key
|
||
|
|
|
||
|
|
Examples:
|
||
|
|
nu secrets.nu --infra libre-wuji gen
|
||
|
|
nu secrets.nu --infra libre-wuji info wireguard # show generators before creating
|
||
|
|
nu secrets.nu --infra libre-wuji new wireguard # all keys auto-generated
|
||
|
|
nu secrets.nu --infra libre-wuji new postgresql POSTGRES_PASSWORD=hunter2
|
||
|
|
nu secrets.nu --infra libre-wuji make hcloud token=hcloud_xxxxx
|
||
|
|
nu secrets.nu --infra libre-wuji list
|
||
|
|
nu secrets.nu --infra libre-wuji --out json list
|
||
|
|
nu secrets.nu --infra libre-wuji show postgresql
|
||
|
|
nu secrets.nu --infra libre-wuji get postgresql POSTGRES_PASSWORD
|
||
|
|
nu secrets.nu --infra libre-wuji -o json get postgresql
|
||
|
|
source <(nu secrets.nu --infra libre-wuji -e get wireguard)
|
||
|
|
source <(nu secrets.nu --infra libre-wuji -p WG_ get wireguard)
|
||
|
|
WORKSPACE_INFRA=libre-wuji nu secrets.nu edit docker_mailserver
|
||
|
|
"
|
||
|
|
}
|
||
|
|
|
||
|
|
# Generate age keypair and write sops.yaml
|
||
|
|
def cmd-gen [ctx: record] {
|
||
|
|
if (^which age-keygen | complete).exit_code != 0 {
|
||
|
|
error make --unspanned { msg: "age-keygen not found — install: brew install age" }
|
||
|
|
}
|
||
|
|
|
||
|
|
if ($ctx.kage_file | path exists) {
|
||
|
|
print $"⚠️ ($ctx.kage_file) already exists"
|
||
|
|
print "Overwrite? This invalidates all existing encrypted secrets. [y/N] "
|
||
|
|
let ans = (input "")
|
||
|
|
if $ans not-in ["y", "Y"] { print "Aborted."; return }
|
||
|
|
^rm -f $ctx.kage_file
|
||
|
|
}
|
||
|
|
|
||
|
|
let result = (do { ^age-keygen -o $ctx.kage_file } | complete)
|
||
|
|
if $result.exit_code != 0 {
|
||
|
|
error make --unspanned { msg: $"age-keygen failed: ($result.stderr)" }
|
||
|
|
}
|
||
|
|
|
||
|
|
let pub_key = (
|
||
|
|
open --raw $ctx.kage_file
|
||
|
|
| lines
|
||
|
|
| where { $in | str starts-with "# public key: " }
|
||
|
|
| first
|
||
|
|
| str replace "# public key: " ""
|
||
|
|
| str trim
|
||
|
|
)
|
||
|
|
|
||
|
|
print $"✓ Age keypair generated"
|
||
|
|
print $" private key: ($ctx.kage_file)"
|
||
|
|
print $" public key: ($pub_key)"
|
||
|
|
|
||
|
|
let base_keys = ["api_key" "certificate" "key" "password" "secret" "token"
|
||
|
|
"AWS_ACCESS_KEY_ID" "AWS_SECRET_ACCESS_KEY"
|
||
|
|
"RESTIC_PASSWORD" "RESTIC_REPOSITORY" "KOPIA_PASSWORD"
|
||
|
|
"RELAY_USER" "RELAY_USERNAME" "RELAY_PASSWORD" "ADMIN_PASSWORD"]
|
||
|
|
let regex = $"^(($base_keys | sort | str join '|'))$"
|
||
|
|
let sops_content = ([
|
||
|
|
"creation_rules:"
|
||
|
|
' - path_regex: "secrets/.*\\.sops\\.yaml$"'
|
||
|
|
$" age: ($pub_key)"
|
||
|
|
$' encrypted_regex: "($regex)"'
|
||
|
|
] | str join "\n")
|
||
|
|
$"($sops_content)\n" | save --force $ctx.sops_yaml
|
||
|
|
print $"✓ ($ctx.sops_yaml) updated"
|
||
|
|
|
||
|
|
let gitignore = ($ctx.infra_dir | path join ".gitignore")
|
||
|
|
let required_entries = [".kage" "secrets/*.sops.yaml.template"]
|
||
|
|
let existing = if ($gitignore | path exists) { open --raw $gitignore } else { "" }
|
||
|
|
let missing = ($required_entries | where {|e| not ($existing | str contains $e)})
|
||
|
|
if ($missing | is-not-empty) {
|
||
|
|
if not ($gitignore | path exists) {
|
||
|
|
"# do not commit age private keys or staged secret templates\n" | save $gitignore
|
||
|
|
}
|
||
|
|
for e in $missing {
|
||
|
|
$"\n($e)\n" | save --append $gitignore
|
||
|
|
}
|
||
|
|
}
|
||
|
|
print "⚠️ Back up .kage securely — it cannot be recovered if lost."
|
||
|
|
}
|
||
|
|
|
||
|
|
# Create SOPS-encrypted secret(s) from existing template(s) + KEY=value pairs.
|
||
|
|
# Accepts multiple names and glob patterns expanded against templates/.
|
||
|
|
def cmd-make [ctx: record, args: list<string>] {
|
||
|
|
if ($args | is-empty) {
|
||
|
|
error make --unspanned { msg: "Usage: make [--force] <name|pattern> [name ...] [KEY=value ...]" }
|
||
|
|
}
|
||
|
|
|
||
|
|
let force = ("--force" in $args) or ("-f" in $args)
|
||
|
|
let rest = ($args | where { |a| $a != "--force" and $a != "-f" })
|
||
|
|
let pairs = ($rest | where { |a| $a | str contains "=" })
|
||
|
|
let raw_names = ($rest | where { |a| not ($a | str contains "=") } | each { str replace --regex '\.yaml$' "" })
|
||
|
|
|
||
|
|
let names = ($raw_names | each {|n|
|
||
|
|
if ($n | str contains "*") or ($n | str contains "?") {
|
||
|
|
let matches = (try { glob ($ctx.templates_dir | path join $"($n).yaml") } catch { [] })
|
||
|
|
if ($matches | is-empty) {
|
||
|
|
error make --unspanned { msg: $"Pattern '($n)' matched no templates in ($ctx.templates_dir)" }
|
||
|
|
}
|
||
|
|
$matches | each {|f| $f | path basename | str replace --regex '\.yaml$' "" }
|
||
|
|
} else {
|
||
|
|
[$n]
|
||
|
|
}
|
||
|
|
} | flatten)
|
||
|
|
|
||
|
|
if ($names | is-empty) {
|
||
|
|
error make --unspanned { msg: "No names resolved from arguments" }
|
||
|
|
}
|
||
|
|
|
||
|
|
if ($names | length) == 1 {
|
||
|
|
_cmd-make-one $ctx ($names | first) $pairs $force
|
||
|
|
} else {
|
||
|
|
for name in $names {
|
||
|
|
print $"── ($name)"
|
||
|
|
_cmd-make-one $ctx $name $pairs $force
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
def _cmd-make-one [ctx: record, name: string, pairs: list<string>, force: bool] {
|
||
|
|
let staged_path = ($ctx.secrets_dir | path join $"($name).sops.yaml.template")
|
||
|
|
let infra_tpl = ($ctx.secrets_dir | path join "templates" $"($name).yaml")
|
||
|
|
let generic_path = ($ctx.templates_dir | path join $"($name).yaml")
|
||
|
|
let prov_root = ($env.PROVISIONING? | default "/usr/local/provisioning")
|
||
|
|
let global_path = ($prov_root | path join "workspace" "tools" "templates" $"($name).yaml")
|
||
|
|
|
||
|
|
let tpl = if ($staged_path | path exists) {
|
||
|
|
{ path: $staged_path, staged: true }
|
||
|
|
} else if ($infra_tpl | path exists) {
|
||
|
|
{ path: $infra_tpl, staged: false }
|
||
|
|
} else if ($generic_path | path exists) {
|
||
|
|
{ path: $generic_path, staged: false }
|
||
|
|
} else if ($global_path | path exists) {
|
||
|
|
{ path: $global_path, staged: false }
|
||
|
|
} else {
|
||
|
|
let avail = (try {
|
||
|
|
ls $ctx.templates_dir
|
||
|
|
| where type == file
|
||
|
|
| get name
|
||
|
|
| each {|f| $f | path basename | str replace ".yaml" ""}
|
||
|
|
| str join ", "
|
||
|
|
} catch { "" })
|
||
|
|
let infra_tpl_avail = (try {
|
||
|
|
ls ($ctx.secrets_dir | path join "templates")
|
||
|
|
| where type == file
|
||
|
|
| get name
|
||
|
|
| each {|f| $f | path basename | str replace ".yaml" ""}
|
||
|
|
| str join ", "
|
||
|
|
} catch { "" })
|
||
|
|
let global_avail = (try {
|
||
|
|
ls ($prov_root | path join "workspace" "tools" "templates")
|
||
|
|
| where type == file
|
||
|
|
| get name
|
||
|
|
| each {|f| $f | path basename | str replace ".yaml" ""}
|
||
|
|
| str join ", "
|
||
|
|
} catch { "" })
|
||
|
|
error make --unspanned {
|
||
|
|
msg: $"Template '($name)' not found. Checked:\n ($staged_path)\n ($infra_tpl)\n ($generic_path)\n ($global_path)\nAvailable in secrets/templates/: ($infra_tpl_avail)\nAvailable in templates/: ($avail)\nAvailable in global templates/: ($global_avail)"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
_assert-sops-ready $ctx
|
||
|
|
|
||
|
|
mkdir $ctx.secrets_dir
|
||
|
|
let output = ($ctx.secrets_dir | path join $"($name).sops.yaml")
|
||
|
|
|
||
|
|
if ($output | path exists) and not $force {
|
||
|
|
print $" ($output) already exists"
|
||
|
|
let ans = (input " Overwrite? [y/N] ")
|
||
|
|
if $ans not-in ["y", "Y"] {
|
||
|
|
print " skipped"
|
||
|
|
return
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
let overrides = (_parse-pairs $pairs)
|
||
|
|
|
||
|
|
# Staged templates: YAML-based key overrides (values may be real or CHANGE_ME sentinels).
|
||
|
|
# Generic templates: positional PLACEHOLDER replacement (original behaviour).
|
||
|
|
let content = if $tpl.staged and not ($overrides | is-empty) {
|
||
|
|
mut rec = (open --raw $tpl.path | from yaml)
|
||
|
|
for kv in ($overrides | items {|k v| {key: $k, val: $v}}) {
|
||
|
|
$rec = ($rec | upsert $kv.key $kv.val)
|
||
|
|
}
|
||
|
|
$rec | to yaml
|
||
|
|
} else if not $tpl.staged {
|
||
|
|
mut c = (open --raw $tpl.path)
|
||
|
|
for kv in ($overrides | items {|k v| {key: $k, val: $v}}) {
|
||
|
|
$c = ($c | str replace "PLACEHOLDER" $kv.val)
|
||
|
|
}
|
||
|
|
$c
|
||
|
|
} else {
|
||
|
|
open --raw $tpl.path
|
||
|
|
}
|
||
|
|
|
||
|
|
# Keys come from the actual content to encrypt — covers both standalone and cmd-new paths.
|
||
|
|
# Must happen before sops encrypt so the regex is up to date.
|
||
|
|
let content_keys = (try { $content | from yaml | columns } | default [])
|
||
|
|
let regex_updated = (_ensure-keys-in-regex $ctx $content_keys)
|
||
|
|
|
||
|
|
$content | save --force $output
|
||
|
|
|
||
|
|
let enc = (do {
|
||
|
|
with-env { SOPS_AGE_KEY_FILE: $ctx.kage_file } {
|
||
|
|
^sops --encrypt --in-place --config $ctx.sops_yaml $output
|
||
|
|
}
|
||
|
|
} | complete)
|
||
|
|
|
||
|
|
if $enc.exit_code != 0 {
|
||
|
|
^rm -f $output
|
||
|
|
error make --unspanned { msg: $"sops encrypt failed:\n($enc.stderr)" }
|
||
|
|
}
|
||
|
|
|
||
|
|
print $"✓ ($output) created"
|
||
|
|
print $" Keys encrypted: ($content_keys | str join ', ')"
|
||
|
|
|
||
|
|
if $tpl.staged {
|
||
|
|
^rm -f $tpl.path
|
||
|
|
print $" Staged template removed: ($tpl.path | path basename)"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Derive template from component requires.credentials, then call cmd-make
|
||
|
|
def cmd-new [ctx: record, args: list<string>] {
|
||
|
|
if ($args | is-empty) {
|
||
|
|
error make --unspanned { msg: "Usage: new <name> [KEY=value ...]" }
|
||
|
|
}
|
||
|
|
|
||
|
|
let name = ($args | first | str replace --regex '\.yaml$' "")
|
||
|
|
let pairs = ($args | skip 1)
|
||
|
|
let ncl_path = do {
|
||
|
|
let p1 = ($ctx.infra_dir | path join "components" $"($name).ncl")
|
||
|
|
let p2 = ($ctx.infra_dir | path join "components" $"($name | str replace --all '_' '-').ncl")
|
||
|
|
if ($p1 | path exists) { $p1 } else { $p2 }
|
||
|
|
}
|
||
|
|
|
||
|
|
if not ($ncl_path | path exists) {
|
||
|
|
cmd-make $ctx $args
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
# Guard: staged template takes priority in _cmd-make-one, which would orphan the
|
||
|
|
# workspace template that cmd-new is about to generate with real credential values.
|
||
|
|
let staged_path = ($ctx.secrets_dir | path join $"($name).sops.yaml.template")
|
||
|
|
if ($staged_path | path exists) {
|
||
|
|
error make --unspanned {
|
||
|
|
msg: $"Staged template already exists: ($staged_path)\nEncrypt it with 'secret-make ($name)', or remove it to regenerate credentials via 'secret-new'."
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
let prov_root = ($env.PROVISIONING? | default "/usr/local/provisioning")
|
||
|
|
let export = (do {
|
||
|
|
^nickel export --format json --import-path $prov_root $ncl_path
|
||
|
|
} | complete)
|
||
|
|
|
||
|
|
if $export.exit_code != 0 {
|
||
|
|
error make --unspanned { msg: $"nickel export failed for ($name):\n($export.stderr)" }
|
||
|
|
}
|
||
|
|
|
||
|
|
let comp = ($export.stdout | from json)
|
||
|
|
let name_key = ($name | str replace --all '-' '_')
|
||
|
|
let entry = ($comp | get -o $name_key | default ($comp | get -o $name | default {}))
|
||
|
|
let creds = ($entry | get -o requires | default {} | get -o credentials | default [])
|
||
|
|
|
||
|
|
if ($creds | is-empty) {
|
||
|
|
error make --unspanned { msg: $"Component '($name)' has no requires.credentials — nothing to template" }
|
||
|
|
}
|
||
|
|
|
||
|
|
let generators = ($entry | get -o credential_generators | default {})
|
||
|
|
|
||
|
|
# Generate values: process in order so dependent generators (wg_pubkey) see already-generated keys.
|
||
|
|
mut generated: record = {}
|
||
|
|
for k in $creds {
|
||
|
|
let gen = ($generators | get -o $k | default {})
|
||
|
|
let supplied = ($pairs | where {|p| $p | str starts-with $"($k)=" } | get 0? | default "")
|
||
|
|
let value = if ($supplied | is-not-empty) {
|
||
|
|
$supplied | str replace $"($k)=" ""
|
||
|
|
} else if ($gen | is-not-empty) {
|
||
|
|
_generate-value $k $gen $generated
|
||
|
|
} else {
|
||
|
|
"PLACEHOLDER"
|
||
|
|
}
|
||
|
|
$generated = ($generated | insert $k $value)
|
||
|
|
}
|
||
|
|
|
||
|
|
let values_map = $generated # immutable copy — mut can't be captured in closures
|
||
|
|
mkdir $ctx.templates_dir
|
||
|
|
let template_path = ($ctx.templates_dir | path join $"($name).yaml")
|
||
|
|
let content = ($creds | each {|k| $"($k): ($values_map | get $k)" } | str join "\n")
|
||
|
|
$"($content)\n" | save --force $template_path
|
||
|
|
print $"✓ Template generated: ($template_path)"
|
||
|
|
print $" Credentials: ($creds | str join ', ')"
|
||
|
|
if ($generators | is-not-empty) {
|
||
|
|
let auto = ($creds | where {|k| ($generators | get -o $k | default {} | is-not-empty) and ($pairs | where {|p| $p | str starts-with $"($k)=" } | is-empty) })
|
||
|
|
if ($auto | is-not-empty) {
|
||
|
|
print $" Auto-generated: ($auto | str join ', ')"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
_cmd-make-one $ctx $name [] false
|
||
|
|
}
|
||
|
|
|
||
|
|
# Show credentials and generators declared by a component
|
||
|
|
def cmd-info [ctx: record, name: string] {
|
||
|
|
if ($name | is-empty) {
|
||
|
|
error make --unspanned { msg: "Usage: info <name>" }
|
||
|
|
}
|
||
|
|
let name = ($name | str replace --regex '\.yaml$' "")
|
||
|
|
let ncl_path = ($ctx.infra_dir | path join "components" $"($name).ncl")
|
||
|
|
if not ($ncl_path | path exists) {
|
||
|
|
error make --unspanned { msg: $"Component config not found: ($ncl_path)" }
|
||
|
|
}
|
||
|
|
let prov_root = ($env.PROVISIONING? | default "/usr/local/provisioning")
|
||
|
|
let export = (do { ^nickel export --format json --import-path $prov_root $ncl_path } | complete)
|
||
|
|
|
||
|
|
if $export.exit_code != 0 {
|
||
|
|
error make --unspanned { msg: $"nickel export failed for ($name):\n($export.stderr)" }
|
||
|
|
}
|
||
|
|
let entry = ($export.stdout | from json | get -o $name | default {})
|
||
|
|
let creds = ($entry | get -o requires | default {} | get -o credentials | default [])
|
||
|
|
let gens = ($entry | get -o credential_generators | default {})
|
||
|
|
|
||
|
|
let secret_path = ($ctx.secrets_dir | path join $"($name).sops.yaml")
|
||
|
|
let secret_status = if ($secret_path | path exists) { "exists" } else { "not created" }
|
||
|
|
|
||
|
|
if $ctx.out_format == "json" {
|
||
|
|
let credentials = ($creds | each {|k|
|
||
|
|
let gen = ($gens | get -o $k | default {})
|
||
|
|
let kind = ($gen.kind? | default "")
|
||
|
|
{
|
||
|
|
key: $k,
|
||
|
|
generator: $kind,
|
||
|
|
auto: ($kind | is-not-empty),
|
||
|
|
}
|
||
|
|
})
|
||
|
|
{
|
||
|
|
component: $name,
|
||
|
|
secret_path: $secret_path,
|
||
|
|
secret_status: $secret_status,
|
||
|
|
credentials: $credentials,
|
||
|
|
} | to json | print
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
print $"\nComponent: ($name)"
|
||
|
|
print $"Secret: ($secret_path) \(($secret_status)\)"
|
||
|
|
print ""
|
||
|
|
if ($creds | is-empty) {
|
||
|
|
print " No credentials declared (requires.credentials is empty)"
|
||
|
|
} else {
|
||
|
|
print " Key Generator Action"
|
||
|
|
print " ─────────────────── ───────────────── ──────────────────────────────"
|
||
|
|
for k in $creds {
|
||
|
|
let gen = ($gens | get -o $k | default {})
|
||
|
|
let kind = ($gen.kind? | default "")
|
||
|
|
let gen_label = match $kind {
|
||
|
|
"random_password" => $"random_password \(len=($gen.length? | default 32)\)"
|
||
|
|
"wg_privkey" => "wg genkey"
|
||
|
|
"wg_pubkey" => $"wg pubkey ← ($gen.source? | default 'WG_PRIVATE_KEY')"
|
||
|
|
"bcrypt_password" => $"htpasswd -nbB ← ($gen.source? | default 'WGUI_PASSWORD')"
|
||
|
|
"" => "— manual (PLACEHOLDER)"
|
||
|
|
_ => $kind
|
||
|
|
}
|
||
|
|
let action = if ($kind | is-not-empty) { "auto-generated" } else { "supply KEY=value" }
|
||
|
|
print $" ($k | fill -w 20) ($gen_label | fill -w 18) ($action)"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
print ""
|
||
|
|
if ($secret_path | path exists) {
|
||
|
|
print $" Run: just secret-show ($name) to inspect current values"
|
||
|
|
} else {
|
||
|
|
print $" Run: just secret-new ($name) to create (auto-generates keys above)"
|
||
|
|
}
|
||
|
|
print ""
|
||
|
|
}
|
||
|
|
|
||
|
|
# List encrypted secrets and flag staged templates that have not been encrypted yet
|
||
|
|
def cmd-list [ctx: record] {
|
||
|
|
let sops_files = (try { glob $"($ctx.secrets_dir)/*.sops.yaml" } catch { [] })
|
||
|
|
let tpl_files = (try { glob $"($ctx.secrets_dir)/*.sops.yaml.template" } catch { [] })
|
||
|
|
|
||
|
|
let secrets = (
|
||
|
|
$sops_files
|
||
|
|
| each {|f|
|
||
|
|
let info = (ls $f | first)
|
||
|
|
{
|
||
|
|
name: ($f | path basename | str replace ".sops.yaml" ""),
|
||
|
|
size: $info.size,
|
||
|
|
modified: $info.modified,
|
||
|
|
}
|
||
|
|
}
|
||
|
|
)
|
||
|
|
|
||
|
|
let pending = (
|
||
|
|
$tpl_files
|
||
|
|
| each {|t|
|
||
|
|
let name = ($t | path basename | str replace ".sops.yaml.template" "")
|
||
|
|
let sops = ($ctx.secrets_dir | path join $"($name).sops.yaml")
|
||
|
|
if not ($sops | path exists) { [$name] } else { [] }
|
||
|
|
}
|
||
|
|
| flatten
|
||
|
|
)
|
||
|
|
|
||
|
|
if $ctx.out_format == "json" {
|
||
|
|
{ secrets_dir: $ctx.secrets_dir, secrets: $secrets, pending: $pending } | to json | print
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
if ($sops_files | is-empty) and ($tpl_files | is-empty) {
|
||
|
|
print $"No encrypted secrets or staged templates found in ($ctx.secrets_dir)"
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
if ($sops_files | is-not-empty) {
|
||
|
|
print $"\nEncrypted secrets in ($ctx.secrets_dir):\n"
|
||
|
|
for s in $secrets {
|
||
|
|
let mod = ($s.modified | format date "%Y-%m-%d %H:%M")
|
||
|
|
print $" ($s.name) ($s.size) ($mod)"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
if ($pending | is-not-empty) {
|
||
|
|
print $"\n Pending — template staged, secret not yet encrypted:\n"
|
||
|
|
for name in $pending {
|
||
|
|
print $" ??? ($name)"
|
||
|
|
}
|
||
|
|
print $"\n Run: just secret-make <name> to encrypt a pending secret"
|
||
|
|
}
|
||
|
|
|
||
|
|
print ""
|
||
|
|
}
|
||
|
|
|
||
|
|
# List only staged templates (*.sops.yaml.template) without a corresponding encrypted secret
|
||
|
|
def cmd-pending [ctx: record] {
|
||
|
|
let tpl_files = (try { glob $"($ctx.secrets_dir)/*.sops.yaml.template" } catch { [] })
|
||
|
|
|
||
|
|
let pending = (
|
||
|
|
$tpl_files
|
||
|
|
| each {|t|
|
||
|
|
let name = ($t | path basename | str replace ".sops.yaml.template" "")
|
||
|
|
let sops = ($ctx.secrets_dir | path join $"($name).sops.yaml")
|
||
|
|
if not ($sops | path exists) { [$name] } else { [] }
|
||
|
|
}
|
||
|
|
| flatten
|
||
|
|
)
|
||
|
|
|
||
|
|
if $ctx.out_format == "json" {
|
||
|
|
{ secrets_dir: $ctx.secrets_dir, pending: $pending } | to json | print
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
if ($tpl_files | is-empty) {
|
||
|
|
print "No staged templates found"
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
if ($pending | is-empty) {
|
||
|
|
print "No pending secrets — all staged templates have a corresponding encrypted secret"
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
print $"\nPending secrets in ($ctx.secrets_dir):\n"
|
||
|
|
for name in $pending {
|
||
|
|
print $" ??? ($name | fill -w 30) run: just secret-make ($name)"
|
||
|
|
}
|
||
|
|
print ""
|
||
|
|
}
|
||
|
|
|
||
|
|
# Decrypt and print a secret for human inspection (plaintext, with warning banner).
|
||
|
|
def cmd-show [ctx: record, name: string] {
|
||
|
|
if ($name | is-empty) {
|
||
|
|
error make --unspanned { msg: "Usage: show <name>" }
|
||
|
|
}
|
||
|
|
let name = ($name | str replace --regex '\.yaml$' "")
|
||
|
|
let path = ($ctx.secrets_dir | path join $"($name).sops.yaml")
|
||
|
|
_assert-secret-exists $path $name
|
||
|
|
_assert-kage-exists $ctx.kage_file
|
||
|
|
|
||
|
|
print $"⚠️ Decrypted content of ($name):\n"
|
||
|
|
with-env { SOPS_AGE_KEY_FILE: $ctx.kage_file } {
|
||
|
|
^sops --decrypt --config $ctx.sops_yaml $path
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Decrypt and return a secret's value(s) for script consumption.
|
||
|
|
# `get <name>` — all keys: text (KEY: value), --out json, or -e/--env-var (export lines)
|
||
|
|
# `get <name> <key>` — one key: bare value (text), {key,value} (json), or export line (-e)
|
||
|
|
def cmd-get [ctx: record, args: list<string>] {
|
||
|
|
if ($args | is-empty) {
|
||
|
|
error make --unspanned { msg: "Usage: get <name> [key]" }
|
||
|
|
}
|
||
|
|
let name = ($args | first | str replace --regex '\.yaml$' "")
|
||
|
|
let key = ($args | get 1? | default "")
|
||
|
|
let path = ($ctx.secrets_dir | path join $"($name).sops.yaml")
|
||
|
|
_assert-secret-exists $path $name
|
||
|
|
_assert-kage-exists $ctx.kage_file
|
||
|
|
|
||
|
|
let dec = (with-env { SOPS_AGE_KEY_FILE: $ctx.kage_file } {
|
||
|
|
^sops --decrypt --config $ctx.sops_yaml $path
|
||
|
|
} | complete)
|
||
|
|
if $dec.exit_code != 0 {
|
||
|
|
error make --unspanned { msg: $"sops decrypt failed:\n($dec.stderr)" }
|
||
|
|
}
|
||
|
|
let values = ($dec.stdout | from yaml)
|
||
|
|
|
||
|
|
if ($key | is-not-empty) {
|
||
|
|
if $key not-in ($values | columns) {
|
||
|
|
error make --unspanned { msg: $"Key '($key)' not found in secret '($name)' — available: ($values | columns | str join ', ')" }
|
||
|
|
}
|
||
|
|
let val = ($values | get $key)
|
||
|
|
if $ctx.env_var {
|
||
|
|
let var_name = ($"($ctx.env_prefix)($key)" | str upcase)
|
||
|
|
print $"export ($var_name)=(_shell-quote ($val | into string))"
|
||
|
|
} else if $ctx.out_format == "json" {
|
||
|
|
{ name: $name, key: $key, value: $val } | to json | print
|
||
|
|
} else {
|
||
|
|
print $val
|
||
|
|
}
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
if $ctx.env_var {
|
||
|
|
for kv in ($values | items {|k, v| {key: $k, val: $v} }) {
|
||
|
|
let var_name = ($"($ctx.env_prefix)($kv.key)" | str upcase)
|
||
|
|
print $"export ($var_name)=(_shell-quote ($kv.val | into string))"
|
||
|
|
}
|
||
|
|
} else if $ctx.out_format == "json" {
|
||
|
|
{ name: $name, values: $values } | to json | print
|
||
|
|
} else {
|
||
|
|
for kv in ($values | items {|k, v| {key: $k, val: $v} }) {
|
||
|
|
print $"($kv.key): ($kv.val)"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Single-quote a value for safe use in a POSIX shell `export KEY=value` line.
|
||
|
|
def _shell-quote [val: string]: nothing -> string {
|
||
|
|
$"'($val | str replace --all "'" "'\\''")'"
|
||
|
|
}
|
||
|
|
|
||
|
|
# Open SOPS secret in $EDITOR — decrypt on open, re-encrypt on save
|
||
|
|
def cmd-edit [ctx: record, name: string] {
|
||
|
|
if ($name | is-empty) {
|
||
|
|
error make --unspanned { msg: "Usage: edit <name>" }
|
||
|
|
}
|
||
|
|
let name = ($name | str replace --regex '\.yaml$' "")
|
||
|
|
let path = ($ctx.secrets_dir | path join $"($name).sops.yaml")
|
||
|
|
_assert-secret-exists $path $name
|
||
|
|
_assert-kage-exists $ctx.kage_file
|
||
|
|
|
||
|
|
let editor = (match ($env.EDITOR? | default "vim") {
|
||
|
|
"zed" => "vim",
|
||
|
|
$e => $e,
|
||
|
|
})
|
||
|
|
with-env { SOPS_AGE_KEY_FILE: $ctx.kage_file, EDITOR: $editor } {
|
||
|
|
do --ignore-errors { ^sops --config $ctx.sops_yaml $path }
|
||
|
|
}
|
||
|
|
let code = $env.LAST_EXIT_CODE
|
||
|
|
if $code != 0 and $code != 200 {
|
||
|
|
error make --unspanned { msg: $"sops failed (exit ($code))" }
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Generate a credential value using the generator spec from the component config.
|
||
|
|
# `generated` carries already-generated values so dependent keys (e.g. wg_pubkey) can reference them.
|
||
|
|
def _generate-value [key: string, gen: record, generated: record]: nothing -> string {
|
||
|
|
match ($gen.kind? | default "") {
|
||
|
|
"random_password" => {
|
||
|
|
let len = ($gen.length? | default 32 | into int)
|
||
|
|
let r = (do { ^openssl rand -base64 64 } | complete)
|
||
|
|
if $r.exit_code == 0 {
|
||
|
|
$r.stdout | str trim
|
||
|
|
| str replace --all "=" ""
|
||
|
|
| str replace --all "/" "_"
|
||
|
|
| str replace --all "+" "-"
|
||
|
|
| str substring 0..$len
|
||
|
|
} else {
|
||
|
|
random chars --length $len
|
||
|
|
}
|
||
|
|
}
|
||
|
|
"wg_privkey" => {
|
||
|
|
if (^which wg | complete).exit_code != 0 {
|
||
|
|
error make --unspanned { msg: $"wg_privkey: `wg` not found — install wireguard-tools\n macOS: brew install wireguard-tools\n Debian: apt-get install -y wireguard-tools" }
|
||
|
|
}
|
||
|
|
let r = (do { ^wg genkey } | complete)
|
||
|
|
if $r.exit_code == 0 { $r.stdout | str trim } else {
|
||
|
|
error make --unspanned { msg: $"wg genkey failed: ($r.stderr | str trim)" }
|
||
|
|
}
|
||
|
|
}
|
||
|
|
"wg_pubkey" => {
|
||
|
|
if (^which wg | complete).exit_code != 0 {
|
||
|
|
error make --unspanned { msg: $"wg_pubkey: `wg` not found — install wireguard-tools\n macOS: brew install wireguard-tools\n Debian: apt-get install -y wireguard-tools" }
|
||
|
|
}
|
||
|
|
let source = ($gen.source? | default "WG_PRIVATE_KEY")
|
||
|
|
let priv = ($generated | get -o $source | default "")
|
||
|
|
if ($priv | is-empty) {
|
||
|
|
error make --unspanned { msg: $"wg_pubkey: source key ($source) must be generated before ($key)" }
|
||
|
|
}
|
||
|
|
let r = (do { $priv | ^wg pubkey } | complete)
|
||
|
|
if $r.exit_code == 0 { $r.stdout | str trim } else {
|
||
|
|
error make --unspanned { msg: $"wg pubkey failed: ($r.stderr | str trim)" }
|
||
|
|
}
|
||
|
|
}
|
||
|
|
"bcrypt_password" => {
|
||
|
|
if (^which htpasswd | complete).exit_code != 0 {
|
||
|
|
error make --unspanned { msg: $"bcrypt_password: `htpasswd` not found — install apache2-utils/httpd\n macOS: brew install httpd\n Debian: apt-get install -y apache2-utils" }
|
||
|
|
}
|
||
|
|
let source = ($gen.source? | default "WGUI_PASSWORD")
|
||
|
|
let plaintext = ($generated | get -o $source | default "")
|
||
|
|
if ($plaintext | is-empty) {
|
||
|
|
error make --unspanned { msg: $"bcrypt_password: source key ($source) must be generated before ($key)" }
|
||
|
|
}
|
||
|
|
let r = (do { ^htpasswd -nbB -C 12 wg $plaintext } | complete)
|
||
|
|
if $r.exit_code == 0 {
|
||
|
|
$r.stdout | str trim | split row ":" | get 1 | str trim
|
||
|
|
} else {
|
||
|
|
error make --unspanned { msg: $"htpasswd failed: ($r.stderr | str trim)" }
|
||
|
|
}
|
||
|
|
}
|
||
|
|
_ => { "PLACEHOLDER" }
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Parse KEY=value pairs into a record
|
||
|
|
def _parse-pairs [pairs: list<string>]: nothing -> record {
|
||
|
|
$pairs | reduce --fold {} {|pair, acc|
|
||
|
|
let parts = ($pair | split row "=" | collect)
|
||
|
|
if ($parts | length) < 2 {
|
||
|
|
error make --unspanned { msg: $"Invalid KEY=value pair: ($pair)" }
|
||
|
|
}
|
||
|
|
let k = ($parts | first)
|
||
|
|
let v = ($parts | skip 1 | str join "=")
|
||
|
|
$acc | insert $k $v
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Ensure all given keys appear in the sops.yaml encrypted_regex.
|
||
|
|
# Parses the current regex, adds missing keys (sorted, deduplicated), writes back.
|
||
|
|
# Returns true if the regex was updated, false if already complete.
|
||
|
|
def _ensure-keys-in-regex [ctx: record, keys: list<string>]: nothing -> bool {
|
||
|
|
if not ($ctx.sops_yaml | path exists) { return false }
|
||
|
|
let raw = (open --raw $ctx.sops_yaml)
|
||
|
|
let regex_line = ($raw | lines | where {|l| $l | str contains "encrypted_regex"} | get 0?)
|
||
|
|
if ($regex_line | default "" | is-empty) { return false }
|
||
|
|
|
||
|
|
let current_keys = (
|
||
|
|
$regex_line
|
||
|
|
| str replace --regex '.*encrypted_regex:\s*"' ""
|
||
|
|
| str replace --regex '".*' ""
|
||
|
|
| str replace --regex '^\^?\(' ""
|
||
|
|
| str replace --regex '\)\$?$' ""
|
||
|
|
| split row "|"
|
||
|
|
| each { str trim }
|
||
|
|
| where { is-not-empty }
|
||
|
|
)
|
||
|
|
let missing = ($keys | where {|k| ($k | is-not-empty) and ($k not-in $current_keys) })
|
||
|
|
if ($missing | is-empty) { return false }
|
||
|
|
|
||
|
|
let updated_keys = ($current_keys ++ $missing | uniq | sort)
|
||
|
|
let new_regex = $"^(($updated_keys | str join '|'))$"
|
||
|
|
let new_line = ($regex_line | str replace --regex 'encrypted_regex:.*' $"encrypted_regex: \"($new_regex)\"")
|
||
|
|
let new_raw = ($raw | str replace $regex_line $new_line)
|
||
|
|
$new_raw | save --force $ctx.sops_yaml
|
||
|
|
print $" [+] sops.yaml regex updated — added: ($missing | str join ', ')"
|
||
|
|
true
|
||
|
|
}
|
||
|
|
|
||
|
|
def _assert-sops-ready [ctx: record] {
|
||
|
|
if not ($ctx.sops_yaml | path exists) {
|
||
|
|
error make --unspanned { msg: $"($ctx.sops_yaml) not found — run: secrets.nu --infra ($ctx.infra_name) gen" }
|
||
|
|
}
|
||
|
|
if not ($ctx.kage_file | path exists) {
|
||
|
|
error make --unspanned { msg: $"($ctx.kage_file) not found — run: secrets.nu --infra ($ctx.infra_name) gen" }
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
def _assert-secret-exists [path: string, name: string] {
|
||
|
|
if not ($path | path exists) {
|
||
|
|
error make --unspanned { msg: $"Secret '($name)' not found at ($path)" }
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
def _assert-kage-exists [kage_file: string] {
|
||
|
|
if not ($kage_file | path exists) {
|
||
|
|
error make --unspanned { msg: $"($kage_file) not found — cannot decrypt" }
|
||
|
|
}
|
||
|
|
}
|