sops wrapper with eval of .sops.nix as .sops.yaml

[itzwam]

#!/usr/bin/env bash

set -euo pipefail

set -x

NIX_RULES="$(readlink -f ./.sops.nix)"
SOPS_RULES="/tmp/sopsnix_$(pwd | sha1sum | cut -d' ' -f1)"

nix eval --json -v -f $NIX_RULES --apply 'creation_rules: if builtins.isList creation_rules then { inherit creation_rules; } else throw "Unknown format for secrets.nix"' | yq -r . > "$SOPS_RULES.$$"
if ! diff --color -uN $SOPS_RULES $SOPS_RULES.$$; then
  mv $SOPS_RULES.$$ $SOPS_RULES
else
  rm $SOPS_RULES.$$
fi

SOPS_CONFIG="$SOPS_RULES" exec sops "$@"

something like that, so that we could be able to declare the secrets settings / keys directly from Nix
or I may have missed something about the module

[acid-bong]

one can do a git-hooks.nix-like shellHook for installing such a thing

• original: https://github.com/cachix/git-hooks.nix/blob/61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a/modules/pre-commit.nix#L480-L507
• my stripped-down version (see only up to nix-store --realize): https://codeberg.org/acidbong/nixos/src/commit/831b1d0e946d6a9902ebbe53b31250641ca28a77/parts/pre-commit.nix#L37-L43

but note that variable bindings (& and *) are YAML-specific, and Nix(pkgs) either uses builtins.toJSON or (pgks.formats.yaml {}).generate, which also passes things via JSON, so you'll only be able to pass them as Nix bindings

[SuperSandro2000]

What common scenario could we simplify by that? I am currently having a hard time imagining a good usecase for this compared to yaml anchors.