From 1141c36c2642438e5b9a05bb1a2859ca6afccfc4 Mon Sep 17 00:00:00 2001
From: Ryan Mulligan <ryan@ryantm.com>
Date: Sun, 26 Feb 2023 08:37:02 -0800
Subject: [PATCH] fix: disallow Nix store paths in age.identityPaths option

---
 modules/age.nix | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/modules/age.nix b/modules/age.nix
index 8c99214..2a1bb29 100644
--- a/modules/age.nix
+++ b/modules/age.nix
@@ -174,6 +174,15 @@ with lib; let
       symlink = mkEnableOption "symlinking secrets to their destination" // {default = true;};
     };
   });
+
+  identity = with types;
+    mkOptionType {
+      name = "identity";
+      description = "Path to the identity for age decryption. Usually a path to an SSH key. Must not be a store path, because we do not want private keys to end up in the nix store.";
+      descriptionClass = "noun";
+      check = x: isStringLike x && !isStorePath x;
+      merge = mergeEqualOption;
+    };
 in {
   imports = [
     (mkRenamedOptionModule ["age" "sshKeyPaths"] ["age" "identityPaths"])
@@ -216,7 +225,7 @@ in {
       '';
     };
     identityPaths = mkOption {
-      type = types.listOf types.path;
+      type = types.listOf identity;
       default =
         if (config.services.openssh.enable or false)
         then map (e: e.path) (lib.filter (e: e.type == "rsa" || e.type == "ed25519") config.services.openssh.hostKeys)
@@ -226,9 +235,7 @@ in {
           "/etc/ssh/ssh_host_rsa_key"
         ]
         else [];
-      description = ''
-        Path to SSH keys to be used as identities in age decryption.
-      '';
+      description = "List of identities: ${identity.description}";
     };
   };