From b88c4c7bf6ff74b4077a84db9b60b2b83489265d Mon Sep 17 00:00:00 2001
From: Alexander Bantyev <balsoft@balsoft.ru>
Date: Wed, 29 Apr 2020 01:50:53 +0300
Subject: [PATCH] Handle locked secret.nix

---
 flake.lock          | 16 +++++++---------
 flake.nix           |  6 ------
 modules/secrets.nix |  3 ++-
 3 files changed, 9 insertions(+), 16 deletions(-)

diff --git a/flake.lock b/flake.lock
index 349d1f2..eb3116e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -257,20 +257,18 @@
     },
     "nixpkgs_4": {
       "info": {
-        "lastModified": 1587452212,
-        "narHash": "sha256-Sn9xtMrUYmXCT33yQjNh0tWFwY7jF5x4vCUrkcXDMCE="
+        "lastModified": 1588110642,
+        "narHash": "sha256-A5Sqy2PAJOYaTIjHOTo3ZFbUtd1r6uZf9ymcbSyMh9Q="
       },
       "locked": {
-        "owner": "nixos",
-        "repo": "nixpkgs-channels",
-        "rev": "22a3bf9fb9edad917fb6cd1066d58b5e426ee975",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a0ebabf60a3febbd0ba4b401b13503e1fae24934",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs-channels",
-        "type": "github"
+        "id": "nixpkgs",
+        "type": "indirect"
       }
     },
     "nixpkgs_5": {
diff --git a/flake.nix b/flake.nix
index 6220da4..9c38973 100644
--- a/flake.nix
+++ b/flake.nix
@@ -5,12 +5,6 @@
   edition = 201909;
 
   inputs = {
-    nixpkgs = {
-      type = "github";
-      owner = "nixos";
-      repo = "nixpkgs-channels";
-      ref = "nixos-unstable";
-    };
     NUR = {
       type = "github";
       owner = "nix-community";
diff --git a/modules/secrets.nix b/modules/secrets.nix
index 0e864c3..b63b90a 100755
--- a/modules/secrets.nix
+++ b/modules/secrets.nix
@@ -89,8 +89,9 @@ in rec {
     };
   };
   config = let
+    unlocked = import (pkgs.runCommand "check-secret" {} "set +e; grep -qI . ${../secret.nix}; echo $? > $out") == 0;
     secretnix = import ../secret.nix;
-    secrets = if isNull secretnix then
+    secrets = if ! unlocked || isNull secretnix then
       mapAttrs (n: v: null) options.secrets
     else
       secretnix;