secret.nix update

modules/applications/sylpheed.nix

@@ -19,7 +19,7 @@
       nntp_server=
       use_nntp_auth=0
       user_id=balsoft@balsoft.ru
-      password=${config.secrets.mail.password}
+      password=${config.secrets.mail.password or ""}
       inbox=inbox
       use_apop_auth=0
       remove_mail=1

modules/applications/weechat.nix

@@ -1,4 +1,4 @@
-{ pkgs, config, inputs, ... }:
+{ pkgs, lib, config, inputs, ... }:
 let
   weechat = pkgs.weechat.override {
     configure = { availablePlugins, ... }: {
@@ -18,19 +18,6 @@ in {
 
     home.file.".weechat/plugins.conf".text = ''
         [var]
-      lua.matrix.autojoin_on_invite = "on"
-      lua.matrix.backlog_lines = "120"
-      lua.matrix.debug = "off"
-      lua.matrix.encrypted_message_color = "lightgreen"
-      lua.matrix.homeserver_url = "https://matrix.balsoft.ru/"
-      lua.matrix.local_echo = "on"
-      lua.matrix.nick_style = "nick"
-      lua.matrix.password = "${config.secrets.matrix.password}"
-      lua.matrix.presence_filter = "on"
-      lua.matrix.read_receipts = "on"
-      lua.matrix.timeout = "20"
-      lua.matrix.typing_notices = "on"
-      lua.matrix.user = "${config.secrets.matrix.user}"
         python.slack.auto_open_threads = "true"
         python.slack.background_load_all_history = "true"
         python.slack.channel_name_typing_indicator = "true"
@@ -59,7 +46,7 @@ in {
         python.slack.short_buffer_names = "false"
         python.slack.show_buflist_presence = "true"
         python.slack.show_reaction_nicks = "true"
-      python.slack.slack_api_token = "${config.secrets.slack-term}"
+        python.slack.slack_api_token = "${if isNull config.secrets.slack-term then "" else config.secrets.slack-term}"
         python.slack.slack_timeout = "20000"
         python.slack.switch_buffer_on_join = "true"
         python.slack.thread_messages_in_channel = "false"

modules/applications/yt-utilities.nix

@@ -1,5 +1,5 @@
-{ pkgs, config, lib, ... }: {
-  home-manager.users.balsoft = lib.mkIf (config.deviceSpecific.goodMachine) {
+{ pkgs, config, lib, ... }: lib.mkIf (! isNull config.secrets.yt-utilities) {
+  home-manager.users.balsoft =  {
     home.file.".yt.yaml".text = builtins.toJSON {
       yt-token = config.secrets.yt-utilities.token;
       user = config.secrets.yt-utilities.user;
@@ -10,6 +10,5 @@
       since = "1997-11-19";
       severity = "Info";
     };
-    # home.packages = [ pkgs.yt-utilities ];
   };
 }

modules/mailserver.nix

@@ -66,12 +66,14 @@ in {
     ];
     dnsBlacklistOverrides = ''
       balsoft.ru OK
-      ${builtins.concatStringsSep " OK \n" (builtins.attrNames config.devices)} OK
+      ${
+        builtins.concatStringsSep " OK \n" (builtins.attrNames config.devices)
+      } OK
       192.168.0.0/16 OK
     '';
   };
-  mailserver = {
-    enable = ! isNull config.secrets.mail.host;
+  mailserver = lib.mkIf (! isNull config.secrets.mail) {
+    enable = true;
     fqdn = config.secrets.mail.host;
     domains = [ config.secrets.mail.host ];
     loginAccounts = {

modules/matrix-synapse.nix

@@ -1,4 +1,4 @@
-{ pkgs, config, lib, ... }: {
+{ pkgs, config, lib, ... }: lib.mkIf (! isNull config.secrets.matrix) {
   services.matrix-synapse = {
     enable = true;
     allow_guest_access = true;

modules/openvpn.nix

@@ -1,5 +1,5 @@
 { pkgs, config, lib, ... }:
-{
+lib.mkIf (! isNull config.secrets.openvpn) {
   services.openvpn = {
     servers = {
       client = {

modules/secrets.nix

@@ -27,24 +27,29 @@ in rec {
   options.secrets = {
     owm-key = secret "OpenWeatherMap key";
     irc = mkCredOption "IRC (konversation)" { };
-    slack-term = mkOption { type = str; };
-    yt-utilities = {
+    slack-term = secret "slack token";
+    yt-utilities = mkOption {
+      description = "youtrack";
+      type = nullOr (submodule {
+        options = {
           user = secret "youtrack user";
           url = secret "youtrack url";
           token = secret "youtrack token";
-      source = {
-        url = secret "A url to yt-utilities source";
-        rev = secret "revision";
-        sha256 = secret "sha256";
         };
+      });
     };
     wage = secret "wage (sum CURRENCY/TIME, like 10EUR/h)";
-    gcal = {
+    gcal = mkOption {
+      description = "Google calendar auth";
+      type = nullOr (submodule {
+        options = {
           email = mkOption { type = lib.types.str; };
           client-id = mkOption { type = lib.types.str; };
           client-secret = mkOption { type = lib.types.str; };
           refresh-token = mkOption { type = lib.types.str; };
         };
+      });
+    };
     mail = mkCredOption "email" {
       host = mkOption {
         type = str;
@@ -62,7 +67,10 @@ in rec {
       type = nullOr str;
       description = "Rclone config";
     };
-    ssl = rec {
+    ssl = mkOption {
+      description = "Certs";
+      type = nullOr (submodule {
+        options = {
           cert = mkOption {
             type = nullOr str;
             description = "SSL certificate";
@@ -72,27 +80,27 @@ in rec {
             description = "SSL RSA private key";
           };
         };
+      });
+    };
     matrix = mkCredOption "matrix" rec {
       shared_secret = mkOption {
         type = nullOr str;
         description = "A shared secret for matrix instance";
       };
       mautrix-whatsapp = {
-        config = mkOption {
-          type = attrs;
-        };
-        registration = mkOption {
-          type = attrs;
-        };
+        config = mkOption { type = attrs; };
+        registration = mkOption { type = attrs; };
       };
       mautrix-telegram = mautrix-whatsapp;
     };
   };
   config = let
-    unlocked = import (pkgs.runCommand "check-secret" {} "set +e; grep -qI . ${../secret.nix}; echo $? > $out") == 0;
+    unlocked = import (pkgs.runCommand "check-secret" { }
+      "set +e; grep -qI . ${../secret.nix}; echo $? > $out") == 0;
     secretnix = import ../secret.nix;
     secrets = if !unlocked || isNull secretnix then
-      mapAttrs (n: v: null) options.secrets
+      builtins.trace "secret.nix locked, building without any secrets"
+      (mapAttrs (n: v: null) options.secrets)
     else
       secretnix;
   in { inherit secrets; };

modules/workspace/gcalcli.nix

@@ -1,5 +1,5 @@
 { pkgs, lib, config, ... }: {
-  home-manager.users.balsoft = {
+  home-manager.users.balsoft = lib.mkIf (! isNull config.secrets.gcal) {
     home.file.".gcalcli_oauth.home".text = lib.optionals
     (!(isNull config.secrets.gcal)) (builtins.toJSON {
       access_token = "";

modules/workspace/i3blocks/default.nix

@@ -36,14 +36,10 @@ in {
   in ''
     interval=60
     markup=pango
-  '' + genIniOrdered (optional (config.secrets ? mail) (scr "email") ++ [
-    (scrint "weather" 600)
-    (scr "calendar")
-    (scr "emacs")
-    (scrint "youtrack-wage" 3600)
-    (scrint "music" 10)
-    (scrint "sound" 5)
-  ] ++ [
+  '' + genIniOrdered (optional (!isNull config.secrets.mail) (scr "email")
+    ++ [ (scrint "weather" 600) (scr "calendar") (scr "emacs") ]
+    ++ optional (!isNull config.secrets.wage) (scrint "youtrack-wage" 3600)
+    ++ [ (scrint "music" 10) (scrint "sound" 5) ] ++ [
       (scrint "cpu" 5)
       (scrint "freq" 10)
       (scr "temperature")
@@ -51,6 +47,7 @@ in {
     ] ++ optionals config.deviceSpecific.isLaptop [
       (scr "battery")
       (scrint "brightness" 5)
-  ] ++ optional (config.deviceSpecific.devInfo ? bigScreen) (scrint "network" 1)
+    ]
+    ++ optional (config.deviceSpecific.devInfo ? bigScreen) (scrint "network" 1)
     ++ [ (scrint "connections" 10) (scr "df") (scr "date") (scrint "time" 1) ]);
 }

modules/workspace/rclone.nix

@@ -1,5 +1,5 @@
 { pkgs, config, lib, ... }: {
-  home-manager.users.balsoft = {
+  home-manager.users.balsoft = lib.mkIf (!isNull config.secrets.rclone) {
     xdg.configFile."rclone/rclone.conf.home".text = config.secrets.rclone;
     home.activation."rclone" = {
       after = [ "linkGeneration" ];