Agenix: How to access absolute path, or alternative?

Help
1

I’d like to combine both word files into 1. The mywords in agenix contains names of people, I don’t want them to be readable in git. They can be readable in the /nix/store.

I get the following error:

error: access to absolute path ‘/run/agenix/files/programs/codebook/mywords’ is forbidden in pure evaluation mode (use ‘–impure’ to override)

let
  importStrings =
    path:
    builtins.filter (x: builtins.isString x && x != "" && !(lib.strings.hasPrefix "#" x)) (
      builtins.split "\n" (builtins.readFile path)
    );
in
{
  home-manager.users."myuser" = { pkgs, ... }: {
      xdg.configFile."codebook/codebook.toml".source = (pkgs.formats.toml { }).generate "codebook.toml" {
        dictionaries = [
          "en_us"
          "fr"
          "de"
          "it"
          "es"
        ];
        ## Words that should always be flagged as incorrect.
        flag_words = importStrings ./codebook_flag_words.md;
        ## Custom allowlist of words to ignore (case-insensitive).
        words =
          importStrings ./codebook_words_global.md
          ++ importStrings (config.age.secrets."codebook/mywords".path);
      };
  };
}
2

The is not what agenix is for. It is for creating files during activation containing secrets that are read during runtime of a service.

I think you are rather looking for something like storing them in a file and use git-crypt to encrypt them before they are stored in git.

3

This path won’t (be guaranteed to) exist during eval, so reading it doesn’t make sense.
And, as you found, reading any non-store path is disallowed with pure eval (which is enforced by flakes).

1 Like
`sops-nix` templates and home manager
4

Even worse: if it exists and you change it, it needs a second evaluation (switch) before it is used.

1 Like