traits: consistently describe manageSecrets options

1 files changed, 26 insertions, 22 deletions

diff --git a/modules/nixos/traits/hercules.nix b/modules/nixos/traits/hercules.nix
index fc3dbd0..14e8c12 100644
--- a/modules/nixos/traits/hercules.nix
+++ b/modules/nixos/traits/hercules.nix
@@ -9,39 +9,43 @@
 in {
   options.traits.hercules-ci = {
     enable = lib.mkEnableOption "hercules-ci";
-    manageSecrets = lib.mkEnableOption "automatic secrets management";
+    manageSecrets =
+      lib.mkEnableOption "automatic secrets management"
+      // {
+        default = config.traits.secrets.enable;
+      };
   };
 
   config = lib.mkIf cfg.enable (
     lib.mkMerge [
       {
-        services = {
-          hercules-ci-agent = {
-            enable = true;
-            package = unstable.hercules-ci-agent;
-            settings = {
-              binaryCachesPath = config.age.secrets.binaryCache.path;
-              clusterJoinTokenPath = config.age.secrets.clusterToken.path;
-              secretsJsonPath = config.age.secrets.secretsJson.path;
-            };
-          };
+        services.hercules-ci-agent = {
+          enable = true;
+          package = unstable.hercules-ci-agent;
         };
       }
 
       (let
-        hercArgs = {
-          mode = "400";
-          owner = "hercules-ci-agent";
-          group = "hercules-ci-agent";
-        };
-
-        mkSecrets = lib.mapAttrs (_: file: lib.recursiveUpdate hercArgs {inherit file;});
+        secretNames = [
+          "binaryCaches"
+          "clusterJoinToken"
+          "secretsJson"
+        ];
       in
         lib.mkIf cfg.manageSecrets {
-          age.secrets = mkSecrets {
-            binaryCache = secretsDir + "/binaryCache.age";
-            clusterToken = secretsDir + "/clusterToken.age";
-            secretsJson = secretsDir + "/secretsJson.age";
+          age.secrets = lib.genAttrs secretNames (
+            file: {
+              file = "${secretsDir}/${file}.age";
+              mode = "400";
+              owner = "hercules-ci-agent";
+              group = "hercules-ci-agent";
+            }
+          );
+
+          services.hercules-ci-agent = {
+            settings = lib.mapAttrs' (name: lib.nameValuePair (name + "Path")) (
+              lib.genAttrs secretNames (name: config.age.secrets.${name}.path)
+            );
           };
         })
     ]