Add secrets support to dev VMs

devshell/commands.nix

@@ -1,6 +1,7 @@
 { pkgs, ... }:
 let
   homeFlake = "$HOME/.config/nixpkgs/flake.nix";
+  devKey = ".keys/dev.key";
 in
 {
   commands = [
@@ -67,7 +68,9 @@ in
       command =
         ''
           cd "$PRJ_ROOT"
-          nix run ".#nixosConfigurations.\"$1\".config.my.buildAs.devVM"
+          tmp="$(mktemp -d nix-vm.XXXXXXXXXX --tmpdir)"
+          install -Dm0400 "${devKey}" "$tmp/xchg/dev.key"
+          TMPDIR="$tmp" USE_TMPDIR=1 nix run ".#nixosConfigurations.\"$1\".config.my.buildAs.devVM"
         '';
     }
     {

nixos/modules/build.nix

@@ -62,6 +62,7 @@ in
     virtualisation = {
       diskImage = dummyOption;
       forwardPorts = dummyOption;
+      sharedDirectories = dummyOption;
     };
   };
 

nixos/modules/secrets.nix

@@ -1,6 +1,7 @@
 { lib, config, secretsPath, ... }:
 let
   inherit (builtins) mapAttrs;
+  inherit (lib) mkMerge mkIf;
   inherit (lib.my) mkOpt';
 
   cfg = config.my.secrets;
@@ -11,7 +12,14 @@ in
     files = mkOpt' (attrsOf unspecified) { } "Secrets to decrypt with agenix.";
   };
 
-  config.age.secrets = mapAttrs (f: opts: {
-    file = "${secretsPath}/${f}.age";
-  } // opts) cfg.files;
+  config = mkMerge [
+    {
+      age.secrets = mapAttrs (f: opts: {
+        file = "${secretsPath}/${f}.age";
+      } // opts) cfg.files;
+    }
+    (mkIf config.my.build.isDevVM {
+      age.identityPaths = [ "/tmp/xchg/dev.key" ];
+    })
+  ];
 }