From aa994dd296be218c8f3ecc902929008530960010 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sat, 17 Aug 2024 12:51:53 +0200
Subject: [PATCH] harmonia: switch to non-deprecated SIGN_KEY_PATHS

---
 .../modules/services/networking/harmonia.nix  | 22 ++++++++++++++++---
 nixos/tests/harmonia.nix                      |  2 +-
 2 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/services/networking/harmonia.nix b/nixos/modules/services/networking/harmonia.nix
index 629ee436e63d..ac5c35ddb280 100644
--- a/nixos/modules/services/networking/harmonia.nix
+++ b/nixos/modules/services/networking/harmonia.nix
@@ -2,6 +2,12 @@
 let
   cfg = config.services.harmonia;
   format = pkgs.formats.toml { };
+
+  signKeyPaths = cfg.signKeyPaths ++ lib.optional (cfg.signKeyPath != null) cfg.signKeyPath;
+  credentials = lib.imap0 (i: signKeyPath: {
+    id = "sign-key-${builtins.toString i}";
+    path = signKeyPath;
+  }) signKeyPaths;
 in
 {
   options = {
@@ -11,7 +17,13 @@ in
       signKeyPath = lib.mkOption {
         type = lib.types.nullOr lib.types.path;
         default = null;
-        description = "Path to the signing key that will be used for signing the cache";
+        description = "DEPRECATED: Use `services.harmonia.signKeyPaths` instead. Path to the signing key to use for signing the cache";
+      };
+
+      signKeyPaths = lib.mkOption {
+        type = lib.types.listOf lib.types.path;
+        default = [ ];
+        description = "Paths to the signing keys to use for signing the cache";
       };
 
       package = lib.mkPackageOption pkgs "harmonia" { };
@@ -28,6 +40,8 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    warnings = lib.optional (cfg.signKeyPath != null)
+      "`services.harmonia.signKeyPath` is deprecated, use `services.harmonia.signKeyPaths` instead";
     nix.settings.extra-allowed-users = [ "harmonia" ];
     users.users.harmonia = {
       isSystemUser = true;
@@ -44,7 +58,9 @@ in
 
       environment = {
         CONFIG_FILE = format.generate "harmonia.toml" cfg.settings;
-        SIGN_KEY_PATH = lib.mkIf (cfg.signKeyPath != null) "%d/sign-key";
+        SIGN_KEY_PATHS = lib.strings.concatMapStringsSep " " (
+          credential: "%d/${credential.id}"
+        ) credentials;
         # Note: it's important to set this for nix-store, because it wants to use
         # $HOME in order to use a temporary cache dir. bizarre failures will occur
         # otherwise
@@ -60,7 +76,7 @@ in
         DeviceAllow = [ "" ];
         UMask = "0066";
         RuntimeDirectory = "harmonia";
-        LoadCredential = lib.mkIf (cfg.signKeyPath != null) [ "sign-key:${cfg.signKeyPath}" ];
+        LoadCredential = builtins.map (credential: "${credential.id}:${credential.path}") credentials;
         SystemCallFilter = [
           "@system-service"
           "~@privileged"
diff --git a/nixos/tests/harmonia.nix b/nixos/tests/harmonia.nix
index a9beac82f8e1..d97f0fb89ede 100644
--- a/nixos/tests/harmonia.nix
+++ b/nixos/tests/harmonia.nix
@@ -7,7 +7,7 @@
     harmonia = {
       services.harmonia = {
         enable = true;
-        signKeyPath = pkgs.writeText "cache-key" "cache.example.com-1:9FhO0w+7HjZrhvmzT1VlAZw4OSAlFGTgC24Seg3tmPl4gZBdwZClzTTHr9cVzJpwsRSYLTu7hEAQe3ljy92CWg==";
+        signKeyPaths = [(pkgs.writeText "cache-key" "cache.example.com-1:9FhO0w+7HjZrhvmzT1VlAZw4OSAlFGTgC24Seg3tmPl4gZBdwZClzTTHr9cVzJpwsRSYLTu7hEAQe3ljy92CWg==")];
         settings.priority = 35;
       };