How ttrssreal/buildtime-secrets-nix works
buildtime-secrets-nix provides a pre-build hook for accessing secrets from derivations. The likely runtime path is a build invoking the hook, which uses configuration and a selected backend to provide secret access; the README does not describe the exact invocation or data flow. The tree identifies executable and SOPS backends and Nix integration modules, but their wiring is not shown in the sampled source. The Nix store library’s exposed operations are supported by inspected source.
Main entry points: main.rs Hook entry point · src/lib.rs Store API · src/lib.rs Hook library
Components 12
Build hook
- Hook entry point
buildtime-secrets-nix/src/main.rs - Hook library
buildtime-secrets-nix/src/lib.rs - Configuration
buildtime-secrets-nix/src/config.rs
Secret backends
- Secret model
buildtime-secrets-nix/src/secret.rs - Backend dispatch
buildtime-secrets-nix/src/backend/mod.rs - Executable backend
buildtime-secrets-nix/src/backend/executable.rs - SOPS backend
buildtime-secrets-nix/src/backend/sops.rs
Nix integration
- Build-time module
modules/buildtime-secrets.nix - SOPS module
modules/sops.nix - Store API
libnixstore/src/lib.rs
Other components
- Nix build
- Local Nix store
Connections 3
- Nix build → Hook entry point: invokes hook
- Hook entry point → Hook library: runs
- Store API → Local Nix store: queries