# ttrssreal/buildtime-secrets-nix architecture

> Architecture diagram of the GitHub repository ttrssreal/buildtime-secrets-nix, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/ttrssreal/buildtime-secrets-nix
- Repository: https://github.com/ttrssreal/buildtime-secrets-nix

## Overview

buildtime-secrets-nix provides a pre-build hook for accessing secrets from derivations. The likely runtime path is a build invoking the hook, which uses configuration and a selected backend to provide secret access; the README does not describe the exact invocation or data flow. The tree identifies executable and SOPS backends and Nix integration modules, but their wiring is not shown in the sampled source. The Nix store library’s exposed operations are supported by inspected source.

Main entry points: [`buildtime-secrets-nix/src/main.rs`](https://github.com/ttrssreal/buildtime-secrets-nix/blob/main/buildtime-secrets-nix/src/main.rs) (Hook entry point), [`libnixstore/src/lib.rs`](https://github.com/ttrssreal/buildtime-secrets-nix/blob/main/libnixstore/src/lib.rs) (Store API), [`buildtime-secrets-nix/src/lib.rs`](https://github.com/ttrssreal/buildtime-secrets-nix/blob/main/buildtime-secrets-nix/src/lib.rs) (Hook library)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_hook["Build hook"]
  node_main["Hook entry point<br/>[main.rs]"]
  node_library["Hook library<br/>[lib.rs]"]
  node_config["Configuration<br/>[config.rs]"]
end

subgraph group_secrets["Secret backends"]
  node_secret["Secret model<br/>[secret.rs]"]
  node_backend["Backend dispatch<br/>[mod.rs]"]
  node_executable["Executable backend<br/>[executable.rs]"]
  node_sops["SOPS backend<br/>[sops.rs]"]
end

subgraph group_nix["Nix integration"]
  node_buildtime_module["Build-time module"]
  node_sops_module["SOPS module<br/>[sops.nix]"]
  node_store_api["Store API<br/>[lib.rs]"]
end

node_builder(("Nix build"))
node_nix_store[("Local Nix store")]

node_builder -->|"invokes hook"| node_main
node_main -->|"runs"| node_library
node_store_api -->|"queries"| node_nix_store

click node_main "https://github.com/ttrssreal/buildtime-secrets-nix/blob/main/buildtime-secrets-nix/src/main.rs"
click node_library "https://github.com/ttrssreal/buildtime-secrets-nix/blob/main/buildtime-secrets-nix/src/lib.rs"
click node_config "https://github.com/ttrssreal/buildtime-secrets-nix/blob/main/buildtime-secrets-nix/src/config.rs"
click node_secret "https://github.com/ttrssreal/buildtime-secrets-nix/blob/main/buildtime-secrets-nix/src/secret.rs"
click node_backend "https://github.com/ttrssreal/buildtime-secrets-nix/blob/main/buildtime-secrets-nix/src/backend/mod.rs"
click node_executable "https://github.com/ttrssreal/buildtime-secrets-nix/blob/main/buildtime-secrets-nix/src/backend/executable.rs"
click node_sops "https://github.com/ttrssreal/buildtime-secrets-nix/blob/main/buildtime-secrets-nix/src/backend/sops.rs"
click node_buildtime_module "https://github.com/ttrssreal/buildtime-secrets-nix/blob/main/modules/buildtime-secrets.nix"
click node_sops_module "https://github.com/ttrssreal/buildtime-secrets-nix/blob/main/modules/sops.nix"
click node_store_api "https://github.com/ttrssreal/buildtime-secrets-nix/blob/main/libnixstore/src/lib.rs"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_main,node_library,node_config toneBlue
class node_secret,node_backend,node_executable,node_sops,node_nix_store toneAmber
class node_buildtime_module,node_sops_module,node_store_api toneMint
class node_builder toneIndigo
```

## Components

### Build hook

- [Hook entry point](https://github.com/ttrssreal/buildtime-secrets-nix/blob/main/buildtime-secrets-nix/src/main.rs): `buildtime-secrets-nix/src/main.rs`
- [Hook library](https://github.com/ttrssreal/buildtime-secrets-nix/blob/main/buildtime-secrets-nix/src/lib.rs): `buildtime-secrets-nix/src/lib.rs`
- [Configuration](https://github.com/ttrssreal/buildtime-secrets-nix/blob/main/buildtime-secrets-nix/src/config.rs): `buildtime-secrets-nix/src/config.rs`

### Secret backends

- [Secret model](https://github.com/ttrssreal/buildtime-secrets-nix/blob/main/buildtime-secrets-nix/src/secret.rs): `buildtime-secrets-nix/src/secret.rs`
- [Backend dispatch](https://github.com/ttrssreal/buildtime-secrets-nix/blob/main/buildtime-secrets-nix/src/backend/mod.rs): `buildtime-secrets-nix/src/backend/mod.rs`
- [Executable backend](https://github.com/ttrssreal/buildtime-secrets-nix/blob/main/buildtime-secrets-nix/src/backend/executable.rs): `buildtime-secrets-nix/src/backend/executable.rs`
- [SOPS backend](https://github.com/ttrssreal/buildtime-secrets-nix/blob/main/buildtime-secrets-nix/src/backend/sops.rs): `buildtime-secrets-nix/src/backend/sops.rs`

### Nix integration

- [Build-time module](https://github.com/ttrssreal/buildtime-secrets-nix/blob/main/modules/buildtime-secrets.nix): `modules/buildtime-secrets.nix`
- [SOPS module](https://github.com/ttrssreal/buildtime-secrets-nix/blob/main/modules/sops.nix): `modules/sops.nix`
- [Store API](https://github.com/ttrssreal/buildtime-secrets-nix/blob/main/libnixstore/src/lib.rs): `libnixstore/src/lib.rs`

### Other components

- **Nix build**
- **Local Nix store**

## Connections

- Nix build → Hook entry point: invokes hook
- Hook entry point → Hook library: runs
- Store API → Local Nix store: queries