1#!/sbin/openrc-run
 2description="Decrypt age-encrypted secrets at boot"
 3
 4depend() {
 5    after localmount
 6    before named mosquitto
 7}
 8
 9start() {
10    if [ ! -d /etc/secrets ] || [ -z "$(ls /etc/secrets/*.age 2>/dev/null)" ]; then
11        einfo "No secrets to decrypt"
12        return 0
13    fi
14
15    ebegin "Decrypting secrets"
16    mkdir -p /run/secrets
17    chmod 711 /run/secrets
18
19    local key="/persist/ssh/ssh_host_ed25519_key"
20    if [ ! -f "$key" ]; then
21        ewarn "Host key not found at $key (no persist partition?)"
22        ewarn "Secrets will not be decrypted"
23        eend 0
24        return 0
25    fi
26
27    local failed=0
28    for secret in /etc/secrets/*.age; do
29        [ -f "$secret" ] || continue
30        local name
31        name=$(basename "$secret" .age)
32        if age -d -i "$key" "$secret" > "/run/secrets/$name" 2>/dev/null; then
33            if [ -f "/etc/secrets/${name}.meta" ]; then
34                . "/etc/secrets/${name}.meta"
35                chown "${OWNER:-root}:${GROUP:-root}" "/run/secrets/$name"
36                chmod "${MODE:-400}" "/run/secrets/$name"
37            else
38                chmod 400 "/run/secrets/$name"
39            fi
40        else
41            ewarn "Failed to decrypt: $name"
42            failed=1
43        fi
44    done
45    eend $failed
46}