treewide: don't reference <secrets> explicitly

2 files changed, 10 insertions, 6 deletions

diff --git a/krebs/3modules/retiolum-bootstrap.nix b/krebs/3modules/retiolum-bootstrap.nix
index bd7e7c5f6..1e94df14e 100644
--- a/krebs/3modules/retiolum-bootstrap.nix
+++ b/krebs/3modules/retiolum-bootstrap.nix
@@ -22,8 +22,8 @@ in
         default = "${config.krebs.secret.directory}/tinc.krebsco.de.key";
     };
     # in use:
-    #  <secrets/tinc.krebsco.de.crt>
-    #  <secrets/tinc.krebsco.de.key>
+    #  ${config.krebs.secret.directory}/tinc.krebsco.de.crt
+    #  ${config.krebs.secret.directory}/tinc.krebsco.de.key
   };
 
   config = mkIf cfg.enable {
diff --git a/krebs/3modules/secret.nix b/krebs/3modules/secret.nix
index 90c2f6a6d..c35dceba3 100644
--- a/krebs/3modules/secret.nix
+++ b/krebs/3modules/secret.nix
@@ -7,13 +7,17 @@ in {
       default = toString <secrets>;
       type = types.absolute-pathname;
     };
-    file = mkOption {
-      default = relpath: "${cfg.directory}/${relpath}";
-      readOnly = true;
-    };
     files = mkOption {
       type = with pkgs.stockholm.lib.types; attrsOf secret-file;
       default = {};
+      apply = mapAttrs (name: secret-file:
+        if types.absolute-pathname.check secret-file.source-path then
+          secret-file
+        else
+          secret-file // {
+            source-path = "${config.krebs.secret.directory}/secret-file.source-path";
+          }
+      );
     };
   };
   config = lib.mkIf (cfg.files != {}) {