Move configuration of secret source outside of provisioning setup

itself

nix/modules/nixos/infrastructure/provisioning/default.nix

@@ -13,14 +13,6 @@ let
       description = "Modules used to bring up the needed resources";
       default = [ ];
     };
-    secretsSource = lib.mkOption {
-      type = lib.types.enum [
-        "vault"
-        "bitwarden"
-      ];
-      description = "Where to get the secrets for the provisioning from";
-      default = "vault";
-    };
   };
   usesEndpoint =
     search: endpoint: config:
@@ -82,6 +74,14 @@ in
   options.khscodes.infrastructure.provisioning = {
     pre = provisioning;
     post = provisioning;
+    secretsSource = lib.mkOption {
+      type = lib.types.enum [
+        "vault"
+        "bitwarden"
+      ];
+      description = "Where to get the secrets for the provisioning from";
+      default = "vault";
+    };
     instanceUserData = lib.mkOption {
       type = (pkgs.formats.json { }).type;
       description = "User data that should be added to the instance during provisioning";

nix/packages/post-provisioning/default.nix

@@ -16,7 +16,7 @@ pkgs.writeShellApplication {
     cmd="''${2:-apply}"
     baseAttr='${inputs.self}#nixosConfigurations."'"$hostname"'".config.khscodes.infrastructure.provisioning'
     config="$(nix build --no-link --print-out-paths "''${baseAttr}.postConfig")"
-    secretsSource="$(nix eval --raw "''${baseAttr}.post.secretsSource")"
+    secretsSource="$(nix eval --raw "''${baseAttr}.secretsSource")"
     endpoints="$(nix eval --show-trace --json "''${baseAttr}.postEndpoints")"
     if [[ "$config" == "null" ]]; then
       echo "No postprovisioning needed"

nix/packages/pre-provisioning/default.nix

@@ -17,7 +17,7 @@ pkgs.writeShellApplication {
     cmd="''${2:-apply}"
     baseAttr='${inputs.self}#nixosConfigurations."'"$hostname"'".config.khscodes.infrastructure.provisioning'
     config="$(nix build --no-link --print-out-paths "''${baseAttr}.preConfig")"
-    secretsSource="$(nix eval --raw "''${baseAttr}.pre.secretsSource")"
+    secretsSource="$(nix eval --raw "''${baseAttr}.secretsSource")"
     endpoints="$(nix eval --show-trace --json "''${baseAttr}.preEndpoints")"
     if [[ "$config" == "null" ]]; then
       echo "No preprovisioning needed"

nix/systems/aarch64-linux/security.kaareskovgaard.net/default.nix

@@ -27,8 +27,7 @@ in
       server_type = "cax11";
     };
     # Cannot use vault for secrets source, as this is the server containing vault.
-    khscodes.infrastructure.provisioning.pre.secretsSource = "bitwarden";
-    khscodes.infrastructure.provisioning.post.secretsSource = "bitwarden";
+    khscodes.infrastructure.provisioning.secretsSource = "bitwarden";
     khscodes.infrastructure.vault-server-approle.stage = "post";
     khscodes.networking.fqdn = "security.kaareskovgaard.net";
     khscodes.infrastructure.openbao.domain = "secrets.kaareskovgaard.net";