git.delta.rocks / jrsonnet / refs/commits / 5a5b360a3403

--- a/crates/fleet-base/src/fleetdata.rs
+++ b/crates/fleet-base/src/fleetdata.rs
@@ -1,6 +1,10 @@
 use std::{
-	collections::{BTreeMap, BTreeSet},
+	collections::{
+		BTreeMap, BTreeSet,
+		btree_map::{self, Entry},
+	},
 	io::{self, Cursor},
+	ops::Deref,
 };
 
 use age::Recipient;
@@ -10,10 +14,12 @@
 	distr::{Alphanumeric, SampleString as _},
 	rng,
 };
-use serde::{Deserialize, Serialize, de::Error};
+use serde::{
+	Deserialize, Serialize,
+	de::{self, Error},
+};
 use serde_json::Value;
-
-use crate::secret::{Expectations, RegenerationReason, secret_needs_regeneration};
+use tracing::info;
 
 #[derive(Serialize, Deserialize, Default)]
 #[serde(rename_all = "camelCase")]
@@ -72,17 +78,29 @@
 
 	#[serde(default)]
 	pub hosts: BTreeMap<String, HostData>,
+
+	#[serde(default, alias = "shared_secrets")]
+	pub secrets: FleetSecrets,
+
+	// extra_name => anything
 	#[serde(default)]
 	#[serde(skip_serializing_if = "BTreeMap::is_empty")]
-	pub shared_secrets: BTreeMap<String, FleetSharedSecret>,
-	#[serde(default)]
-	#[serde(skip_serializing_if = "BTreeMap::is_empty")]
-	pub host_secrets: BTreeMap<String, BTreeMap<String, FleetHostSecret>>,
+	pub extra: BTreeMap<String, Value>,
 
-	// extra_name => anything
 	#[serde(default)]
 	#[serde(skip_serializing_if = "BTreeMap::is_empty")]
-	pub extra: BTreeMap<String, Value>,
+	host_secrets: BTreeMap<String, BTreeMap<String, FleetSecretDistribution>>,
+}
+impl FleetData {
+	pub fn from_str(s: &str) -> anyhow::Result<Self> {
+		let mut data: Self = nixlike::parse_str(s)?;
+		if !data.host_secrets.is_empty() {
+			info!("migrating host secrets into shared secrets structure");
+			data.secrets
+				.merge_from_hosts(std::mem::take(&mut data.host_secrets));
+		}
+		Ok(data)
+	}
 }
 
 /// Returns None if recipients.is_empty()
@@ -129,27 +147,276 @@
 #[derive(Serialize, Deserialize, Clone)]
 #[serde(rename_all = "camelCase")]
 #[must_use]
-pub struct FleetHostSecret {
+pub struct FleetSecretDistribution {
 	#[serde(default)]
 	#[serde(skip_serializing_if = "Option::is_none")]
 	pub managed: Option<bool>,
+	#[serde(default)]
+	pub owners: BTreeSet<String>,
 	#[serde(flatten)]
 	pub secret: FleetSecretData,
 }
-impl FleetHostSecret {
-	pub fn needs_regeneration(&self, expectations: &Expectations) -> Option<RegenerationReason> {
-		secret_needs_regeneration(&self.secret, &expectations.owners, expectations)
+
+#[derive(Clone)]
+#[must_use]
+pub struct FleetSecretDistributions(Vec<FleetSecretDistribution>);
+
+impl Deref for FleetSecretDistributions {
+	type Target = [FleetSecretDistribution];
+
+	fn deref(&self) -> &Self::Target {
+		self.0.as_slice()
+	}
+}
+
+impl FleetSecretDistributions {
+	pub fn owners(&self) -> impl Iterator<Item = &String> {
+		self.0.iter().flat_map(|v| v.owners.iter())
+	}
+	#[allow(
+		clippy::len_without_is_empty,
+		reason = "should not be empty for a long time"
+	)]
+	pub fn len(&self) -> usize {
+		self.0.len()
+	}
+
+	pub fn get(&self, owner: &str) -> Option<&FleetSecretDistribution> {
+		self.0.iter().find(|d| d.owners.contains(owner))
+	}
+	fn entry(&mut self, owner: String) -> DistEntry<'_> {
+		let Some(idx) = self.0.iter().position(|d| d.owners.contains(&owner)) else {
+			return DistEntry::Vacant(VacantDistEntry {
+				distributions: self,
+				owner,
+			});
+		};
+		DistEntry::Occupied(OccupiedDistEntry {
+			distributions: self,
+			idx,
+			owner,
+		})
+	}
+	fn extend(&mut self, dist: FleetSecretDistribution) {
+		for owner in &dist.owners {
+			self.entry(owner.to_owned()).remove();
+		}
+		self.0.push(dist);
+	}
+	pub fn contains(&self, owner: &str) -> bool {
+		self.0.iter().any(|d| d.owners.contains(owner))
+	}
+}
+
+struct OccupiedDistEntry<'d> {
+	distributions: &'d mut FleetSecretDistributions,
+	idx: usize,
+	owner: String,
+}
+impl<'d> OccupiedDistEntry<'d> {
+	fn remove(self) -> VacantDistEntry<'d> {
+		let dist = &mut self.distributions.0[self.idx];
+		assert!(
+			dist.owners.remove(&self.owner),
+			"entry exists, as we have its reference"
+		);
+		if dist.owners.is_empty() {
+			self.distributions.0.remove(self.idx);
+		}
+		VacantDistEntry {
+			distributions: self.distributions,
+			owner: self.owner,
+		}
+	}
+	fn set(self, secret: FleetSecretData) -> Self {
+		self.remove().set(secret)
 	}
 }
+struct VacantDistEntry<'d> {
+	distributions: &'d mut FleetSecretDistributions,
+	owner: String,
+}
+impl<'d> VacantDistEntry<'d> {
+	fn set(self, secret: FleetSecretData) -> OccupiedDistEntry<'d> {
+		let Self {
+			distributions,
+			owner,
+		} = self;
+		let idx = distributions.0.len();
+		distributions.0.push(FleetSecretDistribution {
+			managed: None,
+			owners: BTreeSet::from_iter([owner.clone()]),
+			secret,
+		});
+		OccupiedDistEntry {
+			distributions,
+			owner,
+			idx,
+		}
+	}
+}
 
-#[derive(Serialize, Deserialize, Clone)]
-#[serde(rename_all = "camelCase")]
-#[must_use]
-pub struct FleetSharedSecret {
-	#[serde(default)]
-	#[serde(skip_serializing_if = "Option::is_none")]
-	pub managed: Option<bool>,
-	pub owners: BTreeSet<String>,
-	#[serde(flatten)]
-	pub secret: FleetSecretData,
+enum DistEntry<'d> {
+	Vacant(VacantDistEntry<'d>),
+	Occupied(OccupiedDistEntry<'d>),
+}
+impl DistEntry<'_> {
+	fn remove(self) -> Self {
+		match self {
+			DistEntry::Vacant(_) => self,
+			DistEntry::Occupied(o) => Self::Vacant(o.remove()),
+		}
+	}
+	fn set(self, secret: FleetSecretData) -> Self {
+		Self::Occupied(match self {
+			DistEntry::Vacant(e) => e.set(secret),
+			DistEntry::Occupied(e) => e.set(secret),
+		})
+	}
+}
+
+impl Serialize for FleetSecretDistributions {
+	fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+	where
+		S: serde::Serializer,
+	{
+		let mut found_hosts = BTreeSet::new();
+		for ele in self.0.iter() {
+			if ele.owners.is_empty() {
+				panic!("consistency: secret distribution has no defined owners");
+			}
+			for ele in ele.owners.iter() {
+				if !found_hosts.insert(ele) {
+					panic!(
+						"consistency: secret distribution contains duplicate entry for the same host",
+					);
+				}
+			}
+		}
+		match self.0.len() {
+			0 => panic!("consistency: empty distributions"),
+			1 => self.0[0].serialize(serializer),
+			_ => self.0.serialize(serializer),
+		}
+	}
+}
+impl<'de> Deserialize<'de> for FleetSecretDistributions {
+	fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+	where
+		D: serde::Deserializer<'de>,
+	{
+		#[derive(Deserialize)]
+		#[serde(untagged)]
+		enum Distributions {
+			One(FleetSecretDistribution),
+			Many(Vec<FleetSecretDistribution>),
+		}
+		let d = Distributions::deserialize(deserializer)?;
+		let ds = match d {
+			Distributions::One(d) => vec![d],
+			Distributions::Many(ds) => ds,
+		};
+		if ds.is_empty() {
+			return Err(de::Error::custom("consistency: empty distributions"));
+		}
+		let mut found_hosts = BTreeSet::new();
+		for ele in ds.iter() {
+			if ele.owners.is_empty() {
+				return Err(de::Error::custom(
+					"consistency: secret distribution has no defined owners",
+				));
+			}
+			for ele in ele.owners.iter() {
+				if !found_hosts.insert(ele) {
+					return Err(de::Error::custom(
+						"consistency: secret distribution contains duplicate entry for the same host",
+					));
+				}
+			}
+		}
+		Ok(Self(ds))
+	}
+}
+
+#[derive(Serialize, Deserialize, Default)]
+pub struct FleetSecrets(BTreeMap<String, FleetSecretDistributions>);
+
+impl FleetSecrets {
+	pub fn keys(&self) -> btree_map::Keys<String, FleetSecretDistributions> {
+		self.0.keys()
+	}
+
+	pub fn keys_for_owner(&self, owner: &str) -> impl Iterator<Item = &String> {
+		self.0
+			.iter()
+			.filter(|(_, d)| d.contains(owner))
+			.map(|(n, _)| n)
+	}
+
+	pub fn drop_owner_no_reencrypt(&mut self, secret: &str, owner: &str) -> bool {
+		let Entry::Occupied(mut dists) = self.0.entry(secret.to_owned()) else {
+			return false;
+		};
+		let DistEntry::Occupied(dist) = dists.get_mut().entry(owner.to_owned()) else {
+			return false;
+		};
+
+		dist.remove();
+
+		if dists.get().0.is_empty() {
+			dists.remove();
+		};
+
+		true
+	}
+	pub fn set_single_data(&mut self, secret: String, owner: String, data: FleetSecretData) {
+		let e = self
+			.0
+			.entry(secret.to_owned())
+			.or_insert_with(|| FleetSecretDistributions(Default::default()));
+		e.entry(owner.to_owned()).set(data);
+	}
+	pub fn set_data(&mut self, secret: String, data: FleetSecretDistribution) {
+		match self.0.entry(secret) {
+			Entry::Vacant(e) => {
+				e.insert(FleetSecretDistributions(vec![data]));
+			}
+			Entry::Occupied(mut e) => {
+				let dists = e.get_mut();
+				dists.extend(data)
+			}
+		}
+	}
+	pub fn get_single(&self, secret: &str, owner: &str) -> Option<&FleetSecretDistribution> {
+		let secret = self.0.get(secret)?;
+		secret.get(owner)
+	}
+	pub fn get(&self, secret: &str) -> Option<&FleetSecretDistributions> {
+		self.0.get(secret)
+	}
+
+	pub fn contains_for_owner(&self, secret: &str, owner: &str) -> bool {
+		let Some(secret) = self.0.get(secret) else {
+			return false;
+		};
+		secret.contains(owner)
+	}
+	pub fn contains(&self, secret: &str) -> bool {
+		self.0.contains_key(secret)
+	}
+	pub fn remove(&mut self, secret: &str) {
+		self.0.remove(secret);
+	}
+
+	fn merge_from_hosts(
+		&mut self,
+		host_secrets: BTreeMap<String, BTreeMap<String, FleetSecretDistribution>>,
+	) {
+		for (host, host_secrets) in host_secrets {
+			for (secret_name, mut secret_data) in host_secrets {
+				secret_data.owners.insert(host.clone());
+				self.set_data(secret_name, secret_data);
+			}
+		}
+	}
 }

--- a/crates/fleet-base/src/host.rs
+++ b/crates/fleet-base/src/host.rs
@@ -22,7 +22,7 @@
 
 use crate::{
 	command::MyCommand,
-	fleetdata::{FleetData, FleetHostSecret, FleetSharedSecret},
+	fleetdata::{FleetData, FleetSecretData, FleetSecretDistribution, FleetSecretDistributions},
 	secret::{HostSecretDefinition, SharedSecretDefinition},
 };
 
@@ -623,80 +623,48 @@
 		let config_field = &self.config_field;
 		nix_go!(config_field.sharedSecrets).list_fields()
 	}
-	/// Shared secrets configured in fleet.nix
-	pub fn list_shared(&self) -> Vec<String> {
-		let data = self.data();
-		data.shared_secrets.keys().cloned().collect()
-	}
 	pub fn has_shared(&self, name: &str) -> bool {
 		let data = self.data();
-		data.shared_secrets.contains_key(name)
+		data.secrets.contains(name)
 	}
-	pub fn replace_shared(&self, name: String, shared: FleetSharedSecret) {
+	pub fn replace_shared(&self, name: String, shared: FleetSecretDistribution) {
 		let mut data = self.data_mut();
-		data.shared_secrets.insert(name.to_owned(), shared);
+		data.secrets.set_data(name, shared);
 	}
 	pub fn remove_shared(&self, secret: &str) {
 		let mut data = self.data_mut();
-		data.shared_secrets.remove(secret);
+		data.secrets.remove(secret);
 	}
 
-	pub fn list_secrets(&self, host: &str) -> Vec<String> {
-		let data = self.data();
-		let mut out = data
-			.host_secrets
-			.get(host)
-			.map(|s| s.keys().cloned().collect::<Vec<String>>())
-			.unwrap_or_default();
-
-		for (name, shared) in data.shared_secrets.iter() {
-			if shared.owners.contains(host) {
-				out.push(name.clone());
-			}
-		}
-
-		out
+	pub fn list_secrets_for_owner(&self, host: &str) -> Vec<String> {
+		let data = self.data_mut();
+		data.secrets.keys_for_owner(host).cloned().collect()
+	}
+	pub fn list_secrets(&self) -> Vec<String> {
+		let data = self.data_mut();
+		data.secrets.keys().cloned().collect()
 	}
 
 	pub fn has_secret(&self, host: &str, secret: &str) -> bool {
 		let data = self.data();
-		let Some(host_secrets) = data.host_secrets.get(host) else {
-			return false;
-		};
-		host_secrets.contains_key(secret)
+		data.secrets.contains_for_owner(secret, host)
 	}
-	pub fn insert_secret(&self, host: &str, secret: String, value: FleetHostSecret) {
+	pub fn insert_secret(&self, host: String, secret: String, value: FleetSecretData) {
 		let mut data = self.data_mut();
-		let host_secrets = data.host_secrets.entry(host.to_owned()).or_default();
-		host_secrets.insert(secret, value);
+		data.secrets.set_single_data(secret, host, value);
 	}
 	pub fn remove_secret(&self, host: &str, secret: &str) {
 		let mut data = self.data_mut();
-		let host_secrets = data.host_secrets.entry(host.to_owned()).or_default();
-		host_secrets.remove(secret);
+		data.secrets.drop_owner_no_reencrypt(secret, host);
 	}
 
-	pub fn host_secret(&self, host: &str, secret: &str) -> Result<FleetHostSecret> {
+	pub fn host_secret(&self, host: &str, secret: &str) -> Option<FleetSecretDistribution> {
 		let data = self.data();
-		if let Some(host_secrets) = data.host_secrets.get(host) {
-			if let Some(secret) = host_secrets.get(secret) {
-				return Ok(secret.clone());
-			}
-		};
-		let Some(shared) = data.shared_secrets.get(secret) else {
-			bail!("machine {host} has no secret {secret}");
-		};
-		if !shared.owners.contains(host) {
-			bail!("shared secret {secret} is not owned by {host}");
-		};
-		Ok(FleetHostSecret {
-			managed: shared.managed,
-			secret: shared.secret.clone(),
-		})
+		data.secrets.get_single(secret, host).cloned()
 	}
-	pub fn shared_secret(&self, secret: &str) -> Result<Option<FleetSharedSecret>> {
+	pub fn shared_secret(&self, secret: &str) -> Option<FleetSecretDistributions> {
 		let data = self.data();
-		Ok(data.shared_secrets.get(secret).cloned())
+		data.secrets.get(secret).cloned()
 	}
 	pub fn shared_secret_definition(&self, secret: &str) -> Result<SharedSecretDefinition> {
 		let config_field = &self.config_field;

--- a/crates/fleet-base/src/opts.rs
+++ b/crates/fleet-base/src/opts.rs
@@ -211,7 +211,7 @@
 		}
 		let bytes =
 			std::fs::read_to_string(&fleet_data_path).context("reading fleet state (fleet.nix)")?;
-		let data: Mutex<FleetData> = nixlike::parse_str(&bytes)?;
+		let data = Mutex::new(FleetData::from_str(&bytes)?);
 
 		let mut fetch_settings = FetchSettings::new();
 		fetch_settings.set(c"warn-dirty", c"false");

--- a/flake.lock
+++ b/flake.lock
@@ -2,10 +2,10 @@
   "nodes": {
     "crane": {
       "locked": {
-        "lastModified": 1766181779,
+        "lastModified": 1767461147,
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "0263f510ba38bee5b7f817498066adaad694e50b",
+        "rev": "7d59256814085fd9666a2ae3e774dc5ee216b630",
         "type": "github"
       },
       "original": {
@@ -37,10 +37,10 @@
         ]
       },
       "locked": {
-        "lastModified": 1765835352,
+        "lastModified": 1767609335,
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "a34fae9c08a15ad73f295041fec82323541400a9",
+        "rev": "250481aafeb741edfe23d29195671c19b36b6dca",
         "type": "github"
       },
       "original": {
@@ -126,10 +126,10 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1766181714,
+        "lastModified": 1767657734,
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "ff2da5fee8b3248cac330f14eac98228620beab0",
+        "rev": "d4ccebf51ee4dbeb9df364dce1fe9848635c1258",
         "type": "github"
       },
       "original": {
@@ -190,10 +190,10 @@
         ]
       },
       "locked": {
-        "lastModified": 1766112155,
+        "lastModified": 1767667566,
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "2a6db3fc1c27ae77f9caa553d7609b223cb770b5",
+        "rev": "056ce5b125ab32ffe78c7d3e394d9da44733c95e",
         "type": "github"
       },
       "original": {
@@ -223,10 +223,10 @@
         ]
       },
       "locked": {
-        "lastModified": 1766000401,
+        "lastModified": 1767468822,
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "42d96e75aa56a3f70cab7e7dc4a32868db28e8fd",
+        "rev": "d56486eb9493ad9c4777c65932618e9c2d0468fc",
         "type": "github"
       },
       "original": {

--- a/flake.nix
+++ b/flake.nix
@@ -128,11 +128,6 @@
               overlays = [
                 (inputs.rust-overlay.overlays.default)
                 (final: prev: {
-                  boehmgc = prev.boehmgc.overrideAttrs (prevAttrs: {
-                    configureFlags = prevAttrs.configureFlags ++ [
-                      "--enable-gc-assertions"
-                    ];
-                  });
                   # Libsecret is stupidly huge
                   # https://github.com/oxalica/rust-overlay/issues/211
                   libsecret = final.stdenv.mkDerivation {

--- a/modules/secrets-data.nix
+++ b/modules/secrets-data.nix
@@ -1,7 +1,6 @@
 {
   lib,
   fleetLib,
-  config,
   ...
 }:
 let
@@ -15,15 +14,7 @@
     submodule
     bool
     unspecified
-    ;
-  inherit (lib.attrsets)
-    mapAttrsToList
-    mapAttrs
-    filterAttrs
-    genAttrs
     ;
-  inherit (lib.lists) sort unique concatLists;
-  inherit (lib.strings) toJSON;
 
   secretDataValue = {
     options = {
@@ -71,35 +62,8 @@
         default = null;
       };
     };
-    config = { };
   };
 
-  hostSecretData = {
-    freeformType = attrsOf (submodule secretDataValue);
-    options = {
-      createdAt = mkOption {
-        type = str;
-        description = "Timestamp of secret generation/last rotation.";
-        default = null;
-      };
-      expiresAt = mkOption {
-        type = nullOr str;
-        description = "Expiration timestamp triggering mandatory secret rotation.";
-        default = null;
-      };
-      shared = mkOption {
-        type = bool;
-        description = "Indicates if secret is a shared secret, so other hosts might have the same piece of secret data.";
-        default = false;
-      };
-      generationData = mkOption {
-        type = unspecified;
-        description = "Contextual metadata associated with secret part.";
-        default = null;
-      };
-    };
-    config = { };
-  };
   managerKey = {
     options = {
       name = mkOption {
@@ -121,49 +85,11 @@
         managerKeys = mkOption {
           type = listOf (submodule managerKey);
         };
-        sharedSecrets = mkOption {
-          type = attrsOf (submodule sharedSecretData);
+        secrets = mkOption {
+          type = attrsOf (listOf submodule sharedSecretData);
           default = { };
           description = "Shared secret data.";
-        };
-        hostSecrets = mkOption {
-          type = attrsOf (attrsOf (submodule hostSecretData));
-          default = { };
-          description = "Host-specific secrets.";
-          internal = true;
         };
       };
-      config.hostSecrets =
-        let
-          hostsWithSharedSecrets = unique (
-            concatLists (mapAttrsToList (_: s: s.owners) config.sharedSecrets)
-          );
-          secretsHavingHost = host: filterAttrs (_: secret: lib.elem host secret.owners) config.sharedSecrets;
-          toHostSecret = _: secret: (removeAttrs secret [ "owners" ]) // { shared = true; };
-        in
-        genAttrs hostsWithSharedSecrets (host: mapAttrs toHostSecret (secretsHavingHost host));
     });
-  config = {
-    assertions =
-      (mapAttrsToList (name: secret: {
-        assertion =
-          secret.expectedOwners == null
-          ||
-            sort (a: b: a < b) (config.data.sharedSecrets.${name} or { owners = [ ]; }).owners
-            == sort (a: b: a < b) secret.expectedOwners;
-        message = "Shared secret ${name} is expected to be encrypted for ${toJSON secret.expectedOwners}, but it is encrypted for ${
-          toJSON (config.data.sharedSecrets.${name} or { owners = [ ]; }).owners
-        }. Run fleet secrets regenerate to fix";
-      }) config.sharedSecrets)
-
-      ++ (mapAttrsToList (name: secret: {
-        # TODO: Same assertion should be in host secrets
-        assertion =
-          (config.data.sharedSecrets.${name} or { generationData = null; }).generationData
-          == secret.expectedGenerationData;
-        message = "Shared secret ${name} has unexpected generation data ${toJSON secret.expectedGenerationData} != ${
-          toJSON (config.data.sharedSecrets.${name} or { generationData = null; }).generationData
-        }. Run fleet secrets regenerate to fix";
-      }) config.sharedSecrets);
-  };
 }

--- a/modules/secrets.nix
+++ b/modules/secrets.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  config,
   ...
 }:
 let
@@ -18,7 +17,6 @@
     uniq
     ;
   inherit (lib.strings) concatStringsSep;
-  inherit (lib.attrsets) mapAttrs;
 
   sharedSecret =
     { config, ... }:
@@ -54,6 +52,12 @@
             Set to false if host permissions are revoked through alternative mechanisms like firewall rules.
           '';
         };
+        allowDifferent = mkOption {
+          type = bool;
+          description = ''
+            When adding owner, do not update secret value for other owners, instead creating a new distribution
+          '';
+        };
         generator = mkOption {
           type = uniq (nullOr (functionTo package));
           description = ''
@@ -84,32 +88,13 @@
 in
 {
   options = {
-    sharedSecrets = mkOption {
+    secrets = mkOption {
       type = attrsOf (submodule sharedSecret);
       default = { };
       description = "Collection of secrets shared across multiple hosts with configurable ownership";
     };
   };
   config = {
-    hosts = mapAttrs (
-      _: secretMap:
-      let
-        partsOf =
-          s:
-          removeAttrs s [
-            "createdAt"
-            "expiresAt"
-            "generationData"
-          ];
-
-      in
-      {
-        nixos.data.secrets = mapAttrs (_: s: partsOf s) secretMap;
-        # nixos.secrets = mapAttrs (
-        #   _: s: mapAttrs (_: _: {}) (partsOf s)
-        # ) secretMap;
-      }
-    ) config.data.hostSecrets;
     nixpkgs.overlays = [
       (final: prev: {
         mkSecretGenerators =