From c2122e912a6a8d3ab6241f384e2ff8b2336f1b3a Mon Sep 17 00:00:00 2001
From: Robin Stumm <robin.stumm@iohk.io>
Date: Mon, 17 Jan 2022 20:46:20 +0100
Subject: [PATCH] nix stdlib: use github token from vault via template

---
 pkgs/cicero/evaluators/nix/lib.nix | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/pkgs/cicero/evaluators/nix/lib.nix b/pkgs/cicero/evaluators/nix/lib.nix
index 7d67a90a..901725b1 100644
--- a/pkgs/cicero/evaluators/nix/lib.nix
+++ b/pkgs/cicero/evaluators/nix/lib.nix
@@ -321,11 +321,6 @@ rec {
             (inner: ''
               export SSL_CERT_FILE=/current-profile/etc/ssl/certs/ca-bundle.crt
 
-              # TODO Only get from vault. Env var is just for development.
-              if [[ -z "''${GITHUB_TOKEN:-}" ]]; then
-                GITHUB_TOKEN=$(vault kv get -field=token kv/data/cicero/github)
-              fi
-
               function cleanup {
                 rm -f "$secret_headers"
               }
@@ -334,7 +329,7 @@ rec {
               secret_headers="$(mktemp)"
 
               cat >> "$secret_headers" <<EOF
-              Authorization: token $GITHUB_TOKEN
+              Authorization: token $(< "$NOMAD_SECRETS_DIR"/github/token)
               EOF
 
               function report {
@@ -376,9 +371,13 @@ rec {
             config.packages = data-merge.append [
               "github:NixOS/nixpkgs/${self.inputs.nixpkgs.rev}#curl"
               "github:NixOS/nixpkgs/${self.inputs.nixpkgs.rev}#jq"
-              "github:NixOS/nixpkgs/${self.inputs.nixpkgs.rev}#vault"
               "github:NixOS/nixpkgs/${self.inputs.nixpkgs.rev}#cacert"
             ];
+
+            template = data-merge.append [{
+              destination = "secrets/cicero/github/token";
+              data = ''{{with secret "kv/cicero/github"}}{{.Data.data.token}}{{end}}'';
+            }];
           };
     };
   };