From 578794f528804f642e65a1b893e6440e0b0162cc Mon Sep 17 00:00:00 2001
From: Nathan Henrie <nate@n8henrie.com>
Date: Sat, 11 Feb 2023 07:19:01 -0700
Subject: [PATCH 1/2] Test with nonexisting key

---
 test/integration.nix        | 3 +++
 test/integration_darwin.nix | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/test/integration.nix b/test/integration.nix
index 01d8e3a..2ec2f3e 100644
--- a/test/integration.nix
+++ b/test/integration.nix
@@ -13,6 +13,7 @@ import "${nixpkgs}/nixos/tests/make-test-python.nix" ({pkgs, ...}: {
   nodes.system1 = {
     config,
     lib,
+    options,
     ...
   }: {
     imports = [
@@ -26,6 +27,8 @@ import "${nixpkgs}/nixos/tests/make-test-python.nix" ({pkgs, ...}: {
       file = ../example/passwordfile-user1.age;
     };
 
+    age.identityPaths = options.age.identityPaths.default ++ ["/etc/ssh/this_key_wont_exist"];
+
     users = {
       mutableUsers = false;
 
diff --git a/test/integration_darwin.nix b/test/integration_darwin.nix
index 24a8579..4894caa 100644
--- a/test/integration_darwin.nix
+++ b/test/integration_darwin.nix
@@ -1,6 +1,7 @@
 {
   config,
   pkgs,
+  options,
   ...
 }: let
   secret = "hello";
@@ -18,6 +19,8 @@ in {
 
   services.nix-daemon.enable = true;
 
+  age.identityPaths = options.age.identityPaths.default ++ ["/etc/ssh/this_key_wont_exist"];
+
   age.secrets.secret1.file = ../example/secret1.age;
 
   environment.systemPackages = [testScript];

From 37c729795605ec52638a7bdab1ec52e15eb3ff3a Mon Sep 17 00:00:00 2001
From: Nathan Henrie <nate@n8henrie.com>
Date: Tue, 7 Feb 2023 13:38:59 -0700
Subject: [PATCH 2/2] Skip missing or unreadable keys

---
 modules/age.nix | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/modules/age.nix b/modules/age.nix
index e89125e..c33fb9c 100644
--- a/modules/age.nix
+++ b/modules/age.nix
@@ -54,8 +54,6 @@ with lib; let
     chown :${chownGroup} "${cfg.secretsMountPoint}" "${cfg.secretsMountPoint}/$_agenix_generation"
   '';
 
-  identities = builtins.concatStringsSep " " (map (path: "-i ${path}") cfg.identityPaths);
-
   setTruePath = secretType: ''
     ${
       if secretType.symlink
@@ -72,13 +70,23 @@ with lib; let
     ${setTruePath secretType}
     echo "decrypting '${secretType.file}' to '$_truePath'..."
     TMP_FILE="$_truePath.tmp"
+
+    IDENTITIES=()
+    for identity in ${toString cfg.identityPaths}; do
+      test -r "$identity" || continue
+      IDENTITIES+=(-i)
+      IDENTITIES+=("$identity")
+    done
+
+    test "''${#IDENTITIES[@]}" -eq 0 && echo "[agenix] WARNING: no readable identities found!"
+
     mkdir -p "$(dirname "$_truePath")"
     [ "${secretType.path}" != "${cfg.secretsDir}/${secretType.name}" ] && mkdir -p "$(dirname "${secretType.path}")"
     (
       umask u=r,g=,o=
       test -f "${secretType.file}" || echo '[agenix] WARNING: encrypted file ${secretType.file} does not exist!'
       test -d "$(dirname "$TMP_FILE")" || echo "[agenix] WARNING: $(dirname "$TMP_FILE") does not exist!"
-      LANG=${config.i18n.defaultLocale or "C"} ${ageBin} --decrypt ${identities} -o "$TMP_FILE" "${secretType.file}"
+      LANG=${config.i18n.defaultLocale or "C"} ${ageBin} --decrypt "''${IDENTITIES[@]}" -o "$TMP_FILE" "${secretType.file}"
     )
     chmod ${secretType.mode} "$TMP_FILE"
     mv -f "$TMP_FILE" "$_truePath"