move clanCore into nixosModules, add secrets generate command

pkgs/clan-cli/clan_cli/secrets/__init__.py

@@ -1,6 +1,7 @@
 # !/usr/bin/env python3
 import argparse
 
+from .generate import register_generate_parser
 from .groups import register_groups_parser
 from .import_sops import register_import_sops_parser
 from .machines import register_machines_parser
@@ -29,4 +30,9 @@ def register_parser(parser: argparse.ArgumentParser) -> None:
     import_sops_parser = subparser.add_parser("import-sops", help="import a sops file")
     register_import_sops_parser(import_sops_parser)
 
+    parser_generate = subparser.add_parser(
+        "generate", help="generate secrets for machines if they don't exist yet"
+    )
+    register_generate_parser(parser_generate)
+
     register_secrets_parser(subparser)

pkgs/clan-cli/clan_cli/secrets/generate.py

@@ -0,0 +1,51 @@
+import argparse
+import subprocess
+import sys
+
+from clan_cli.errors import ClanError
+
+
+def get_secret_script(machine: str) -> None:
+    proc = subprocess.run(
+        [
+            "nix",
+            "build",
+            "--impure",
+            "--print-out-paths",
+            "--expr",
+            "let f = builtins.getFlake (toString ./.); in "
+            f"(f.nixosConfigurations.{machine}.extendModules "
+            "{ modules = [{ clanCore.clanDir = toString ./.; }]; })"
+            ".config.system.clan.generateSecrets",
+        ],
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+    if proc.returncode != 0:
+        print(proc.stderr, file=sys.stderr)
+        raise ClanError(f"failed to generate secrets:\n{proc.stderr}")
+
+    secret_generator_script = proc.stdout.strip()
+    print(secret_generator_script)
+    secret_generator = subprocess.run(
+        [secret_generator_script],
+        check=True,
+    )
+
+    if secret_generator.returncode != 0:
+        raise ClanError("failed to generate secrets")
+    else:
+        print("successfully generated secrets")
+
+
+def generate_command(args: argparse.Namespace) -> None:
+    get_secret_script(args.machine)
+
+
+def register_generate_parser(parser: argparse.ArgumentParser) -> None:
+    parser.add_argument(
+        "machine",
+        help="The machine to generate secrets for",
+    )
+    parser.set_defaults(func=generate_command)