|
1 | | -{ config, lib, pkgs, ... }: |
| 1 | +{ |
| 2 | + config, |
| 3 | + lib, |
| 4 | + pkgs, |
| 5 | + ... |
| 6 | +}: |
2 | 7 |
|
3 | 8 | with lib; |
4 | 9 |
|
5 | 10 | let |
6 | | - secret-file = types.submodule ({ ... }@moduleAttrs: { |
7 | | - options = { |
8 | | - name = mkOption { |
9 | | - type = types.str; |
10 | | - default = moduleAttrs.config._module.args.name; |
| 11 | + secret-file = types.submodule ( |
| 12 | + { ... }@moduleAttrs: |
| 13 | + { |
| 14 | + options = { |
| 15 | + name = mkOption { |
| 16 | + type = types.str; |
| 17 | + default = moduleAttrs.config._module.args.name; |
| 18 | + }; |
| 19 | + path = mkOption { |
| 20 | + type = types.str; |
| 21 | + readOnly = true; |
| 22 | + default = "/run/secrets-old/${removeSuffix ".gpg" (baseNameOf moduleAttrs.config.source-path)}"; |
| 23 | + }; |
| 24 | + mode = mkOption { |
| 25 | + type = types.str; |
| 26 | + default = "0400"; |
| 27 | + }; |
| 28 | + owner = mkOption { |
| 29 | + type = types.str; |
| 30 | + default = "root"; |
| 31 | + }; |
| 32 | + group-name = mkOption { |
| 33 | + type = types.str; |
| 34 | + default = "root"; |
| 35 | + }; |
| 36 | + source-path = mkOption { |
| 37 | + type = types.str; |
| 38 | + default = pkgs.copyPathToStore "${toString ../../secrets}/${config.networking.hostName}/${moduleAttrs.config.name}.gpg"; |
| 39 | + }; |
| 40 | + encrypted = mkOption { |
| 41 | + type = types.bool; |
| 42 | + default = true; |
| 43 | + }; |
| 44 | + enable = mkOption { |
| 45 | + type = types.bool; |
| 46 | + default = true; |
| 47 | + }; |
11 | 48 | }; |
12 | | - path = mkOption { |
13 | | - type = types.str; |
14 | | - readOnly = true; |
15 | | - default = "/run/secrets/${removeSuffix ".gpg" (baseNameOf moduleAttrs.config.source-path)}"; |
16 | | - }; |
17 | | - mode = mkOption { |
18 | | - type = types.str; |
19 | | - default = "0400"; |
20 | | - }; |
21 | | - owner = mkOption { |
22 | | - type = types.str; |
23 | | - default = "root"; |
24 | | - }; |
25 | | - group-name = mkOption { |
26 | | - type = types.str; |
27 | | - default = "root"; |
28 | | - }; |
29 | | - source-path = mkOption { |
30 | | - type = types.str; |
31 | | - default = pkgs.copyPathToStore "${toString ../../secrets}/${config.networking.hostName}/${moduleAttrs.config.name}.gpg"; |
32 | | - }; |
33 | | - encrypted = mkOption { |
34 | | - type = types.bool; |
35 | | - default = true; |
36 | | - }; |
37 | | - enable = mkOption { |
38 | | - type = types.bool; |
39 | | - default = true; |
40 | | - }; |
41 | | - }; |
42 | | - }); |
| 49 | + } |
| 50 | + ); |
43 | 51 | enabledFiles = filterAttrs (n: file: file.enable) config.secrets; |
44 | 52 |
|
45 | | - mkDecryptSecret = file: pkgs.writeScript "decrypt-secret-${removeSuffix ".gpg" (baseNameOf file.source-path)}.sh" '' |
46 | | - #!${pkgs.runtimeShell} |
47 | | - set -eu pipefail |
48 | | - if [ ! -f "${file.path}" ]; then |
49 | | - umask 0077 |
50 | | - echo "${file.source-path} -> ${file.path}" |
51 | | - ${if file.encrypted then '' |
52 | | - ${pkgs.gnupg}/bin/gpg --decrypt ${escapeShellArg file.source-path} > ${file.path} |
53 | | - '' else '' |
54 | | - cat ${escapeShellArg file.source-path} > ${file.path} |
55 | | - ''} |
56 | | - fi |
57 | | - ''; |
58 | | - mkSetupSecret = file: pkgs.writeScript "setup-secret-${removeSuffix ".gpg" (baseNameOf file.source-path)}.sh" '' |
59 | | - #!${pkgs.runtimeShell} |
60 | | - set -eu pipefail |
61 | | - chown ${escapeShellArg file.owner}:${escapeShellArg file.group-name} ${escapeShellArg file.path} |
62 | | - chmod ${escapeShellArg file.mode} ${escapeShellArg file.path} |
63 | | - ''; |
| 53 | + mkDecryptSecret = |
| 54 | + file: |
| 55 | + pkgs.writeScript "decrypt-secret-${removeSuffix ".gpg" (baseNameOf file.source-path)}.sh" '' |
| 56 | + #!${pkgs.runtimeShell} |
| 57 | + set -eu pipefail |
| 58 | + if [ ! -f "${file.path}" ]; then |
| 59 | + umask 0077 |
| 60 | + echo "${file.source-path} -> ${file.path}" |
| 61 | + ${ |
| 62 | + if file.encrypted then |
| 63 | + '' |
| 64 | + ${pkgs.gnupg}/bin/gpg --decrypt ${escapeShellArg file.source-path} > ${file.path} |
| 65 | + '' |
| 66 | + else |
| 67 | + '' |
| 68 | + cat ${escapeShellArg file.source-path} > ${file.path} |
| 69 | + '' |
| 70 | + } |
| 71 | + fi |
| 72 | + ''; |
| 73 | + mkSetupSecret = |
| 74 | + file: |
| 75 | + pkgs.writeScript "setup-secret-${removeSuffix ".gpg" (baseNameOf file.source-path)}.sh" '' |
| 76 | + #!${pkgs.runtimeShell} |
| 77 | + set -eu pipefail |
| 78 | + chown ${escapeShellArg file.owner}:${escapeShellArg file.group-name} ${escapeShellArg file.path} |
| 79 | + chmod ${escapeShellArg file.mode} ${escapeShellArg file.path} |
| 80 | + ''; |
64 | 81 |
|
65 | | -in { |
| 82 | +in |
| 83 | +{ |
66 | 84 | options.secrets = mkOption { |
67 | 85 | type = with types; attrsOf secret-file; |
68 | | - default = {}; |
| 86 | + default = { }; |
69 | 87 | }; |
70 | | - config = mkIf (enabledFiles != {}) { |
71 | | - system.activationScripts = let |
72 | | - files = unique (map (flip removeAttrs ["_module"]) (attrValues enabledFiles)); |
73 | | - decrypt = '' |
74 | | - function fail() { |
75 | | - rm $1 |
76 | | - echo "failed to decrypt $1" |
77 | | - } |
78 | | - echo setting up secrets... |
79 | | - mkdir -p /run/secrets |
80 | | - chown 0:0 /run/secrets |
81 | | - chmod 0755 /run/secrets |
82 | | - ${concatMapStringsSep "\n" (file: '' |
83 | | - ${mkDecryptSecret file} || fail ${file.path} |
84 | | - '') files} |
85 | | - ''; |
86 | | - setup = '' |
87 | | - echo setting up secrets... |
88 | | - ${concatMapStringsSep "\n" (file: '' |
89 | | - ${mkSetupSecret file} || echo "failed to set up ${file.path}" |
90 | | - '') files} |
91 | | - ''; |
92 | | - in { |
93 | | - decrypt-secrets.text = "source ${pkgs.writeText "setup-secrets.sh" decrypt}"; |
94 | | - setup-secrets = stringAfter [ "users" "groups" ] "source ${pkgs.writeText "setup-secrets.sh" setup}"; |
95 | | - }; |
| 88 | + config = mkIf (enabledFiles != { }) { |
| 89 | + system.activationScripts = |
| 90 | + let |
| 91 | + files = unique (map (flip removeAttrs [ "_module" ]) (attrValues enabledFiles)); |
| 92 | + decrypt = '' |
| 93 | + function fail() { |
| 94 | + rm $1 |
| 95 | + echo "failed to decrypt $1" |
| 96 | + } |
| 97 | + echo setting up secrets... |
| 98 | + mkdir -p /run/secrets-old |
| 99 | + chown 0:0 /run/secrets-old |
| 100 | + chmod 0755 /run/secrets-old |
| 101 | + ${concatMapStringsSep "\n" (file: '' |
| 102 | + ${mkDecryptSecret file} || fail ${file.path} |
| 103 | + '') files} |
| 104 | + ''; |
| 105 | + setup = '' |
| 106 | + echo setting up secrets... |
| 107 | + ${concatMapStringsSep "\n" (file: '' |
| 108 | + ${mkSetupSecret file} || echo "failed to set up ${file.path}" |
| 109 | + '') files} |
| 110 | + ''; |
| 111 | + in |
| 112 | + { |
| 113 | + decrypt-secrets.text = "source ${pkgs.writeText "setup-secrets.sh" decrypt}"; |
| 114 | + setup-secrets = stringAfter [ |
| 115 | + "users" |
| 116 | + "groups" |
| 117 | + ] "source ${pkgs.writeText "setup-secrets.sh" setup}"; |
| 118 | + }; |
96 | 119 | }; |
97 | 120 | } |
0 commit comments