2023-01-29 19:36:01 +03:00
|
|
|
{
|
|
|
|
config,
|
|
|
|
options,
|
|
|
|
lib,
|
|
|
|
pkgs,
|
|
|
|
...
|
|
|
|
}:
|
|
|
|
with lib; let
|
2020-09-01 07:37:26 +03:00
|
|
|
cfg = config.age;
|
2021-03-02 00:11:02 +03:00
|
|
|
|
2023-02-20 15:47:48 +03:00
|
|
|
isDarwin = lib.attrsets.hasAttrByPath ["environment" "darwinConfig"] options;
|
2023-01-30 01:42:58 +03:00
|
|
|
|
2021-12-06 02:08:18 +03:00
|
|
|
ageBin = config.age.ageBin;
|
2020-09-18 21:59:01 +03:00
|
|
|
|
2020-09-01 07:37:26 +03:00
|
|
|
users = config.users.users;
|
|
|
|
|
2023-01-30 01:42:58 +03:00
|
|
|
mountCommand =
|
2023-01-30 19:18:56 +03:00
|
|
|
if isDarwin
|
|
|
|
then ''
|
2023-01-30 19:06:03 +03:00
|
|
|
if ! diskutil info "${cfg.secretsMountPoint}" &> /dev/null; then
|
2023-01-31 01:51:52 +03:00
|
|
|
num_sectors=1048576
|
|
|
|
dev=$(hdiutil attach -nomount ram://"$num_sectors" | sed 's/[[:space:]]*$//')
|
2023-01-30 19:06:59 +03:00
|
|
|
newfs_hfs -v agenix "$dev"
|
2023-01-30 01:42:58 +03:00
|
|
|
mount -t hfs -o nobrowse,nodev,nosuid,-m=0751 "$dev" "${cfg.secretsMountPoint}"
|
|
|
|
fi
|
|
|
|
''
|
|
|
|
else ''
|
|
|
|
grep -q "${cfg.secretsMountPoint} ramfs" /proc/mounts ||
|
|
|
|
mount -t ramfs none "${cfg.secretsMountPoint}" -o nodev,nosuid,mode=0751
|
|
|
|
'';
|
2022-07-10 21:47:58 +03:00
|
|
|
newGeneration = ''
|
2024-09-11 00:56:24 +03:00
|
|
|
_agenix_generation="$(basename "$(readlink "${cfg.secretsDir}" || echo 0)")"
|
2022-07-10 21:47:58 +03:00
|
|
|
(( ++_agenix_generation ))
|
|
|
|
echo "[agenix] creating new generation in ${cfg.secretsMountPoint}/$_agenix_generation"
|
|
|
|
mkdir -p "${cfg.secretsMountPoint}"
|
|
|
|
chmod 0751 "${cfg.secretsMountPoint}"
|
2023-01-30 01:42:58 +03:00
|
|
|
${mountCommand}
|
2022-07-10 21:47:58 +03:00
|
|
|
mkdir -p "${cfg.secretsMountPoint}/$_agenix_generation"
|
|
|
|
chmod 0751 "${cfg.secretsMountPoint}/$_agenix_generation"
|
|
|
|
'';
|
|
|
|
|
2023-01-30 01:42:58 +03:00
|
|
|
chownGroup =
|
|
|
|
if isDarwin
|
|
|
|
then "admin"
|
|
|
|
else "keys";
|
|
|
|
# chown the secrets mountpoint and the current generation to the keys group
|
|
|
|
# instead of leaving it root:root.
|
|
|
|
chownMountPoint = ''
|
|
|
|
chown :${chownGroup} "${cfg.secretsMountPoint}" "${cfg.secretsMountPoint}/$_agenix_generation"
|
|
|
|
'';
|
|
|
|
|
2022-07-10 21:47:58 +03:00
|
|
|
setTruePath = secretType: ''
|
2023-01-29 19:36:01 +03:00
|
|
|
${
|
|
|
|
if secretType.symlink
|
|
|
|
then ''
|
|
|
|
_truePath="${cfg.secretsMountPoint}/$_agenix_generation/${secretType.name}"
|
|
|
|
''
|
|
|
|
else ''
|
|
|
|
_truePath="${secretType.path}"
|
|
|
|
''
|
|
|
|
}
|
2022-07-10 21:47:58 +03:00
|
|
|
'';
|
|
|
|
|
|
|
|
installSecret = secretType: ''
|
|
|
|
${setTruePath secretType}
|
2021-02-25 13:23:15 +03:00
|
|
|
echo "decrypting '${secretType.file}' to '$_truePath'..."
|
|
|
|
TMP_FILE="$_truePath.tmp"
|
2023-02-07 23:38:59 +03:00
|
|
|
|
|
|
|
IDENTITIES=()
|
|
|
|
for identity in ${toString cfg.identityPaths}; do
|
|
|
|
test -r "$identity" || continue
|
2023-12-21 00:13:47 +03:00
|
|
|
test -s "$identity" || continue
|
2023-02-07 23:38:59 +03:00
|
|
|
IDENTITIES+=(-i)
|
|
|
|
IDENTITIES+=("$identity")
|
|
|
|
done
|
|
|
|
|
|
|
|
test "''${#IDENTITIES[@]}" -eq 0 && echo "[agenix] WARNING: no readable identities found!"
|
|
|
|
|
2021-02-25 13:23:15 +03:00
|
|
|
mkdir -p "$(dirname "$_truePath")"
|
2022-02-22 02:05:42 +03:00
|
|
|
[ "${secretType.path}" != "${cfg.secretsDir}/${secretType.name}" ] && mkdir -p "$(dirname "${secretType.path}")"
|
2021-05-13 06:11:17 +03:00
|
|
|
(
|
|
|
|
umask u=r,g=,o=
|
2022-03-08 18:58:08 +03:00
|
|
|
test -f "${secretType.file}" || echo '[agenix] WARNING: encrypted file ${secretType.file} does not exist!'
|
|
|
|
test -d "$(dirname "$TMP_FILE")" || echo "[agenix] WARNING: $(dirname "$TMP_FILE") does not exist!"
|
2023-02-07 23:38:59 +03:00
|
|
|
LANG=${config.i18n.defaultLocale or "C"} ${ageBin} --decrypt "''${IDENTITIES[@]}" -o "$TMP_FILE" "${secretType.file}"
|
2021-05-13 06:11:17 +03:00
|
|
|
)
|
2020-09-03 06:49:24 +03:00
|
|
|
chmod ${secretType.mode} "$TMP_FILE"
|
2021-02-25 13:23:15 +03:00
|
|
|
mv -f "$TMP_FILE" "$_truePath"
|
2021-11-08 20:45:34 +03:00
|
|
|
|
|
|
|
${optionalString secretType.symlink ''
|
2023-05-20 02:51:05 +03:00
|
|
|
[ "${secretType.path}" != "${cfg.secretsDir}/${secretType.name}" ] && ln -sfT "${cfg.secretsDir}/${secretType.name}" "${secretType.path}"
|
2021-11-08 20:45:34 +03:00
|
|
|
''}
|
2020-09-02 00:27:54 +03:00
|
|
|
'';
|
2020-09-10 06:41:26 +03:00
|
|
|
|
2023-01-29 19:36:01 +03:00
|
|
|
testIdentities =
|
2023-01-31 00:21:42 +03:00
|
|
|
map
|
|
|
|
(path: ''
|
2023-01-29 19:36:01 +03:00
|
|
|
test -f ${path} || echo '[agenix] WARNING: config.age.identityPaths entry ${path} not present!'
|
|
|
|
'')
|
|
|
|
cfg.identityPaths;
|
2022-07-10 21:47:58 +03:00
|
|
|
|
|
|
|
cleanupAndLink = ''
|
2024-09-11 00:56:24 +03:00
|
|
|
_agenix_generation="$(basename "$(readlink "${cfg.secretsDir}" || echo 0)")"
|
2022-07-10 21:47:58 +03:00
|
|
|
(( ++_agenix_generation ))
|
|
|
|
echo "[agenix] symlinking new secrets to ${cfg.secretsDir} (generation $_agenix_generation)..."
|
2023-05-20 02:51:05 +03:00
|
|
|
ln -sfT "${cfg.secretsMountPoint}/$_agenix_generation" ${cfg.secretsDir}
|
2022-07-10 21:47:58 +03:00
|
|
|
|
|
|
|
(( _agenix_generation > 1 )) && {
|
|
|
|
echo "[agenix] removing old secrets (generation $(( _agenix_generation - 1 )))..."
|
|
|
|
rm -rf "${cfg.secretsMountPoint}/$(( _agenix_generation - 1 ))"
|
|
|
|
}
|
|
|
|
'';
|
2022-03-08 18:58:08 +03:00
|
|
|
|
2022-07-10 21:47:58 +03:00
|
|
|
installSecrets = builtins.concatStringsSep "\n" (
|
2023-01-29 19:36:01 +03:00
|
|
|
["echo '[agenix] decrypting secrets...'"]
|
2022-07-10 21:47:58 +03:00
|
|
|
++ testIdentities
|
|
|
|
++ (map installSecret (builtins.attrValues cfg.secrets))
|
2023-01-29 19:36:01 +03:00
|
|
|
++ [cleanupAndLink]
|
2022-07-10 21:47:58 +03:00
|
|
|
);
|
2021-05-10 00:18:20 +03:00
|
|
|
|
2022-07-10 21:47:58 +03:00
|
|
|
chownSecret = secretType: ''
|
|
|
|
${setTruePath secretType}
|
|
|
|
chown ${secretType.owner}:${secretType.group} "$_truePath"
|
|
|
|
'';
|
2020-09-10 06:41:26 +03:00
|
|
|
|
2022-07-10 21:47:58 +03:00
|
|
|
chownSecrets = builtins.concatStringsSep "\n" (
|
2023-01-29 19:36:01 +03:00
|
|
|
["echo '[agenix] chowning...'"]
|
|
|
|
++ [chownMountPoint]
|
|
|
|
++ (map chownSecret (builtins.attrValues cfg.secrets))
|
|
|
|
);
|
2020-09-01 07:37:26 +03:00
|
|
|
|
2023-01-29 19:36:01 +03:00
|
|
|
secretType = types.submodule ({config, ...}: {
|
2020-09-01 07:37:26 +03:00
|
|
|
options = {
|
|
|
|
name = mkOption {
|
|
|
|
type = types.str;
|
|
|
|
default = config._module.args.name;
|
2023-06-26 17:02:28 +03:00
|
|
|
defaultText = literalExpression "config._module.args.name";
|
2020-09-01 07:37:26 +03:00
|
|
|
description = ''
|
2023-06-26 18:25:55 +03:00
|
|
|
Name of the file used in {option}`age.secretsDir`
|
2020-09-01 07:37:26 +03:00
|
|
|
'';
|
|
|
|
};
|
|
|
|
file = mkOption {
|
2020-09-03 21:24:33 +03:00
|
|
|
type = types.path;
|
2020-09-01 07:37:26 +03:00
|
|
|
description = ''
|
|
|
|
Age file the secret is loaded from.
|
|
|
|
'';
|
|
|
|
};
|
2020-09-03 21:24:33 +03:00
|
|
|
path = mkOption {
|
2021-03-02 00:10:52 +03:00
|
|
|
type = types.str;
|
2022-02-22 02:05:42 +03:00
|
|
|
default = "${cfg.secretsDir}/${config.name}";
|
2023-06-26 17:02:28 +03:00
|
|
|
defaultText = literalExpression ''
|
|
|
|
"''${cfg.secretsDir}/''${config.name}"
|
|
|
|
'';
|
2021-03-02 00:10:52 +03:00
|
|
|
description = ''
|
|
|
|
Path where the decrypted secret is installed.
|
|
|
|
'';
|
|
|
|
};
|
2020-09-01 07:37:26 +03:00
|
|
|
mode = mkOption {
|
|
|
|
type = types.str;
|
|
|
|
default = "0400";
|
|
|
|
description = ''
|
2021-11-24 20:00:28 +03:00
|
|
|
Permissions mode of the decrypted secret in a format understood by chmod.
|
2020-09-01 07:37:26 +03:00
|
|
|
'';
|
|
|
|
};
|
|
|
|
owner = mkOption {
|
|
|
|
type = types.str;
|
2021-05-10 00:18:20 +03:00
|
|
|
default = "0";
|
2020-09-01 07:37:26 +03:00
|
|
|
description = ''
|
2021-11-24 20:00:28 +03:00
|
|
|
User of the decrypted secret.
|
2020-09-01 07:37:26 +03:00
|
|
|
'';
|
|
|
|
};
|
|
|
|
group = mkOption {
|
|
|
|
type = types.str;
|
2021-05-10 00:18:20 +03:00
|
|
|
default = users.${config.owner}.group or "0";
|
2023-06-26 17:02:28 +03:00
|
|
|
defaultText = literalExpression ''
|
|
|
|
users.''${config.owner}.group or "0"
|
|
|
|
'';
|
2020-09-01 07:37:26 +03:00
|
|
|
description = ''
|
2021-11-24 20:00:28 +03:00
|
|
|
Group of the decrypted secret.
|
2020-09-01 07:37:26 +03:00
|
|
|
'';
|
|
|
|
};
|
2023-01-29 19:36:01 +03:00
|
|
|
symlink = mkEnableOption "symlinking secrets to their destination" // {default = true;};
|
2020-09-01 07:37:26 +03:00
|
|
|
};
|
|
|
|
});
|
2023-01-29 19:36:01 +03:00
|
|
|
in {
|
2021-12-06 03:05:06 +03:00
|
|
|
imports = [
|
2023-01-29 19:36:01 +03:00
|
|
|
(mkRenamedOptionModule ["age" "sshKeyPaths"] ["age" "identityPaths"])
|
2021-12-06 03:05:06 +03:00
|
|
|
];
|
|
|
|
|
2020-09-01 07:37:26 +03:00
|
|
|
options.age = {
|
2021-12-06 02:08:18 +03:00
|
|
|
ageBin = mkOption {
|
|
|
|
type = types.str;
|
2023-12-21 00:13:47 +03:00
|
|
|
default = "${pkgs.age}/bin/age";
|
2023-06-26 17:02:28 +03:00
|
|
|
defaultText = literalExpression ''
|
2023-12-21 00:13:47 +03:00
|
|
|
"''${pkgs.age}/bin/age"
|
2023-06-26 17:02:28 +03:00
|
|
|
'';
|
2021-12-06 02:08:18 +03:00
|
|
|
description = ''
|
|
|
|
The age executable to use.
|
|
|
|
'';
|
|
|
|
};
|
2020-09-01 07:37:26 +03:00
|
|
|
secrets = mkOption {
|
|
|
|
type = types.attrsOf secretType;
|
2023-01-29 19:36:01 +03:00
|
|
|
default = {};
|
2020-09-01 07:37:26 +03:00
|
|
|
description = ''
|
|
|
|
Attrset of secrets.
|
|
|
|
'';
|
|
|
|
};
|
2022-02-22 02:05:42 +03:00
|
|
|
secretsDir = mkOption {
|
|
|
|
type = types.path;
|
|
|
|
default = "/run/agenix";
|
|
|
|
description = ''
|
|
|
|
Folder where secrets are symlinked to
|
|
|
|
'';
|
|
|
|
};
|
2021-02-25 13:23:15 +03:00
|
|
|
secretsMountPoint = mkOption {
|
2023-01-29 19:36:01 +03:00
|
|
|
type =
|
|
|
|
types.addCheck types.str
|
2021-02-25 13:23:15 +03:00
|
|
|
(s:
|
2023-01-29 19:36:01 +03:00
|
|
|
(builtins.match "[ \t\n]*" s)
|
|
|
|
== null # non-empty
|
|
|
|
&& (builtins.match ".+/" s) == null) # without trailing slash
|
|
|
|
// {description = "${types.str.description} (with check: non-empty without trailing slash)";};
|
2021-11-08 20:50:20 +03:00
|
|
|
default = "/run/agenix.d";
|
2021-02-25 13:23:15 +03:00
|
|
|
description = ''
|
2023-06-26 18:25:55 +03:00
|
|
|
Where secrets are created before they are symlinked to {option}`age.secretsDir`
|
2021-02-25 13:23:15 +03:00
|
|
|
'';
|
|
|
|
};
|
2021-12-06 03:05:06 +03:00
|
|
|
identityPaths = mkOption {
|
2023-02-27 02:11:56 +03:00
|
|
|
type = types.listOf types.path;
|
2021-03-02 00:10:52 +03:00
|
|
|
default =
|
2023-01-30 01:42:58 +03:00
|
|
|
if (config.services.openssh.enable or false)
|
2023-01-29 19:36:01 +03:00
|
|
|
then map (e: e.path) (lib.filter (e: e.type == "rsa" || e.type == "ed25519") config.services.openssh.hostKeys)
|
2023-01-30 01:42:58 +03:00
|
|
|
else if isDarwin
|
|
|
|
then [
|
|
|
|
"/etc/ssh/ssh_host_ed25519_key"
|
|
|
|
"/etc/ssh/ssh_host_rsa_key"
|
|
|
|
]
|
2023-01-29 19:36:01 +03:00
|
|
|
else [];
|
2023-06-26 17:02:28 +03:00
|
|
|
defaultText = literalExpression ''
|
|
|
|
if (config.services.openssh.enable or false)
|
|
|
|
then map (e: e.path) (lib.filter (e: e.type == "rsa" || e.type == "ed25519") config.services.openssh.hostKeys)
|
|
|
|
else if isDarwin
|
|
|
|
then [
|
|
|
|
"/etc/ssh/ssh_host_ed25519_key"
|
|
|
|
"/etc/ssh/ssh_host_rsa_key"
|
|
|
|
]
|
|
|
|
else [];
|
|
|
|
'';
|
2023-02-27 02:11:56 +03:00
|
|
|
description = ''
|
|
|
|
Path to SSH keys to be used as identities in age decryption.
|
|
|
|
'';
|
2020-09-01 07:37:26 +03:00
|
|
|
};
|
|
|
|
};
|
|
|
|
|
2023-01-30 01:42:58 +03:00
|
|
|
config = mkIf (cfg.secrets != {}) (mkMerge [
|
|
|
|
{
|
|
|
|
assertions = [
|
|
|
|
{
|
|
|
|
assertion = cfg.identityPaths != [];
|
|
|
|
message = "age.identityPaths must be set.";
|
|
|
|
}
|
2022-07-10 19:39:23 +03:00
|
|
|
];
|
2023-01-30 01:42:58 +03:00
|
|
|
}
|
2022-07-10 19:39:23 +03:00
|
|
|
|
2023-01-30 01:42:58 +03:00
|
|
|
(optionalAttrs (!isDarwin) {
|
|
|
|
# Create a new directory full of secrets for symlinking (this helps
|
|
|
|
# ensure removed secrets are actually removed, or at least become
|
|
|
|
# invalid symlinks).
|
|
|
|
system.activationScripts.agenixNewGeneration = {
|
|
|
|
text = newGeneration;
|
|
|
|
deps = [
|
|
|
|
"specialfs"
|
|
|
|
];
|
|
|
|
};
|
2021-02-25 13:23:15 +03:00
|
|
|
|
2023-01-30 01:42:58 +03:00
|
|
|
system.activationScripts.agenixInstall = {
|
|
|
|
text = installSecrets;
|
|
|
|
deps = [
|
|
|
|
"agenixNewGeneration"
|
|
|
|
"specialfs"
|
|
|
|
];
|
|
|
|
};
|
2021-09-10 21:20:54 +03:00
|
|
|
|
2023-01-30 01:42:58 +03:00
|
|
|
# So user passwords can be encrypted.
|
|
|
|
system.activationScripts.users.deps = ["agenixInstall"];
|
2021-09-10 21:20:54 +03:00
|
|
|
|
2023-01-30 01:42:58 +03:00
|
|
|
# Change ownership and group after users and groups are made.
|
|
|
|
system.activationScripts.agenixChown = {
|
|
|
|
text = chownSecrets;
|
|
|
|
deps = [
|
|
|
|
"users"
|
|
|
|
"groups"
|
|
|
|
];
|
|
|
|
};
|
|
|
|
|
|
|
|
# So other activation scripts can depend on agenix being done.
|
|
|
|
system.activationScripts.agenix = {
|
|
|
|
text = "";
|
|
|
|
deps = ["agenixChown"];
|
|
|
|
};
|
|
|
|
})
|
|
|
|
(optionalAttrs isDarwin {
|
|
|
|
launchd.daemons.activate-agenix = {
|
|
|
|
script = ''
|
|
|
|
set -e
|
|
|
|
set -o pipefail
|
|
|
|
export PATH="${pkgs.gnugrep}/bin:${pkgs.coreutils}/bin:@out@/sw/bin:/usr/bin:/bin:/usr/sbin:/sbin"
|
|
|
|
${newGeneration}
|
|
|
|
${installSecrets}
|
|
|
|
${chownSecrets}
|
|
|
|
exit 0
|
|
|
|
'';
|
2023-01-31 00:21:42 +03:00
|
|
|
serviceConfig = {
|
|
|
|
RunAtLoad = true;
|
|
|
|
KeepAlive.SuccessfulExit = false;
|
|
|
|
};
|
2023-01-30 01:42:58 +03:00
|
|
|
};
|
|
|
|
})
|
|
|
|
]);
|
2020-09-01 07:37:26 +03:00
|
|
|
}
|