mynix/agenix
1
0
Fork 0
mirror of https://github.com/ryantm/agenix.git synced 2024-11-24 02:28:30 +03:00
Code Issues Projects Releases Packages Wiki Activity

contrib: format Nix code with Alejandra

Browse source
This commit is contained in:
Ryan Mulligan 2023-01-29 08:36:01 -08:00
parent 99e0963743
commit 16bef569f4
6 changed files with 245 additions and 226 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

83
modules/age.nix
View file

@ -1,14 +1,17 @@
{ config, options, lib, pkgs, ... }:
with lib;
let
{
config,
options,
lib,
pkgs,
...
}:
with lib; let
cfg = config.age;
# we need at least rage 0.5.0 to support ssh keys
rage =
if lib.versionOlder pkgs.rage.version "0.5.0"
then pkgs.callPackage ../pkgs/rage.nix { }
then pkgs.callPackage ../pkgs/rage.nix {}
else pkgs.rage;
ageBin = config.age.ageBin;
@ -28,11 +31,15 @@ let
identities = builtins.concatStringsSep " " (map (path: "-i ${path}") cfg.identityPaths);
setTruePath = secretType: ''
${if secretType.symlink then ''
${
if secretType.symlink
then ''
_truePath="${cfg.secretsMountPoint}/$_agenix_generation/${secretType.name}"
'' else ''
''
else ''
_truePath="${secretType.path}"
''}
''
}
'';
installSecret = secretType: ''
@ -55,9 +62,11 @@ let
''}
'';
testIdentities = map (path: ''
testIdentities =
map (path: ''
test -f ${path} || echo '[agenix] WARNING: config.age.identityPaths entry ${path} not present!'
'') cfg.identityPaths;
'')
cfg.identityPaths;
cleanupAndLink = ''
_agenix_generation="$(basename "$(readlink ${cfg.secretsDir})" || echo 0)"
@ -72,10 +81,10 @@ let
'';
installSecrets = builtins.concatStringsSep "\n" (
[ "echo '[agenix] decrypting secrets...'" ]
["echo '[agenix] decrypting secrets...'"]
++ testIdentities
++ (map installSecret (builtins.attrValues cfg.secrets))
++ [ cleanupAndLink ]
++ [cleanupAndLink]
);
chownSecret = secretType: ''
@ -90,11 +99,12 @@ let
'';
chownSecrets = builtins.concatStringsSep "\n" (
[ "echo '[agenix] chowning...'" ]
++ [ chownMountPoint ]
++ (map chownSecret (builtins.attrValues cfg.secrets)));
["echo '[agenix] chowning...'"]
++ [chownMountPoint]
++ (map chownSecret (builtins.attrValues cfg.secrets))
);
secretType = types.submodule ({ config, ... }: {
secretType = types.submodule ({config, ...}: {
options = {
name = mkOption {
type = types.str;
@ -137,14 +147,12 @@ let
Group of the decrypted secret.
'';
};
symlink = mkEnableOption "symlinking secrets to their destination" // { default = true; };
symlink = mkEnableOption "symlinking secrets to their destination" // {default = true;};
};
});
in
{
in {
imports = [
(mkRenamedOptionModule [ "age" "sshKeyPaths" ] [ "age" "identityPaths" ])
(mkRenamedOptionModule ["age" "sshKeyPaths"] ["age" "identityPaths"])
];
options.age = {
@ -157,7 +165,7 @@ in
};
secrets = mkOption {
type = types.attrsOf secretType;
default = { };
default = {};
description = ''
Attrset of secrets.
'';
@ -170,11 +178,13 @@ in
'';
};
secretsMountPoint = mkOption {
type = types.addCheck types.str
type =
types.addCheck types.str
(s:
(builtins.match "[ \t\n]*" s) == null # non-empty
(builtins.match "[ \t\n]*" s)
== null # non-empty
&& (builtins.match ".+/" s) == null) # without trailing slash
// { description = "${types.str.description} (with check: non-empty without trailing slash)"; };
// {description = "${types.str.description} (with check: non-empty without trailing slash)";};
default = "/run/agenix.d";
defaultText = "/run/agenix.d";
description = ''
@ -184,20 +194,22 @@ in
identityPaths = mkOption {
type = types.listOf types.path;
default =
if config.services.openssh.enable then
map (e: e.path) (lib.filter (e: e.type == "rsa" || e.type == "ed25519") config.services.openssh.hostKeys)
else [ ];
if config.services.openssh.enable
then map (e: e.path) (lib.filter (e: e.type == "rsa" || e.type == "ed25519") config.services.openssh.hostKeys)
else [];
description = ''
Path to SSH keys to be used as identities in age decryption.
'';
};
};
config = mkIf (cfg.secrets != { }) {
assertions = [{
assertion = cfg.identityPaths != [ ];
config = mkIf (cfg.secrets != {}) {
assertions = [
{
assertion = cfg.identityPaths != [];
message = "age.identityPaths must be set.";
}];
}
];
# Create a new directory full of secrets for symlinking (this helps
# ensure removed secrets are actually removed, or at least become
@ -218,7 +230,7 @@ in
};
# So user passwords can be encrypted.
system.activationScripts.users.deps = [ "agenixInstall" ];
system.activationScripts.users.deps = ["agenixInstall"];
# Change ownership and group after users and groups are made.
system.activationScripts.agenixChown = {
@ -232,8 +244,7 @@ in
# So other activation scripts can depend on agenix being done.
system.activationScripts.agenix = {
text = "";
deps = [ "agenixChown"];
deps = ["agenixChown"];
};
};
}

5
overlay.nix
View file

@ -1,4 +1,3 @@
final: prev:
{
agenix = prev.callPackage ./pkgs/agenix.nix { };
final: prev: {
agenix = prev.callPackage ./pkgs/agenix.nix {};
}

52
pkgs/agenix.nix
View file

@ -13,20 +13,19 @@
if rage.version < "0.5.0"
then callPackage ./rage.nix {}
else rage
}/bin/rage"
} :
let
}/bin/rage",
}: let
sedBin = "${gnused}/bin/sed";
nixInstantiate = "${nix}/bin/nix-instantiate";
mktempBin = "${mktemp}/bin/mktemp";
diffBin = "${diffutils}/bin/diff";
in
lib.recursiveUpdate (writeShellScriptBin "agenix" ''
set -Eeuo pipefail
lib.recursiveUpdate (writeShellScriptBin "agenix" ''
set -Eeuo pipefail
PACKAGE="agenix"
PACKAGE="agenix"
function show_help () {
function show_help () {
echo "$PACKAGE - edit and rekey age secret files"
echo " "
echo "$PACKAGE -e FILE [-i PRIVATE_KEY]"
@ -51,14 +50,14 @@ function show_help () {
echo "agenix version: 0.13.0"
echo "age binary path: ${ageBin}"
echo "age version: $(${ageBin} --version)"
}
}
test $# -eq 0 && (show_help && exit 1)
test $# -eq 0 && (show_help && exit 1)
REKEY=0
DEFAULT_DECRYPT=(--decrypt)
REKEY=0
DEFAULT_DECRYPT=(--decrypt)
while test $# -gt 0; do
while test $# -gt 0; do
case "$1" in
-h|--help)
show_help
@ -97,11 +96,11 @@ while test $# -gt 0; do
exit 1
;;
esac
done
done
RULES=''${RULES:-./secrets.nix}
RULES=''${RULES:-./secrets.nix}
function cleanup {
function cleanup {
if [ ! -z ''${CLEARTEXT_DIR+x} ]
then
rm -rf "$CLEARTEXT_DIR"
@ -110,10 +109,10 @@ function cleanup {
then
rm -rf "$REENCRYPTED_DIR"
fi
}
trap "cleanup" 0 2 3 15
}
trap "cleanup" 0 2 3 15
function edit {
function edit {
FILE=$1
KEYS=$((${nixInstantiate} --eval -E "(let rules = import $RULES; in builtins.concatStringsSep \"\n\" rules.\"$FILE\".publicKeys)" | ${sedBin} 's/"//g' | ${sedBin} 's/\\n/\n/g') | ${sedBin} '/^$/d' || exit 1)
@ -167,9 +166,9 @@ function edit {
${ageBin} "''${ENCRYPT[@]}" <"$CLEARTEXT_FILE" || exit 1
mv -f "$REENCRYPTED_FILE" "$1"
}
}
function rekey {
function rekey {
FILES=$((${nixInstantiate} --eval -E "(let rules = import $RULES; in builtins.concatStringsSep \"\n\" (builtins.attrNames rules))" | ${sedBin} 's/"//g' | ${sedBin} 's/\\n/\n/g') || exit 1)
for FILE in $FILES
@ -178,12 +177,11 @@ function rekey {
EDITOR=: edit "$FILE"
cleanup
done
}
}
[ $REKEY -eq 1 ] && rekey && exit 0
edit "$FILE" && cleanup && exit 0
'')
{
[ $REKEY -eq 1 ] && rekey && exit 0
edit "$FILE" && cleanup && exit 0
'')
{
meta.description = "age-encrypted secrets for NixOS";
}
}

18
pkgs/rage.nix
View file

@ -1,5 +1,10 @@
{ stdenv, rustPlatform, fetchFromGitHub, installShellFiles, darwin }:
{
stdenv,
rustPlatform,
fetchFromGitHub,
installShellFiles,
darwin,
}:
rustPlatform.buildRustPackage rec {
pname = "rage";
version = "0.5.0";
@ -13,9 +18,10 @@ rustPlatform.buildRustPackage rec {
cargoSha256 = "sha256-GPr5zxeODAjD+ynp/nned9gZUiReYcdzosuEbLIKZSs=";
nativeBuildInputs = [ installShellFiles ];
nativeBuildInputs = [installShellFiles];
buildInputs = with darwin.apple_sdk.frameworks; stdenv.lib.optionals stdenv.isDarwin [
buildInputs = with darwin.apple_sdk.frameworks;
stdenv.lib.optionals stdenv.isDarwin [
Security
Foundation
];
@ -37,7 +43,7 @@ rustPlatform.buildRustPackage rec {
description = "A simple, secure and modern encryption tool with small explicit keys, no config options, and UNIX-style composability";
homepage = "https://github.com/str4d/rage";
changelog = "https://github.com/str4d/rage/releases/tag/v${version}";
license = with licenses; [ asl20 mit ]; # either at your option
maintainers = with maintainers; [ marsam ryantm ];
license = with licenses; [asl20 mit]; # either at your option
maintainers = with maintainers; [marsam ryantm];
};
}

2
test/install_ssh_host_keys.nix
View file

@ -1,6 +1,6 @@
# Do not copy this! It is insecure. This is only okay because we are testing.
{
system.activationScripts.agenixInstall.deps = [ "installSSHHostKeys" ];
system.activationScripts.agenixInstall.deps = ["installSSHHostKeys"];
system.activationScripts.installSSHHostKeys.text = ''
mkdir -p /etc/ssh

29
test/integration.nix
View file

@ -1,14 +1,20 @@
{
nixpkgs ? <nixpkgs>,
pkgs ? import <nixpkgs> { inherit system; config = {}; },
system ? builtins.currentSystem
} @args:
import "${nixpkgs}/nixos/tests/make-test-python.nix" ({ pkgs, ...}: {
nixpkgs ? <nixpkgs>,
pkgs ?
import <nixpkgs> {
inherit system;
config = {};
},
system ? builtins.currentSystem,
} @ args:
import "${nixpkgs}/nixos/tests/make-test-python.nix" ({pkgs, ...}: {
name = "agenix-integration";
nodes.system1 = { config, lib, ... }: {
nodes.system1 = {
config,
lib,
...
}: {
imports = [
../modules/age.nix
./install_ssh_host_keys.nix
@ -30,11 +36,9 @@ import "${nixpkgs}/nixos/tests/make-test-python.nix" ({ pkgs, ...}: {
};
};
};
};
testScript =
let
testScript = let
user = "user1";
password = "password1234";
in ''
@ -55,4 +59,5 @@ import "${nixpkgs}/nixos/tests/make-test-python.nix" ({ pkgs, ...}: {
system1.wait_for_file("/tmp/1")
assert "${user}" in system1.succeed("cat /tmp/1")
'';
}) args
})
args