mynix/agenix
1
0
Fork 0
mirror of https://github.com/ryantm/agenix.git synced 2024-11-25 11:08:30 +03:00
Code Issues Projects Releases Packages Wiki Activity

overhaul on change actions

Browse source 
compare the decrypted secrets, and make use of /run/nixos/activation-{restart,reload}-list
This commit is contained in:
Taeer Bar-Yam 2022-06-01 07:01:51 -04:00
parent 5a98964a52
commit 34f637d93e
3 changed files with 45 additions and 49 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
flake.lock
View file

@ -2,11 +2,11 @@
"nodes": {
"nixpkgs": {
"locked": {
"lastModified": 1638587357,
"narHash": "sha256-2ySMW3QARG8BsRPmwe7clTbdCuaObromOKewykP+UJc=",
"lastModified": 1653996475,
"narHash": "sha256-r/UA7h3Dfgf4dlOCkakpqejf1Tagfb+6T+9OdT0qBgU=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "e34c5379866833f41e2a36f309912fa675d687c7",
"rev": "ec6eaba9dfcfdd11547d75a193e91e26701bf7e3",
"type": "github"
},
"original": {

86
modules/age.nix
View file

@ -1,4 +1,4 @@
{ config, options, lib, pkgs, ... }:
{ config, options, lib, utils, pkgs, ... }:
with lib;
@ -18,8 +18,10 @@ let
installSecret = secretType: ''
${if secretType.symlink then ''
_truePath="${cfg.secretsMountPoint}/$_agenix_generation/${secretType.name}"
_oldPath="${cfg.secretsMountPoint}/$(( _agenix_generation - 1 ))/${secretType.name}"
'' else ''
_truePath="${secretType.path}"
_oldPath=_truePath
''}
echo "decrypting '${secretType.file}' to '$_truePath'..."
TMP_FILE="$_truePath.tmp"
@ -33,8 +35,18 @@ let
)
chmod ${secretType.mode} "$TMP_FILE"
chown ${secretType.owner}:${secretType.group} "$TMP_FILE"
# see if there's been any change from the last generation
changes=$(${pkgs.rsync}/bin/rsync --dry-run -aHAX -i "$TMP_FILE" "$_oldPath")
mv -f "$TMP_FILE" "$_truePath"
[ "$changes" != "" ] && {
echo '${lib.concatStringsSep "\n" secretType.reloadUnits}' >> /run/nixos/activation-reload-list
echo '${lib.concatStringsSep "\n" secretType.restartUnits}' >> /run/nixos/activation-restart-list
${secretType.onChange}
}
${optionalString secretType.symlink ''
[ "${secretType.path}" != "${cfg.secretsDir}/${secretType.name}" ] && ln -sfn "${cfg.secretsDir}/${secretType.name}" "${secretType.path}"
''}
@ -96,16 +108,22 @@ let
Group of the decrypted secret.
'';
};
action = mkOption {
onChange = mkOption {
type = types.str;
default = "";
description = "A script to run when secret is updated.";
};
services = mkOption {
type = types.listOf types.str;
reloadUnits = mkOption {
type = types.listOf utils.systemdUtils.lib.unitNameType;
default = [];
description = "The systemd services that uses this secret. Will be restarted when the secret changes.";
example = "[ wireguard-wg0 ]";
description = "The systemd services to reload when the secret changes.";
example = literalExpression ''[ "wireguard-wg0.service" ]'';
};
restartUnits = mkOption {
type = types.listOf utils.systemdUtils.lib.unitNameType;
default = [];
description = "The systemd services to restart when the secret changes.";
example = literalExpression ''[ "wireguard-wg0.service" ]'';
};
symlink = mkEnableOption "symlinking secrets to their destination" // { default = true; };
};
@ -183,11 +201,6 @@ in
mkdir -p "${cfg.secretsMountPoint}/$_agenix_generation"
chmod 0751 "${cfg.secretsMountPoint}/$_agenix_generation"
ln -sfn "${cfg.secretsMountPoint}/$_agenix_generation" ${cfg.secretsDir}
(( _agenix_generation > 1 )) && {
echo "[agenix] removing old secrets (generation $(( _agenix_generation - 1 )))..."
rm -rf "${cfg.secretsMountPoint}/$(( _agenix_generation - 1 ))"
}
'';
deps = [
"specialfs"
@ -216,7 +229,7 @@ in
};
# Other secrets need to wait for users and groups to exist.
system.activationScripts.agenix = {
system.activationScripts.agenixNonRoot = {
text = installNonRootSecrets;
deps = [
"users"
@ -227,38 +240,21 @@ in
];
};
systemd.services = lib.mkMerge
(lib.mapAttrsToList
(name: {action, services, file, path, mode, owner, group, ...}:
let
fileHash = builtins.hashFile "sha256" file;
restartTriggers = [ fileHash path mode owner group ];
in
lib.mkMerge [
(lib.genAttrs services (_: { inherit restartTriggers; }))
(lib.mkIf (action != "") {
"agenix-${name}-action" = {
inherit restartTriggers;
# We execute the action on reload so that it doesn't happen at
# startup. The only disadvantage is that it won't trigger the
# first time the service is created.
reload = action;
reloadIfChanged = true;
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = " "; # systemd complains if we only set ExecReload
# Give it a reason for starting
wantedBy = [ "multi-user.target" ];
};
})
]) cfg.secrets);
# named "agenix" for others to depend on the last activationScript (and thereby all the rest)
system.activationScripts.agenix = {
# cleanup old generation
text = ''
(( _agenix_generation > 1 )) && {
echo "[agenix] removing old secrets (generation $(( _agenix_generation - 1 )))..."
rm -rf "${cfg.secretsMountPoint}/$(( _agenix_generation - 1 ))"
}
'';
deps = [
"specialfs"
"agenixMountSecrets"
"agenixRoot"
"agenixNonRoot"
];
};
};
}

2
test/integration.nix
View file

@ -45,7 +45,7 @@ import "${nixpkgs}/nixos/tests/make-test-python.nix"
age.secrets.ex1 = {
file = ../example/passwordfile-user1.age;
action = "echo bar > /tmp/foo";
onChange = "echo bar > /tmp/foo";
};
};