mynix/agenix
1
0
Fork 0
mirror of https://github.com/ryantm/agenix.git synced 2024-11-25 02:58:30 +03:00
Code Issues Projects Releases Packages Wiki Activity

give derived secrets their own option

Browse source
This commit is contained in:
Taeer Bar-Yam 2022-01-23 12:56:43 -05:00
parent 720d1daa54
commit ce24b06a96
1 changed files with 106 additions and 78 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

184
modules/age.nix
View file

@ -15,43 +15,42 @@ let
users = config.users.users; users = config.users.users;
identities = builtins.concatStringsSep " " (map (path: "-i ${path}") cfg.identityPaths); identities = builtins.concatStringsSep " " (map (path: "-i ${path}") cfg.identityPaths);
installSecret = secretType: '' installSecret = secret: ''
${if secretType.symlink then '' ${if secret.symlink then ''
_truePath="${cfg.secretsMountPoint}/$_agenix_generation/${secretType.name}" _truePath="${cfg.secretsMountPoint}/$_agenix_generation/${secret.name}"
'' else '' '' else ''
_truePath="${secretType.path}" _truePath="${secret.path}"
''} ''}
${if secretType.file != null then '' ${if secret ? file then ''
echo "decrypting '${secretType.file}' to '$_truePath'..." echo "decrypting '${secret.file}' to '$_truePath'..."
'' else '' '' else ''
echo "applying template ${secretType.template} to '$_truePath'..." echo "constructing template ${secret.template} at '$_truePath'..."
''} ''}
TMP_FILE="$_truePath.tmp" TMP_FILE="$_truePath.tmp"
mkdir -p "$(dirname "$_truePath")" mkdir -p "$(dirname "$_truePath")"
[ "${secretType.path}" != "/run/agenix/${secretType.name}" ] && mkdir -p "$(dirname "${secretType.path}")" [ "${secret.path}" != "/run/agenix/${secret.name}" ] && mkdir -p "$(dirname "${secret.path}")"
${if secret ? file then ''
${if secretType.file != null then '' (
( umask u=r,g=,o=
umask u=r,g=,o= LANG=${config.i18n.defaultLocale} ${ageBin} --decrypt ${identities} -o "$TMP_FILE" "${secret.file}"
LANG=${config.i18n.defaultLocale} ${ageBin} --decrypt ${identities} -o "$TMP_FILE" "${secretType.file}" )
)
'' else '' '' else ''
${pkgs.perl}/bin/perl -pe '${ ${pkgs.perl}/bin/perl -pe '${
lib.concatStringsSep "; " lib.concatStringsSep "; "
(map (s: (map (s:
''$match=q[@${s.name}@];'' + ''$match=q[@${s.name}@];'' +
''$replace=substr(qx[cat ${s.path}], 0, -1);'' + ''$replace=substr(qx[cat ${s.path}], 0, -1);'' +
''s/$match/$replace/ge'') secretType.secrets) ''s/$match/$replace/ge'') secret.secrets)
}' ${secretType.template} > "$TMP_FILE" }' ${secret.template} > "$TMP_FILE"
''} ''}
chmod ${secretType.mode} "$TMP_FILE" chmod ${secret.mode} "$TMP_FILE"
chown ${secretType.owner}:${secretType.group} "$TMP_FILE" chown ${secret.owner}:${secret.group} "$TMP_FILE"
mv -f "$TMP_FILE" "$_truePath" mv -f "$TMP_FILE" "$_truePath"
${optionalString secretType.symlink '' ${optionalString secret.symlink ''
[ "${secretType.path}" != "/run/agenix/${secretType.name}" ] && ln -sfn "/run/agenix/${secretType.name}" "${secretType.path}" [ "${secret.path}" != "/run/agenix/${secret.name}" ] && ln -sfn "/run/agenix/${secret.name}" "${secret.path}"
''} ''}
''; '';
@ -64,7 +63,16 @@ let
nonRootSecrets = builtins.filter isNotRootSecret (builtins.attrValues cfg.secrets); nonRootSecrets = builtins.filter isNotRootSecret (builtins.attrValues cfg.secrets);
installNonRootSecrets = builtins.concatStringsSep "\n" ([ "echo '[agenix] decrypting non-root secrets...'" ] ++ (map installSecret nonRootSecrets)); installNonRootSecrets = builtins.concatStringsSep "\n" ([ "echo '[agenix] decrypting non-root secrets...'" ] ++ (map installSecret nonRootSecrets));
secretType = types.submodule ({ config, ... }: { isRootDerivedSecret = st: isRootSecret st && builtins.all isRootSecret st.secrets;
isNotRootDerivedSecret = st: !(isRootDerivedSecret st);
rootDerivedSecrets = builtins.filter isRootDerivedSecret (builtins.attrValues cfg.derivedSecrets);
installRootDerivedSecrets = builtins.concatStringsSep "\n" ([ "echo '[agenix] constructing root derived secrets...'" ] ++ (map installSecret rootDerivedSecrets));
nonRootDerivedSecrets = builtins.filter isNotRootDerivedSecret (builtins.attrValues cfg.derivedSecrets);
installNonRootDerivedSecrets = builtins.concatStringsSep "\n" ([ "echo '[agenix] constructing non-root derived secrets...'" ] ++ (map installSecret nonRootDerivedSecrets));
baseSecretType = types.submodule ({ config, ... }: {
options = { options = {
name = mkOption { name = mkOption {
type = types.str; type = types.str;
@ -73,13 +81,6 @@ let
Name of the file used in /run/agenix Name of the file used in /run/agenix
''; '';
}; };
file = mkOption {
type = types.nullOr types.path;
default = null;
description = ''
Age file the secret is loaded from.
'';
};
path = mkOption { path = mkOption {
type = types.str; type = types.str;
default = "/run/agenix/${config.name}"; default = "/run/agenix/${config.name}";
@ -119,21 +120,42 @@ let
description = "The systemd services that uses this secret. Will be restarted when the secret changes."; description = "The systemd services that uses this secret. Will be restarted when the secret changes.";
example = "[ wireguard-wg0 ]"; example = "[ wireguard-wg0 ]";
}; };
symlink = mkEnableOption "symlinking secrets to their destination" // { default = true; };
};
});
secretType = types.submodule {
imports = baseSecretType.getSubModules;
options = {
file = mkOption {
type = types.path;
description = ''
Age file the secret is loaded from.
'';
};
};
};
derivedSecretType = types.submodule {
imports = baseSecretType.getSubModules;
options = {
template = mkOption { template = mkOption {
type = types.nullOr types.path; type = types.path;
default = null; description = ''
description = "A template to insert other secrets into."; A template to insert other secrets into.
'';
example = ''builtins.toFile "secret-template" "@secret1@ @secret2@"''; example = ''builtins.toFile "secret-template" "@secret1@ @secret2@"'';
}; };
secrets = mkOption { secrets = mkOption {
type = types.listOf secretType; type = types.listOf secretType;
default = []; default = [];
description = "A list of secrets available to the template."; description = ''
A list of secrets available to the template.
'';
example = ''with config.age.secrets; [ secret1 secret2 ]''; example = ''with config.age.secrets; [ secret1 secret2 ]'';
}; };
symlink = mkEnableOption "symlinking secrets to their destination" // { default = true; };
}; };
}); };
in in
{ {
@ -156,6 +178,13 @@ in
Attrset of secrets. Attrset of secrets.
''; '';
}; };
derivedSecrets = mkOption {
type = types.attrsOf derivedSecretType;
default = { };
description = ''
Attrset of secrets derived from a template applied to secrets from `age.secrets`.
'';
};
secretsMountPoint = mkOption { secretsMountPoint = mkOption {
type = types.addCheck types.str type = types.addCheck types.str
(s: (s:
@ -183,13 +212,7 @@ in
assertions = [{ assertions = [{
assertion = cfg.identityPaths != [ ]; assertion = cfg.identityPaths != [ ];
message = "age.identityPaths must be set."; message = "age.identityPaths must be set.";
}] ++ lib.mapAttrsToList (name: {template, file, ...}: { }];
assertion = (template == null && file != null) ||
(template != null && file == null);
message = ''
You must specify either `file` or `template` for age.secrets.${name}, but not both.
'';
}) cfg.secrets;
# Create a new directory full of secrets for symlinking (this helps # Create a new directory full of secrets for symlinking (this helps
# ensure removed secrets are actually removed, or at least become # ensure removed secrets are actually removed, or at least become
@ -219,7 +242,7 @@ in
# Secrets with root owner and group can be installed before users # Secrets with root owner and group can be installed before users
# exist. This allows user password files to be encrypted. # exist. This allows user password files to be encrypted.
system.activationScripts.agenixRoot = { system.activationScripts.agenixRoot = {
text = installRootOwnedSecrets; text = installRootOwnedSecrets + "\n" + installRootDerivedSecrets;
deps = [ "agenixMountSecrets" "specialfs" ]; deps = [ "agenixMountSecrets" "specialfs" ];
}; };
system.activationScripts.users.deps = [ "agenixRoot" ]; system.activationScripts.users.deps = [ "agenixRoot" ];
@ -239,7 +262,7 @@ in
# Other secrets need to wait for users and groups to exist. # Other secrets need to wait for users and groups to exist.
system.activationScripts.agenix = { system.activationScripts.agenix = {
text = installNonRootSecrets; text = installNonRootSecrets + "\n" + installNonRootDerivedSecrets;
deps = [ deps = [
"users" "users"
"groups" "groups"
@ -249,39 +272,44 @@ in
]; ];
}; };
systemd.services = lib.mkMerge systemd.services =
(lib.mapAttrsToList let
(name: {action, services, file, template, secrets, path, mode, owner, group, ...}: hashFile = builtins.hashFile "sha256";
let secretServices = { name, action, services, restartTriggers }:
hashedFiles = map (builtins.hashFile "sha256") lib.mkMerge [
([ file ] ++ (map ({ file, ... }: file) secrets)); (genAttrs services (_: { inherit restartTriggers; }))
restartTriggers = hashedFiles ++ [ template path mode owner group ]; (mkIf (action != "") {
in "agenix-${name}-action" = {
lib.mkMerge [ inherit restartTriggers;
(lib.genAttrs services (_: { inherit restartTriggers; }))
(lib.mkIf (action != "") {
"agenix-${name}-action" = {
inherit restartTriggers;
# We execute the action on reload so that it doesn't happen at # We execute the action on reload so that it doesn't happen at
# startup. The only disadvantage is that it won't trigger the # startup. The only disadvantage is that it won't trigger the
# first time the service is created. # first time the service is created.
reload = action; reload = action;
reloadIfChanged = true; reloadIfChanged = true;
serviceConfig = { serviceConfig = {
Type = "oneshot"; Type = "oneshot";
RemainAfterExit = true; RemainAfterExit = true;
};
script = " "; # systemd complains if we only set ExecReload
# Give it a reason for starting
wantedBy = [ "multi-user.target" ];
}; };
}) script = " "; # systemd complains if we only set ExecReload
]) cfg.secrets);
};
# Give it a reason for starting
wantedBy = [ "multi-user.target" ];
};
})
];
in
lib.mkMerge (map secretServices
((mapAttrsToList (name: { file, action, services, path, mode, owner, group, ... }: {
inherit action services name;
restartTriggers = [ (hashFile file) path mode owner group ];
}) cfg.secrets)
++
(mapAttrsToList (name: { secrets, template, action, services, path, mode, owner, group, ... }: {
inherit action services name;
restartTriggers = map ({ file, ... }: hashFile file) secrets ++ [ template path mode owner group ];
}) cfg.derivedSecrets)));
};
} }