67 lines
2.1 KiB
Nix
67 lines
2.1 KiB
Nix
|
# Adapted from https://github.com/Mic92/dotfiles/blob/23f163cae52545d44a7e379dc204010b013d679a/nixos/vms/modules/secrets.nix
|
|||
|
|
#
|
|||
|
|
# All of the users wanting to access any key under /run/keys have to be a
|
|||
|
|
# member of the keys group (or be root). This is a hard coded limitation of
|
|||
|
|
# NixOS and I haven’t found a way to allow everyone to access /run/keys/ (not a
|
|||
|
|
# security problem since the keys themselves are given the right permissions).
|
|||
|
|
{ config, lib, pkgs, ... }:
|
|||
|
|
let
|
|||
|
|
secret = lib.types.submodule ({ config, ... }: {
|
|||
|
|
options = {
|
|||
|
|
name = lib.mkOption {
|
|||
|
|
type = lib.types.str;
|
|||
|
|
default = config._module.args.name;
|
|||
|
|
};
|
|||
|
|
path = lib.mkOption {
|
|||
|
|
type = lib.types.str;
|
|||
|
|
default = "/run/keys/${config.name}";
|
|||
|
|
};
|
|||
|
|
mode = lib.mkOption {
|
|||
|
|
type = lib.types.str;
|
|||
|
|
default = "0440";
|
|||
|
|
};
|
|||
|
|
owner = lib.mkOption {
|
|||
|
|
type = lib.types.str;
|
|||
|
|
default = "root";
|
|||
|
|
};
|
|||
|
|
group = lib.mkOption {
|
|||
|
|
type = lib.types.str;
|
|||
|
|
default = "root";
|
|||
|
|
};
|
|||
|
|
source = lib.mkOption {
|
|||
|
|
type = lib.types.str;
|
|||
|
|
default = toString <secrets> + "/${config.name}";
|
|||
|
|
};
|
|||
|
|
};
|
|||
|
|
});
|
|||
|
|
in
|
|||
|
|
{
|
|||
|
|
options.krops.secrets = lib.mkOption {
|
|||
|
|
type = lib.types.attrsOf secret;
|
|||
|
|
default = { };
|
|||
|
|
};
|
|||
|
|
config = lib.mkIf (config.krops.secrets != { }) {
|
|||
|
|
system.activationScripts.setup-secrets =
|
|||
|
|
let
|
|||
|
|
script = ''
|
|||
|
|
echo "setting up secrets…"
|
|||
|
|
'' + lib.concatMapStringsSep
|
|||
|
|
"\n"
|
|||
|
|
(secret: ''
|
|||
|
|
${pkgs.coreutils}/bin/install \
|
|||
|
|
-D \
|
|||
|
|
--compare \
|
|||
|
|
--verbose \
|
|||
|
|
--mode=${lib.escapeShellArg secret.mode} \
|
|||
|
|
--owner=${lib.escapeShellArg secret.owner} \
|
|||
|
|
--group=${lib.escapeShellArg secret.group} \
|
|||
|
|
${lib.escapeShellArg secret.source} \
|
|||
|
|
${lib.escapeShellArg secret.path} \
|
|||
|
|
|| echo "failed to copy ${secret.source} to ${secret.path}"
|
|||
|
|
'')
|
|||
|
|
(lib.attrValues config.krops.secrets);
|
|||
|
|
in
|
|||
|
|
lib.stringAfter [ "users" "groups" ] "source ${pkgs.writeText "setup-secrets.sh" script}";
|
|||
|
|
};
|
|||
|
|
}
|