modules/secrets.nix

   1 { lib, pkgs, config, ... }:
   2 {
   3   options.secrets = {
   4     keys = lib.mkOption {
   5       type = lib.types.listOf lib.types.unspecified;
   6       default = [];
   7       description = "Keys to upload to server";
   8     };
   9     location = lib.mkOption {
  10       type = lib.types.path;
  11       default = "/var/secrets";
  12       description = "Location where to put the keys";
  13     };
  14     # Read-only variables
  15     fullPaths = lib.mkOption {
  16       type = lib.types.attrsOf lib.types.path;
  17       default = builtins.listToAttrs
  18         (map (v: { name = v.dest; value = "${config.secrets.location}/${v.dest}"; }) config.secrets.keys);
  19       readOnly = true;
  20       description = "set of full paths to secrets";
  21     };
  22   };
  23
  24   config = let
  25     location = config.secrets.location;
  26     keys = config.secrets.keys;
  27     empty = pkgs.runCommand "empty" { preferLocalBuild = true; } "mkdir -p $out && touch $out/done";
  28     fpath = v: "secrets/${v.dest}${lib.optionalString (v.isTemplated or true) ".gucci.tpl"}";
  29     dumpKey = v: ''
  30         mkdir -p secrets/$(dirname ${v.dest})
  31         echo -n ${lib.strings.escapeShellArg v.text} > ${fpath v}
  32         cat >> mods <<EOF
  33         ${v.user or "root"} ${v.group or "root"} ${v.permissions or "0600"} ${fpath v}
  34         EOF
  35         '';
  36     secrets = pkgs.runCommand "secrets.tar" {} ''
  37       touch mods
  38       tar --format=ustar --mtime='1970-01-01' -P --transform="s@${empty}@secrets@" -cf $out ${empty}/done
  39       ${builtins.concatStringsSep "\n" (map dumpKey keys)}
  40       cat mods | while read u g p k; do
  41       tar --format=ustar --mtime='1970-01-01' --owner="$u" --group="$g" --mode="$p" --append -f $out "$k"
  42       done
  43       '';
  44   in lib.mkIf (builtins.length keys > 0) {
  45     system.activationScripts.secrets = {
  46       deps = [ "users" "wrappers" ];
  47       text = ''
  48         install -m0750 -o root -g keys -d ${location}
  49         if [ -f /run/keys/secrets.tar ]; then
  50           if [ ! -f ${location}/currentSecrets ] || ! sha512sum -c --status "${location}/currentSecrets"; then
  51             echo "rebuilding secrets"
  52             TMP=$(${pkgs.coreutils}/bin/mktemp -d)
  53             if [ -n "$TMP" ]; then
  54               install -m0750 -o root -g keys -d $TMP
  55               ${pkgs.gnutar}/bin/tar --strip-components 1 -C $TMP -xf /run/keys/secrets.tar
  56               if [ -f /run/keys/vars.yml ]; then
  57                 find $TMP -name "*.gucci.tpl" -exec \
  58                   /bin/sh -c 'f="{}"; ${pkgs.gucci}/bin/gucci -f /run/keys/vars.yml "$f" > "''${f%.gucci.tpl}"; touch --reference "$f" ''${f%.gucci.tpl} ; chmod --reference="$f" ''${f%.gucci.tpl} ; chown --reference="$f" ''${f%.gucci.tpl}' \;
  59                 sha512sum /run/keys/secrets.tar /run/keys/vars.yml > $TMP/currentSecrets
  60               else
  61                 sha512sum /run/keys/secrets.tar > $TMP/currentSecrets
  62               fi
  63               find $TMP -type d -exec chown root:keys {} \; -exec chmod o-rx {} \;
  64               ${pkgs.rsync}/bin/rsync --exclude="*.gucci.tpl" -O -c -av --delete $TMP/ ${location}
  65               rm -rf $TMP
  66             fi
  67           fi
  68         fi
  69         '';
  70     };
  71
  72     system.extraDependencies = [ secrets ];
  73     deployment.secrets."secret_vars.yml" = {
  74       source = builtins.toString <privateFiles/vars.yml>;
  75       destination = "/run/keys/vars.yml";
  76       owner.user = "root";
  77       owner.group = "root";
  78       permissions = "0400";
  79      };
  80     deployment.secrets."secrets.tar" = {
  81       source = "${secrets}";
  82       destination = "/run/keys/secrets.tar";
  83       owner.user = "root";
  84       owner.group = "root";
  85       permissions = "0400";
  86     };
  87   };
  88 }