nixops/modules/secrets.nix

   1 { lib, pkgs, config, myconfig, mylibs, ... }:
   2 {
   3   options.mySecrets = {
   4     keys = lib.mkOption {
   5       type = lib.types.listOf lib.types.unspecified;
   6       default = {};
   7       description = "Keys to upload to server";
   8     };
   9   };
  10   config = let
  11     keys = config.mySecrets.keys;
  12     empty = pkgs.runCommand "empty" { preferLocalBuild = true; } "mkdir -p $out && touch $out/done";
  13     dumpKey = v: ''
  14         mkdir -p secrets/$(dirname ${v.dest})
  15         echo -n ${lib.strings.escapeShellArg v.text} > secrets/${v.dest}
  16         cat >> mods <<EOF
  17         ${v.user or "root"} ${v.group or "root"} ${v.permissions or "0600"} secrets/${v.dest}
  18         EOF
  19         '';
  20     secrets = pkgs.runCommand "secrets.tar" {} ''
  21       touch mods
  22       tar --format=ustar --mtime='1970-01-01' -P --transform="s@${empty}@secrets@" -cf $out ${empty}/done
  23       ${builtins.concatStringsSep "\n" (map dumpKey keys)}
  24       cat mods | while read u g p k; do
  25       tar --format=ustar --mtime='1970-01-01' --owner="$u" --group="$g" --mode="$p" --append -f $out "$k"
  26       done
  27       '';
  28   in {
  29     system.activationScripts.secrets = {
  30       deps = [ "users" "wrappers" ];
  31       text = ''
  32         install -m0750 -o root -g keys -d /var/secrets
  33         if [ -f /run/keys/secrets.tar ]; then
  34           if [ ! -f /var/secrets/currentSecrets ] || ! sha512sum -c --status "/var/secrets/currentSecrets"; then
  35             echo "rebuilding secrets"
  36             rm -rf /var/secrets
  37             install -m0750 -o root -g keys -d /var/secrets
  38             ${pkgs.gnutar}/bin/tar --strip-components 1 -C /var/secrets -xf /run/keys/secrets.tar
  39             sha512sum /run/keys/secrets.tar > /var/secrets/currentSecrets
  40             find /var/secrets -type d -exec chown root:keys {} \; -exec chmod o-rx {} \;
  41           fi
  42         fi
  43         '';
  44     };
  45     deployment.keys."secrets.tar" = {
  46       permissions = "0400";
  47       # keyFile below is not evaluated at build time by nixops, so the
  48       # `secrets` path doesn’t necessarily exist when uploading the
  49       # keys, and nixops is unhappy.
  50       user = "root${builtins.substring 10000 1 secrets}";
  51       group = "root";
  52       keyFile = "${secrets}";
  53     };
  54   };
  55 }