aboutsummaryrefslogtreecommitdiff
path: root/nixops/modules
diff options
context:
space:
mode:
authorIsmaël Bouya <ismael.bouya@normalesup.org>2019-04-25 01:35:25 +0200
committerIsmaël Bouya <ismael.bouya@normalesup.org>2019-04-25 01:35:25 +0200
commit44742a43dac86a79274486a9b73a349c5d4ec631 (patch)
treecbf25fc3b135c7d7977c1e3eacc64d84446bc570 /nixops/modules
parent78e25e2ac542eceb33aa0d292397d5236dbb9df8 (diff)
downloadNix-44742a43dac86a79274486a9b73a349c5d4ec631.tar.gz
Nix-44742a43dac86a79274486a9b73a349c5d4ec631.tar.zst
Nix-44742a43dac86a79274486a9b73a349c5d4ec631.zip
Start building a secrets.tar to reduce upload time for nixops
Diffstat (limited to 'nixops/modules')
-rw-r--r--nixops/modules/secrets/default.nix68
1 files changed, 68 insertions, 0 deletions
diff --git a/nixops/modules/secrets/default.nix b/nixops/modules/secrets/default.nix
new file mode 100644
index 0000000..7096e48
--- /dev/null
+++ b/nixops/modules/secrets/default.nix
@@ -0,0 +1,68 @@
1{ lib, pkgs, config, myconfig, mylibs, ... }:
2{
3 options.mySecrets = {
4 keys = lib.mkOption {
5 type = lib.types.listOf lib.types.unspecified;
6 default = {};
7 description = "Keys to upload to server";
8 };
9 };
10 config = let
11 oldkeys = lib.attrsets.filterAttrs (n: v: n != "secrets.tar") config.deployment.keys;
12 keys = config.mySecrets.keys;
13 empty = pkgs.runCommand "empty" { preferLocalBuild = true; } "mkdir -p $out && touch $out/done";
14 dumpOldKey = k: v: let
15 dest = if v.destDir == "/run/keys"
16 then k
17 else (builtins.replaceStrings ["/run/keys/"] [""] v.destDir) + "/" + k;
18 in ''
19 mkdir -p secrets/$(dirname ${dest})
20 echo -n ${lib.strings.escapeShellArg v.text} > secrets/${dest}
21 cat >> mods <<EOF
22 ${v.user or "root"} ${v.group or "root"} ${v.permissions or "0600"} secrets/${dest}
23 EOF
24 '';
25 dumpKey = v: ''
26 mkdir -p secrets/$(dirname ${v.dest})
27 echo -n ${lib.strings.escapeShellArg v.text} > secrets/${v.dest}
28 cat >> mods <<EOF
29 ${v.user or "root"} ${v.group or "root"} ${v.permissions or "0600"} secrets/${v.dest}
30 EOF
31 '';
32 secrets = pkgs.runCommand "secrets.tar" {} ''
33 touch mods
34 tar --format=ustar --mtime='1970-01-01' -P --transform="s@${empty}@secrets@" -cf $out ${empty}/done
35 ${builtins.concatStringsSep "\n" (lib.attrsets.mapAttrsToList dumpOldKey oldkeys)}
36 ${builtins.concatStringsSep "\n" (map dumpKey keys)}
37 cat mods | while read u g p k; do
38 tar --format=ustar --mtime='1970-01-01' --owner="$u" --group="$g" --mode="$p" --append -f $out "$k"
39 done
40 '';
41 in {
42 system.activationScripts.secrets = {
43 deps = [ "users" "wrappers" ];
44 text = ''
45 install -m0750 -o root -g keys -d /var/secrets
46 if [ -f /run/keys/secrets.tar ]; then
47 if [ ! -f /var/secrets/currentSecrets ] || ! sha512sum -c --status "/var/secrets/currentSecrets"; then
48 echo "rebuilding secrets"
49 rm -rf /var/secrets
50 install -m0750 -o root -g keys -d /var/secrets
51 ${pkgs.gnutar}/bin/tar --strip-components 1 -C /var/secrets -xf /run/keys/secrets.tar
52 sha512sum /run/keys/secrets.tar > /var/secrets/currentSecrets
53 find /var/secrets -type d -exec chown root:keys {} \; -exec chmod o-rx {} \;
54 fi
55 fi
56 '';
57 };
58 deployment.keys."secrets.tar" = {
59 permissions = "0400";
60 # keyFile below is not evaluated at build time by nixops, so the
61 # `secrets` path doesn’t necessarily exist when uploading the
62 # keys, and nixops is unhappy.
63 user = "root${builtins.substring 10000 1 secrets}";
64 group = "root";
65 keyFile = "${secrets}";
66 };
67 };
68}