diff options
Diffstat (limited to 'modules/secrets.nix')
-rw-r--r-- | modules/secrets.nix | 83 |
1 files changed, 54 insertions, 29 deletions
diff --git a/modules/secrets.nix b/modules/secrets.nix index ecc1ebc..86d276a 100644 --- a/modules/secrets.nix +++ b/modules/secrets.nix | |||
@@ -6,11 +6,36 @@ | |||
6 | default = []; | 6 | default = []; |
7 | description = "Keys to upload to server"; | 7 | description = "Keys to upload to server"; |
8 | }; | 8 | }; |
9 | gpgKeys = lib.mkOption { | ||
10 | type = lib.types.listOf lib.types.path; | ||
11 | default = []; | ||
12 | description = "GPG public keys files to encrypt to"; | ||
13 | }; | ||
14 | ageKeys = lib.mkOption { | ||
15 | type = lib.types.listOf lib.types.str; | ||
16 | default = []; | ||
17 | description = "AGE keys to encrypt to"; | ||
18 | }; | ||
19 | decryptKey = lib.mkOption { | ||
20 | type = lib.types.str; | ||
21 | default = "/etc/ssh/ssh_host_ed25519_key"; | ||
22 | description = "ed25519 key used to decrypt with AGE"; | ||
23 | }; | ||
9 | location = lib.mkOption { | 24 | location = lib.mkOption { |
10 | type = lib.types.path; | 25 | type = lib.types.path; |
11 | default = "/var/secrets"; | 26 | default = "/var/secrets"; |
12 | description = "Location where to put the keys"; | 27 | description = "Location where to put the keys"; |
13 | }; | 28 | }; |
29 | secretsVars = lib.mkOption { | ||
30 | type = lib.types.path; | ||
31 | default = "/run/keys/vars.yml"; | ||
32 | description = "Location where the secrets variables are defined, to be used to fill the templates in secrets"; | ||
33 | }; | ||
34 | deleteSecretsVars = lib.mkOption { | ||
35 | type = lib.types.bool; | ||
36 | default = false; | ||
37 | description = "Delete secrets file after deployment"; | ||
38 | }; | ||
14 | # Read-only variables | 39 | # Read-only variables |
15 | fullPaths = lib.mkOption { | 40 | fullPaths = lib.mkOption { |
16 | type = lib.types.attrsOf lib.types.path; | 41 | type = lib.types.attrsOf lib.types.path; |
@@ -33,56 +58,56 @@ | |||
33 | ${v.user or "root"} ${v.group or "root"} ${v.permissions or "0600"} ${fpath v} | 58 | ${v.user or "root"} ${v.group or "root"} ${v.permissions or "0600"} ${fpath v} |
34 | EOF | 59 | EOF |
35 | ''; | 60 | ''; |
36 | secrets = pkgs.runCommand "secrets.tar" {} '' | 61 | secrets = pkgs.runCommand "secrets.tar.enc" { |
62 | buildInputs = [ pkgs.gnupg pkgs.sops ]; | ||
63 | } '' | ||
37 | touch mods | 64 | touch mods |
38 | tar --format=ustar --mtime='1970-01-01' -P --transform="s@${empty}@secrets@" -cf $out ${empty}/done | 65 | tar --format=ustar --mtime='1970-01-01' -P --transform="s@${empty}@secrets@" -cf $out ${empty}/done |
39 | ${builtins.concatStringsSep "\n" (map dumpKey keys)} | 66 | ${builtins.concatStringsSep "\n" (map dumpKey keys)} |
40 | cat mods | while read u g p k; do | 67 | cat mods | while read u g p k; do |
41 | tar --format=ustar --mtime='1970-01-01' --owner="$u" --group="$g" --mode="$p" --append -f $out "$k" | 68 | tar --format=ustar --mtime='1970-01-01' --owner="$u" --group="$g" --mode="$p" --append -f $out "$k" |
42 | done | 69 | done |
70 | export HOME=$(pwd) | ||
71 | fingerprints= | ||
72 | for key in ${builtins.concatStringsSep " " config.secrets.gpgKeys}; do | ||
73 | gpg --import $key 2>/dev/null | ||
74 | fingerprints=$fingerprints,$(cat $key | gpg --with-colons --import-options show-only --import 2>/dev/null | grep ^fpr | cut -d: -f10 | head -n1) | ||
75 | done | ||
76 | |||
77 | sops --age ${builtins.concatStringsSep "," config.secrets.ageKeys} --pgp ''${fingerprints#,} --input-type binary -i -e $out 2>/dev/null | ||
43 | ''; | 78 | ''; |
44 | in lib.mkIf (builtins.length keys > 0) { | 79 | in lib.mkIf (builtins.length keys > 0) { |
45 | system.activationScripts.secrets = { | 80 | system.activationScripts.secrets = { |
46 | deps = [ "users" "wrappers" ]; | 81 | deps = [ "users" "wrappers" ]; |
47 | text = '' | 82 | text = '' |
48 | install -m0750 -o root -g keys -d ${location} | 83 | install -m0750 -o root -g keys -d ${location} |
49 | if [ -f /run/keys/secrets.tar ]; then | 84 | TMP=$(${pkgs.coreutils}/bin/mktemp -d) |
50 | if [ ! -f ${location}/currentSecrets ] || ! sha512sum -c --status "${location}/currentSecrets"; then | 85 | TMPWORK=$(${pkgs.coreutils}/bin/mktemp -d) |
51 | echo "rebuilding secrets" | 86 | chmod go-rwx $TMPWORK |
52 | TMP=$(${pkgs.coreutils}/bin/mktemp -d) | 87 | if [ -n "$TMP" -a -n "$TMPWORK" ]; then |
53 | if [ -n "$TMP" ]; then | 88 | install -m0750 -o root -g keys -d $TMP |
54 | install -m0750 -o root -g keys -d $TMP | 89 | ${pkgs.ssh-to-age}/bin/ssh-to-age -private-key -i ${config.secrets.decryptKey} -o $TMPWORK/keys.txt |
55 | ${pkgs.gnutar}/bin/tar --strip-components 1 -C $TMP -xf /run/keys/secrets.tar | 90 | SOPS_AGE_KEY_FILE=$TMPWORK/keys.txt ${pkgs.sops}/bin/sops -d ${secrets} | ${pkgs.gnutar}/bin/tar --strip-components 1 -C $TMP -x |
56 | if [ -f /run/keys/vars.yml ]; then | 91 | if [ -f ${config.secrets.secretsVars} ]; then |
57 | find $TMP -name "*.gucci.tpl" -exec \ | 92 | SOPS_AGE_KEY_FILE=$TMPWORK/keys.txt ${pkgs.sops}/bin/sops -d ${config.secrets.secretsVars} > $TMPWORK/vars.yml |
58 | /bin/sh -c 'f="{}"; ${pkgs.gucci}/bin/gucci -f /run/keys/vars.yml "$f" > "''${f%.gucci.tpl}"; touch --reference "$f" ''${f%.gucci.tpl} ; chmod --reference="$f" ''${f%.gucci.tpl} ; chown --reference="$f" ''${f%.gucci.tpl}' \; | ||
59 | sha512sum /run/keys/secrets.tar /run/keys/vars.yml > $TMP/currentSecrets | ||
60 | else | ||
61 | sha512sum /run/keys/secrets.tar > $TMP/currentSecrets | ||
62 | fi | ||
63 | find $TMP -type d -exec chown root:keys {} \; -exec chmod o-rx {} \; | ||
64 | ${pkgs.rsync}/bin/rsync --exclude="*.gucci.tpl" -O -c -av --delete $TMP/ ${location} | ||
65 | rm -rf $TMP | ||
66 | fi | ||
67 | fi | 93 | fi |
94 | if [ -f $TMPWORK/vars.yml ]; then | ||
95 | find $TMP -name "*.gucci.tpl" -exec \ | ||
96 | /bin/sh -c 'f="{}"; ${pkgs.gucci}/bin/gucci -f '$TMPWORK'/vars.yml "$f" > "''${f%.gucci.tpl}"; touch --reference "$f" ''${f%.gucci.tpl} ; chmod --reference="$f" ''${f%.gucci.tpl} ; chown --reference="$f" ''${f%.gucci.tpl}' \; | ||
97 | fi | ||
98 | find $TMP -type d -exec chown root:keys {} \; -exec chmod o-rx {} \; | ||
99 | ${pkgs.rsync}/bin/rsync --exclude="*.gucci.tpl" -O -c -av --delete $TMP/ ${location} | ||
100 | rm -rf $TMP $TMPWORK ${lib.optionalString config.secrets.deleteSecretsVars config.secrets.secretsVars} | ||
68 | fi | 101 | fi |
69 | ''; | 102 | ''; |
70 | }; | 103 | }; |
71 | 104 | ||
72 | system.extraDependencies = [ secrets ]; | ||
73 | deployment.secrets."secret_vars.yml" = { | 105 | deployment.secrets."secret_vars.yml" = { |
74 | source = builtins.toString <privateFiles/vars.yml>; | 106 | source = builtins.toString ../nixops/secrets/vars.yml; |
75 | destination = "/run/keys/vars.yml"; | 107 | destination = config.secrets.secretsVars; |
76 | owner.user = "root"; | 108 | owner.user = "root"; |
77 | owner.group = "root"; | 109 | owner.group = "root"; |
78 | permissions = "0400"; | 110 | permissions = "0400"; |
79 | }; | 111 | }; |
80 | deployment.secrets."secrets.tar" = { | ||
81 | source = "${secrets}"; | ||
82 | destination = "/run/keys/secrets.tar"; | ||
83 | owner.user = "root"; | ||
84 | owner.group = "root"; | ||
85 | permissions = "0400"; | ||
86 | }; | ||
87 | }; | 112 | }; |
88 | } | 113 | } |