diff options
Diffstat (limited to 'modules/secrets.nix')
-rw-r--r-- | modules/secrets.nix | 113 |
1 files changed, 0 insertions, 113 deletions
diff --git a/modules/secrets.nix b/modules/secrets.nix deleted file mode 100644 index 86d276a..0000000 --- a/modules/secrets.nix +++ /dev/null | |||
@@ -1,113 +0,0 @@ | |||
1 | { lib, pkgs, config, ... }: | ||
2 | { | ||
3 | options.secrets = { | ||
4 | keys = lib.mkOption { | ||
5 | type = lib.types.listOf lib.types.unspecified; | ||
6 | default = []; | ||
7 | description = "Keys to upload to server"; | ||
8 | }; | ||
9 | gpgKeys = lib.mkOption { | ||
10 | type = lib.types.listOf lib.types.path; | ||
11 | default = []; | ||
12 | description = "GPG public keys files to encrypt to"; | ||
13 | }; | ||
14 | ageKeys = lib.mkOption { | ||
15 | type = lib.types.listOf lib.types.str; | ||
16 | default = []; | ||
17 | description = "AGE keys to encrypt to"; | ||
18 | }; | ||
19 | decryptKey = lib.mkOption { | ||
20 | type = lib.types.str; | ||
21 | default = "/etc/ssh/ssh_host_ed25519_key"; | ||
22 | description = "ed25519 key used to decrypt with AGE"; | ||
23 | }; | ||
24 | location = lib.mkOption { | ||
25 | type = lib.types.path; | ||
26 | default = "/var/secrets"; | ||
27 | description = "Location where to put the keys"; | ||
28 | }; | ||
29 | secretsVars = lib.mkOption { | ||
30 | type = lib.types.path; | ||
31 | default = "/run/keys/vars.yml"; | ||
32 | description = "Location where the secrets variables are defined, to be used to fill the templates in secrets"; | ||
33 | }; | ||
34 | deleteSecretsVars = lib.mkOption { | ||
35 | type = lib.types.bool; | ||
36 | default = false; | ||
37 | description = "Delete secrets file after deployment"; | ||
38 | }; | ||
39 | # Read-only variables | ||
40 | fullPaths = lib.mkOption { | ||
41 | type = lib.types.attrsOf lib.types.path; | ||
42 | default = builtins.listToAttrs | ||
43 | (map (v: { name = v.dest; value = "${config.secrets.location}/${v.dest}"; }) config.secrets.keys); | ||
44 | readOnly = true; | ||
45 | description = "set of full paths to secrets"; | ||
46 | }; | ||
47 | }; | ||
48 | |||
49 | config = let | ||
50 | location = config.secrets.location; | ||
51 | keys = config.secrets.keys; | ||
52 | empty = pkgs.runCommand "empty" { preferLocalBuild = true; } "mkdir -p $out && touch $out/done"; | ||
53 | fpath = v: "secrets/${v.dest}${lib.optionalString (v.isTemplated or true) ".gucci.tpl"}"; | ||
54 | dumpKey = v: '' | ||
55 | mkdir -p secrets/$(dirname ${v.dest}) | ||
56 | echo -n ${lib.strings.escapeShellArg v.text} > ${fpath v} | ||
57 | cat >> mods <<EOF | ||
58 | ${v.user or "root"} ${v.group or "root"} ${v.permissions or "0600"} ${fpath v} | ||
59 | EOF | ||
60 | ''; | ||
61 | secrets = pkgs.runCommand "secrets.tar.enc" { | ||
62 | buildInputs = [ pkgs.gnupg pkgs.sops ]; | ||
63 | } '' | ||
64 | touch mods | ||
65 | tar --format=ustar --mtime='1970-01-01' -P --transform="s@${empty}@secrets@" -cf $out ${empty}/done | ||
66 | ${builtins.concatStringsSep "\n" (map dumpKey keys)} | ||
67 | cat mods | while read u g p k; do | ||
68 | tar --format=ustar --mtime='1970-01-01' --owner="$u" --group="$g" --mode="$p" --append -f $out "$k" | ||
69 | done | ||
70 | export HOME=$(pwd) | ||
71 | fingerprints= | ||
72 | for key in ${builtins.concatStringsSep " " config.secrets.gpgKeys}; do | ||
73 | gpg --import $key 2>/dev/null | ||
74 | fingerprints=$fingerprints,$(cat $key | gpg --with-colons --import-options show-only --import 2>/dev/null | grep ^fpr | cut -d: -f10 | head -n1) | ||
75 | done | ||
76 | |||
77 | sops --age ${builtins.concatStringsSep "," config.secrets.ageKeys} --pgp ''${fingerprints#,} --input-type binary -i -e $out 2>/dev/null | ||
78 | ''; | ||
79 | in lib.mkIf (builtins.length keys > 0) { | ||
80 | system.activationScripts.secrets = { | ||
81 | deps = [ "users" "wrappers" ]; | ||
82 | text = '' | ||
83 | install -m0750 -o root -g keys -d ${location} | ||
84 | TMP=$(${pkgs.coreutils}/bin/mktemp -d) | ||
85 | TMPWORK=$(${pkgs.coreutils}/bin/mktemp -d) | ||
86 | chmod go-rwx $TMPWORK | ||
87 | if [ -n "$TMP" -a -n "$TMPWORK" ]; then | ||
88 | install -m0750 -o root -g keys -d $TMP | ||
89 | ${pkgs.ssh-to-age}/bin/ssh-to-age -private-key -i ${config.secrets.decryptKey} -o $TMPWORK/keys.txt | ||
90 | SOPS_AGE_KEY_FILE=$TMPWORK/keys.txt ${pkgs.sops}/bin/sops -d ${secrets} | ${pkgs.gnutar}/bin/tar --strip-components 1 -C $TMP -x | ||
91 | if [ -f ${config.secrets.secretsVars} ]; then | ||
92 | SOPS_AGE_KEY_FILE=$TMPWORK/keys.txt ${pkgs.sops}/bin/sops -d ${config.secrets.secretsVars} > $TMPWORK/vars.yml | ||
93 | fi | ||
94 | if [ -f $TMPWORK/vars.yml ]; then | ||
95 | find $TMP -name "*.gucci.tpl" -exec \ | ||
96 | /bin/sh -c 'f="{}"; ${pkgs.gucci}/bin/gucci -f '$TMPWORK'/vars.yml "$f" > "''${f%.gucci.tpl}"; touch --reference "$f" ''${f%.gucci.tpl} ; chmod --reference="$f" ''${f%.gucci.tpl} ; chown --reference="$f" ''${f%.gucci.tpl}' \; | ||
97 | fi | ||
98 | find $TMP -type d -exec chown root:keys {} \; -exec chmod o-rx {} \; | ||
99 | ${pkgs.rsync}/bin/rsync --exclude="*.gucci.tpl" -O -c -av --delete $TMP/ ${location} | ||
100 | rm -rf $TMP $TMPWORK ${lib.optionalString config.secrets.deleteSecretsVars config.secrets.secretsVars} | ||
101 | fi | ||
102 | ''; | ||
103 | }; | ||
104 | |||
105 | deployment.secrets."secret_vars.yml" = { | ||
106 | source = builtins.toString ../nixops/secrets/vars.yml; | ||
107 | destination = config.secrets.secretsVars; | ||
108 | owner.user = "root"; | ||
109 | owner.group = "root"; | ||
110 | permissions = "0400"; | ||
111 | }; | ||
112 | }; | ||
113 | } | ||