diff options
author | Ismaël Bouya <ismael.bouya@normalesup.org> | 2018-12-13 21:25:24 +0100 |
---|---|---|
committer | Ismaël Bouya <ismael.bouya@normalesup.org> | 2019-05-24 01:40:13 +0200 |
commit | 252dd7d899b7a0deea1537cc5d2d48b825afffb0 (patch) | |
tree | f51c3c9cd7429b0b9553a840f26bee489be045bc /modules/secrets.nix | |
download | NUR-252dd7d899b7a0deea1537cc5d2d48b825afffb0.tar.gz NUR-252dd7d899b7a0deea1537cc5d2d48b825afffb0.tar.zst NUR-252dd7d899b7a0deea1537cc5d2d48b825afffb0.zip |
Initial commit published for NURnur_root
Diffstat (limited to 'modules/secrets.nix')
-rw-r--r-- | modules/secrets.nix | 61 |
1 files changed, 61 insertions, 0 deletions
diff --git a/modules/secrets.nix b/modules/secrets.nix new file mode 100644 index 00000000..b282e56e --- /dev/null +++ b/modules/secrets.nix | |||
@@ -0,0 +1,61 @@ | |||
1 | { lib, pkgs, config, ... }: | ||
2 | { | ||
3 | options.secrets = { | ||
4 | keys = lib.mkOption { | ||
5 | type = lib.types.listOf lib.types.unspecified; | ||
6 | default = []; | ||
7 | description = "Keys to upload to server"; | ||
8 | }; | ||
9 | location = lib.mkOption { | ||
10 | type = lib.types.path; | ||
11 | default = "/var/secrets"; | ||
12 | description = "Location where to put the keys"; | ||
13 | }; | ||
14 | }; | ||
15 | config = let | ||
16 | location = config.secrets.location; | ||
17 | keys = config.secrets.keys; | ||
18 | empty = pkgs.runCommand "empty" { preferLocalBuild = true; } "mkdir -p $out && touch $out/done"; | ||
19 | dumpKey = v: '' | ||
20 | mkdir -p secrets/$(dirname ${v.dest}) | ||
21 | echo -n ${lib.strings.escapeShellArg v.text} > secrets/${v.dest} | ||
22 | cat >> mods <<EOF | ||
23 | ${v.user or "root"} ${v.group or "root"} ${v.permissions or "0600"} secrets/${v.dest} | ||
24 | EOF | ||
25 | ''; | ||
26 | secrets = pkgs.runCommand "secrets.tar" {} '' | ||
27 | touch mods | ||
28 | tar --format=ustar --mtime='1970-01-01' -P --transform="s@${empty}@secrets@" -cf $out ${empty}/done | ||
29 | ${builtins.concatStringsSep "\n" (map dumpKey keys)} | ||
30 | cat mods | while read u g p k; do | ||
31 | tar --format=ustar --mtime='1970-01-01' --owner="$u" --group="$g" --mode="$p" --append -f $out "$k" | ||
32 | done | ||
33 | ''; | ||
34 | in lib.mkIf (builtins.length keys > 0) { | ||
35 | system.activationScripts.secrets = { | ||
36 | deps = [ "users" "wrappers" ]; | ||
37 | text = '' | ||
38 | install -m0750 -o root -g keys -d ${location} | ||
39 | if [ -f /run/keys/secrets.tar ]; then | ||
40 | if [ ! -f ${location}/currentSecrets ] || ! sha512sum -c --status "${location}/currentSecrets"; then | ||
41 | echo "rebuilding secrets" | ||
42 | rm -rf ${location} | ||
43 | install -m0750 -o root -g keys -d ${location} | ||
44 | ${pkgs.gnutar}/bin/tar --strip-components 1 -C ${location} -xf /run/keys/secrets.tar | ||
45 | sha512sum /run/keys/secrets.tar > ${location}/currentSecrets | ||
46 | find ${location} -type d -exec chown root:keys {} \; -exec chmod o-rx {} \; | ||
47 | fi | ||
48 | fi | ||
49 | ''; | ||
50 | }; | ||
51 | deployment.keys."secrets.tar" = { | ||
52 | permissions = "0400"; | ||
53 | # keyFile below is not evaluated at build time by nixops, so the | ||
54 | # `secrets` path doesn’t necessarily exist when uploading the | ||
55 | # keys, and nixops is unhappy. | ||
56 | user = "root${builtins.substring 10000 1 secrets}"; | ||
57 | group = "root"; | ||
58 | keyFile = "${secrets}"; | ||
59 | }; | ||
60 | }; | ||
61 | } | ||