summaryrefslogtreecommitdiff
path: root/modules
diff options
context:
space:
mode:
Diffstat (limited to 'modules')
-rw-r--r--modules/localsecrets/default.nix96
1 files changed, 96 insertions, 0 deletions
diff --git a/modules/localsecrets/default.nix b/modules/localsecrets/default.nix
new file mode 100644
index 0000000..6665216
--- /dev/null
+++ b/modules/localsecrets/default.nix
@@ -0,0 +1,96 @@
+{ config, pkgs, lib, ... }:
+let
+ types = lib.types;
+ cfg = config.localsecrets;
+
+ keyOpts = {name, ...}: {
+ options = {
+ generator = lib.mkOption {
+ type = types.either types.str types.path;
+ default = "";
+ };
+
+ privateDir = lib.mkOption {
+ type = types.str;
+ default = "/var/lib/${cfg.stateDir}/private/${name}";
+ };
+
+ publicDir = lib.mkOption {
+ type = types.str;
+ default = "/var/lib/${cfg.stateDir}/public/${name}";
+ };
+
+ mode = lib.mkOption {
+ type = types.str;
+ default = "0700";
+ };
+
+ user = lib.mkOption {
+ type = types.str;
+ default = "root";
+ };
+
+ group = lib.mkOption {
+ type = types.str;
+ default = "root";
+ };
+ };
+ };
+in
+{
+ options = {
+ localsecrets = {
+ enable = lib.mkEnableOption "Deploy localsecrets";
+
+ stateDir = lib.mkOption {
+ type = types.str;
+ default = "localsecrets";
+ };
+
+ secrets = lib.mkOption {
+ type = types.attrsOf (types.submodule keyOpts);
+ default = [];
+ };
+ };
+ };
+
+ config = lib.mkIf cfg.enable {
+ systemd.services.localsecrets-generate = {
+ description = "Generate local secrets";
+ wantedBy = [ "multi-user.target" ];
+ after = [ "network.target" ];
+
+ serviceConfig = {
+ StateDirectory = cfg.stateDir;
+ };
+
+ script = ''
+ umask 0022
+ mkdir -p $STATE_DIRECTORY/private
+ mkdir -p $STATE_DIRECTORY/public
+ '' + (lib.concatStringsSep "\n" (lib.mapAttrsToList
+ (name: secret:
+ let
+ runtimeDirectory="secret-${name}";
+ in ''
+ systemd-run \
+ --wait \
+ -p DynamicUser=true \
+ -p RuntimeDirectory=${runtimeDirectory} \
+ -p RuntimeDirectoryMode=${secret.mode} \
+ -p RuntimeDirectoryPreserve=true \
+ -p WorkingDirectory=/run/${runtimeDirectory} \
+ -p PrivateTmp=true \
+ ${pkgs.bash}/bin/bash -c '${secret.generator}'
+
+ rm -rf "${secret.privateDir}" || true
+ chown "${secret.user}:${secret.group}" "/run/${runtimeDirectory}/private"
+ chmod "${secret.mode}" "/run/${runtimeDirectory}/private"
+ mv "/run/${runtimeDirectory}/private" "${secret.privateDir}"
+
+ rm -rf "${secret.publicDir}" || true
+ mv "/run/${runtimeDirectory}/public" "${secret.publicDir}"
+ '') cfg.secrets));
+ };
+ };
+}