2023-09-29 16:30:11 +00:00
|
|
|
{ config, lib, ... }:
|
2023-08-28 09:09:05 +00:00
|
|
|
{
|
2023-09-06 14:08:36 +00:00
|
|
|
options.clanCore.secretStore = lib.mkOption {
|
|
|
|
type = lib.types.enum [ "sops" "password-store" "custom" ];
|
|
|
|
default = "sops";
|
|
|
|
description = ''
|
|
|
|
method to store secrets
|
2023-09-14 12:15:51 +00:00
|
|
|
custom can be used to define a custom secret store.
|
|
|
|
one would have to define system.clan.generateSecrets and system.clan.uploadSecrets
|
2023-09-06 14:08:36 +00:00
|
|
|
'';
|
|
|
|
};
|
2023-09-26 15:31:45 +00:00
|
|
|
|
|
|
|
options.clanCore.secretsDirectory = lib.mkOption {
|
|
|
|
type = lib.types.path;
|
|
|
|
description = ''
|
|
|
|
The directory where secrets are installed to. This is backend specific.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
2023-09-29 16:30:11 +00:00
|
|
|
options.clanCore.secretsUploadDirectory = lib.mkOption {
|
2023-11-10 10:42:44 +00:00
|
|
|
type = lib.types.nullOr lib.types.path;
|
|
|
|
default = null;
|
2023-09-29 16:30:11 +00:00
|
|
|
description = ''
|
|
|
|
The directory where secrets are uploaded into, This is backend specific.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
2023-09-26 15:31:45 +00:00
|
|
|
options.clanCore.secretsPrefix = lib.mkOption {
|
|
|
|
type = lib.types.str;
|
|
|
|
default = "";
|
|
|
|
description = ''
|
|
|
|
Prefix for secrets. This is backend specific.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
2023-08-30 13:24:33 +00:00
|
|
|
options.clanCore.secrets = lib.mkOption {
|
2023-09-13 21:16:56 +00:00
|
|
|
default = { };
|
2023-08-28 09:09:05 +00:00
|
|
|
type = lib.types.attrsOf
|
|
|
|
(lib.types.submodule (secret: {
|
|
|
|
options = {
|
|
|
|
name = lib.mkOption {
|
|
|
|
type = lib.types.str;
|
|
|
|
default = secret.config._module.args.name;
|
|
|
|
description = ''
|
2023-09-19 19:48:39 +00:00
|
|
|
Namespace of the secret
|
2023-08-28 09:09:05 +00:00
|
|
|
'';
|
|
|
|
};
|
|
|
|
generator = lib.mkOption {
|
2023-11-30 12:01:38 +00:00
|
|
|
type = lib.types.submodule ({ config, ... }: {
|
|
|
|
options = {
|
|
|
|
path = lib.mkOption {
|
|
|
|
type = lib.types.listOf (lib.types.either lib.types.path lib.types.package);
|
|
|
|
default = [ ];
|
|
|
|
description = ''
|
|
|
|
Extra paths to add to the PATH environment variable when running the generator.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
script = lib.mkOption {
|
|
|
|
type = lib.types.str;
|
|
|
|
description = ''
|
|
|
|
Script to generate the secret.
|
|
|
|
The script will be called with the following variables:
|
|
|
|
- facts: path to a directory where facts can be stored
|
|
|
|
- secrets: path to a directory where secrets can be stored
|
|
|
|
The script is expected to generate all secrets and facts defined in the module.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
finalScript = lib.mkOption {
|
|
|
|
type = lib.types.str;
|
|
|
|
readOnly = true;
|
|
|
|
internal = true;
|
|
|
|
default = ''
|
|
|
|
export PATH="${lib.makeBinPath config.path}"
|
|
|
|
${config.script}
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
};
|
|
|
|
});
|
2023-08-28 09:09:05 +00:00
|
|
|
};
|
2023-09-26 15:31:45 +00:00
|
|
|
secrets =
|
|
|
|
let
|
|
|
|
config' = config;
|
|
|
|
in
|
|
|
|
lib.mkOption {
|
|
|
|
type = lib.types.attrsOf (lib.types.submodule ({ config, ... }: {
|
|
|
|
options = {
|
|
|
|
name = lib.mkOption {
|
|
|
|
type = lib.types.str;
|
|
|
|
description = ''
|
|
|
|
name of the secret
|
|
|
|
'';
|
|
|
|
default = config._module.args.name;
|
|
|
|
};
|
|
|
|
path = lib.mkOption {
|
|
|
|
type = lib.types.str;
|
|
|
|
description = ''
|
|
|
|
path to a secret which is generated by the generator
|
|
|
|
'';
|
|
|
|
default = "${config'.clanCore.secretsDirectory}/${config'.clanCore.secretsPrefix}${config.name}";
|
|
|
|
};
|
2023-08-28 09:09:05 +00:00
|
|
|
};
|
2023-09-26 15:31:45 +00:00
|
|
|
}));
|
|
|
|
description = ''
|
|
|
|
path where the secret is located in the filesystem
|
|
|
|
'';
|
|
|
|
};
|
2023-08-28 09:09:05 +00:00
|
|
|
facts = lib.mkOption {
|
2023-09-30 07:18:00 +00:00
|
|
|
default = { };
|
2023-08-28 09:09:05 +00:00
|
|
|
type = lib.types.attrsOf (lib.types.submodule (fact: {
|
|
|
|
options = {
|
|
|
|
name = lib.mkOption {
|
|
|
|
type = lib.types.str;
|
|
|
|
description = ''
|
|
|
|
name of the fact
|
|
|
|
'';
|
|
|
|
default = fact.config._module.args.name;
|
|
|
|
};
|
|
|
|
path = lib.mkOption {
|
|
|
|
type = lib.types.str;
|
|
|
|
description = ''
|
|
|
|
path to a fact which is generated by the generator
|
|
|
|
'';
|
2023-09-14 13:22:13 +00:00
|
|
|
default = "machines/${config.clanCore.machineName}/facts/${fact.config._module.args.name}";
|
2023-08-28 09:09:05 +00:00
|
|
|
};
|
|
|
|
value = lib.mkOption {
|
2023-09-19 09:29:59 +00:00
|
|
|
defaultText = lib.literalExpression "\${config.clanCore.clanDir}/\${fact.config.path}";
|
2023-09-27 08:31:10 +00:00
|
|
|
type = lib.types.nullOr lib.types.str;
|
2023-09-19 19:48:39 +00:00
|
|
|
default =
|
|
|
|
if builtins.pathExists "${config.clanCore.clanDir}/${fact.config.path}" then
|
2023-11-28 23:12:35 +00:00
|
|
|
lib.strings.removeSuffix "\n" (builtins.readFile "${config.clanCore.clanDir}/${fact.config.path}")
|
2023-09-19 19:48:39 +00:00
|
|
|
else
|
2023-09-27 08:31:10 +00:00
|
|
|
null;
|
2023-08-28 09:09:05 +00:00
|
|
|
};
|
|
|
|
};
|
|
|
|
}));
|
|
|
|
};
|
|
|
|
};
|
|
|
|
}));
|
|
|
|
};
|
|
|
|
imports = [
|
2023-09-06 14:09:43 +00:00
|
|
|
./sops.nix
|
|
|
|
./password-store.nix
|
2023-08-28 09:09:05 +00:00
|
|
|
];
|
|
|
|
}
|