parent
5e86860312
commit
4afd9910e9
|
@ -37,7 +37,7 @@
|
||||||
|
|
||||||
./lib/flake-module.nix
|
./lib/flake-module.nix
|
||||||
./nixosModules/flake-module.nix
|
./nixosModules/flake-module.nix
|
||||||
./nixosModules/core/flake-module.nix
|
./nixosModules/clanCore/flake-module.nix
|
||||||
];
|
];
|
||||||
});
|
});
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
{ ... } @ core: {
|
{ ... } @ clanCore: {
|
||||||
flake.flakeModules.clan-config = { self, inputs, ... }:
|
flake.flakeModules.clan-config = { self, inputs, ... }:
|
||||||
let
|
let
|
||||||
|
|
||||||
|
@ -29,12 +29,12 @@
|
||||||
perSystem = { pkgs, ... }: {
|
perSystem = { pkgs, ... }: {
|
||||||
devShells.clan-config = pkgs.mkShell {
|
devShells.clan-config = pkgs.mkShell {
|
||||||
packages = [
|
packages = [
|
||||||
core.config.flake.packages.${pkgs.system}.clan-cli
|
clanCore.config.flake.packages.${pkgs.system}.clan-cli
|
||||||
];
|
];
|
||||||
shellHook = ''
|
shellHook = ''
|
||||||
export CLAN_OPTIONS_FILE=$(nix eval --raw .#clanOptions)
|
export CLAN_OPTIONS_FILE=$(nix eval --raw .#clanOptions)
|
||||||
export XDG_DATA_DIRS="${core.config.flake.packages.${pkgs.system}.clan-cli}/share''${XDG_DATA_DIRS:+:$XDG_DATA_DIRS}"
|
export XDG_DATA_DIRS="${clanCore.config.flake.packages.${pkgs.system}.clan-cli}/share''${XDG_DATA_DIRS:+:$XDG_DATA_DIRS}"
|
||||||
export fish_complete_path="${core.config.flake.packages.${pkgs.system}.clan-cli}/share/fish/vendor_completions.d''${fish_complete_path:+:$fish_complete_path}"
|
export fish_complete_path="${clanCore.config.flake.packages.${pkgs.system}.clan-cli}/share/fish/vendor_completions.d''${fish_complete_path:+:$fish_complete_path}"
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
@ -1,6 +1,6 @@
|
||||||
{ self, inputs, lib, ... }: {
|
{ self, inputs, lib, ... }: {
|
||||||
flake.nixosModules.clan.core = { pkgs, ... }: {
|
flake.nixosModules.clanCore = { pkgs, ... }: {
|
||||||
options.clan.core = {
|
options.clanCore = {
|
||||||
clanDir = lib.mkOption {
|
clanDir = lib.mkOption {
|
||||||
type = lib.types.str;
|
type = lib.types.str;
|
||||||
description = ''
|
description = ''
|
|
@ -1,6 +1,6 @@
|
||||||
{ config, lib, ... }:
|
{ config, lib, ... }:
|
||||||
{
|
{
|
||||||
options.clan.core.secrets = lib.mkOption {
|
options.clanCore.secrets = lib.mkOption {
|
||||||
type = lib.types.attrsOf
|
type = lib.types.attrsOf
|
||||||
(lib.types.submodule (secret: {
|
(lib.types.submodule (secret: {
|
||||||
options = {
|
options = {
|
||||||
|
@ -49,7 +49,7 @@
|
||||||
description = ''
|
description = ''
|
||||||
path to a fact which is generated by the generator
|
path to a fact which is generated by the generator
|
||||||
'';
|
'';
|
||||||
default = "${config.clan.core.clanDir}/facts/${config.clan.core.machineName}/${fact.config._module.args.name}";
|
default = "${config.clanCore.clanDir}/facts/${config.clanCore.machineName}/${fact.config._module.args.name}";
|
||||||
};
|
};
|
||||||
value = lib.mkOption {
|
value = lib.mkOption {
|
||||||
default = builtins.readFile fact.config.path;
|
default = builtins.readFile fact.config.path;
|
|
@ -7,24 +7,24 @@
|
||||||
set -x # remove for prod
|
set -x # remove for prod
|
||||||
|
|
||||||
PATH=$PATH:${lib.makeBinPath [
|
PATH=$PATH:${lib.makeBinPath [
|
||||||
config.clan.core.clanPkgs.clan-cli
|
config.clanCore.clanPkgs.clan-cli
|
||||||
]}
|
]}
|
||||||
|
|
||||||
# initialize secret store
|
# initialize secret store
|
||||||
if ! clan secrets machines list | grep -q ${config.clan.core.machineName}; then (
|
if ! clan secrets machines list | grep -q ${config.clanCore.machineName}; then (
|
||||||
INITTMP=$(mktemp -d)
|
INITTMP=$(mktemp -d)
|
||||||
trap 'rm -rf "$INITTMP"' EXIT
|
trap 'rm -rf "$INITTMP"' EXIT
|
||||||
${pkgs.age}/bin/age-keygen -o "$INITTMP/secret" 2> "$INITTMP/public"
|
${pkgs.age}/bin/age-keygen -o "$INITTMP/secret" 2> "$INITTMP/public"
|
||||||
PUBKEY=$(cat "$INITTMP/public" | sed 's/.*: //')
|
PUBKEY=$(cat "$INITTMP/public" | sed 's/.*: //')
|
||||||
clan secrets machines add ${config.clan.core.machineName} "$PUBKEY"
|
clan secrets machines add ${config.clanCore.machineName} "$PUBKEY"
|
||||||
tail -1 "$INITTMP/secret" | clan secrets set --machine ${config.clan.core.machineName} ${config.clan.core.machineName}-age.key
|
tail -1 "$INITTMP/secret" | clan secrets set --machine ${config.clanCore.machineName} ${config.clanCore.machineName}-age.key
|
||||||
) fi
|
) fi
|
||||||
|
|
||||||
${lib.foldlAttrs (acc: n: v: ''
|
${lib.foldlAttrs (acc: n: v: ''
|
||||||
${acc}
|
${acc}
|
||||||
# ${n}
|
# ${n}
|
||||||
# if any of the secrets are missing, we regenerate all connected facts/secrets
|
# if any of the secrets are missing, we regenerate all connected facts/secrets
|
||||||
(if ! ${lib.concatMapStringsSep " && " (x: "clan secrets get ${config.clan.core.machineName}-${x.name} >/dev/null") (lib.attrValues v.secrets)}; then
|
(if ! ${lib.concatMapStringsSep " && " (x: "clan secrets get ${config.clanCore.machineName}-${x.name} >/dev/null") (lib.attrValues v.secrets)}; then
|
||||||
|
|
||||||
facts=$(mktemp -d)
|
facts=$(mktemp -d)
|
||||||
trap "rm -rf $facts" EXIT
|
trap "rm -rf $facts" EXIT
|
||||||
|
@ -38,24 +38,24 @@
|
||||||
'') (lib.attrValues v.facts)}
|
'') (lib.attrValues v.facts)}
|
||||||
|
|
||||||
${lib.concatMapStrings (secret: ''
|
${lib.concatMapStrings (secret: ''
|
||||||
cat "$secrets"/${secret.name} | clan secrets set --machine ${config.clan.core.machineName} ${config.clan.core.machineName}-${secret.name}
|
cat "$secrets"/${secret.name} | clan secrets set --machine ${config.clanCore.machineName} ${config.clanCore.machineName}-${secret.name}
|
||||||
'') (lib.attrValues v.secrets)}
|
'') (lib.attrValues v.secrets)}
|
||||||
fi)
|
fi)
|
||||||
'') "" config.clan.core.secrets}
|
'') "" config.clanCore.secrets}
|
||||||
'';
|
'';
|
||||||
sops.secrets =
|
sops.secrets =
|
||||||
let
|
let
|
||||||
encryptedForThisMachine = name: type:
|
encryptedForThisMachine = name: type:
|
||||||
let
|
let
|
||||||
symlink = config.clan.core.clanDir + "/sops/secrets/${name}/machines/${config.clan.core.machineName}";
|
symlink = config.clanCore.clanDir + "/sops/secrets/${name}/machines/${config.clanCore.machineName}";
|
||||||
in
|
in
|
||||||
# WTF, nix bug, my symlink is in the nixos module detected as a directory also it works in the repl
|
# WTF, nix bug, my symlink is in the nixos module detected as a directory also it works in the repl
|
||||||
type == "directory" && (builtins.readFileType symlink == "directory" || builtins.readFileType symlink == "symlink");
|
type == "directory" && (builtins.readFileType symlink == "directory" || builtins.readFileType symlink == "symlink");
|
||||||
secrets = lib.filterAttrs encryptedForThisMachine (builtins.readDir (config.clan.core.clanDir + "/sops/secrets"));
|
secrets = lib.filterAttrs encryptedForThisMachine (builtins.readDir (config.clanCore.clanDir + "/sops/secrets"));
|
||||||
in
|
in
|
||||||
builtins.mapAttrs
|
builtins.mapAttrs
|
||||||
(name: _: {
|
(name: _: {
|
||||||
sopsFile = config.clan.core.clanDir + "/sops/secrets/${name}/secret";
|
sopsFile = config.clanCore.clanDir + "/sops/secrets/${name}/secret";
|
||||||
format = "binary";
|
format = "binary";
|
||||||
})
|
})
|
||||||
secrets;
|
secrets;
|
|
@ -41,13 +41,13 @@ in
|
||||||
} // lib.mkIf cfg.controller.enable {
|
} // lib.mkIf cfg.controller.enable {
|
||||||
# only the controller needs to have the key in the repo, the other clients can be dynamic
|
# only the controller needs to have the key in the repo, the other clients can be dynamic
|
||||||
# we generate the zerotier code manually for the controller, since it's part of the bootstrap command
|
# we generate the zerotier code manually for the controller, since it's part of the bootstrap command
|
||||||
clan.core.secrets.zerotier = {
|
clanCore.secrets.zerotier = {
|
||||||
facts."network.id" = { };
|
facts."network.id" = { };
|
||||||
secrets."identity.secret" = { };
|
secrets."identity.secret" = { };
|
||||||
generator = ''
|
generator = ''
|
||||||
TMPDIR=$(mktemp -d)
|
TMPDIR=$(mktemp -d)
|
||||||
trap 'rm -rf "$TMPDIR"' EXIT
|
trap 'rm -rf "$TMPDIR"' EXIT
|
||||||
${config.clan.core.clanPkgs.clan-cli}/bin/clan zerotier --outpath "$TMPDIR"
|
${config.clanCore.clanPkgs.clan-cli}/bin/clan zerotier --outpath "$TMPDIR"
|
||||||
cp "$TMPDIR"/network.id "$facts"/network.id
|
cp "$TMPDIR"/network.id "$facts"/network.id
|
||||||
cp "$TMPDIR"/identity.secret "$secrets"/identity.secret
|
cp "$TMPDIR"/identity.secret "$secrets"/identity.secret
|
||||||
'';
|
'';
|
|
@ -15,7 +15,7 @@ def get_secret_script(machine: str) -> None:
|
||||||
"--expr",
|
"--expr",
|
||||||
"let f = builtins.getFlake (toString ./.); in "
|
"let f = builtins.getFlake (toString ./.); in "
|
||||||
f"(f.nixosConfigurations.{machine}.extendModules "
|
f"(f.nixosConfigurations.{machine}.extendModules "
|
||||||
"{ modules = [{ clan.core.clanDir = toString ./.; }]; })"
|
"{ modules = [{ clanCore.clanDir = toString ./.; }]; })"
|
||||||
".config.system.clan.generateSecrets",
|
".config.system.clan.generateSecrets",
|
||||||
],
|
],
|
||||||
check=True,
|
check=True,
|
||||||
|
|
Loading…
Reference in New Issue
Block a user