DavHau
208021ee1c
All checks were successful
buildbot/nix-build .#checks.aarch64-darwin.nixos-test_install_machine Build done.
buildbot/nix-build .#checks.aarch64-darwin.nixos-minimal-inventory-machine Build done.
buildbot/nix-build .#checks.aarch64-darwin.nixos-iso-installer Build done.
buildbot/nix-build .#checks.aarch64-darwin.nixos-flash-installer Build done.
buildbot/nix-build .#checks.aarch64-linux.nixos-minimal-inventory-machine Build done.
buildbot/nix-build .#checks.aarch64-linux.nixos-test_install_machine Build done.
buildbot/nix-build .#checks.aarch64-linux.nixos-flash-installer Build done.
buildbot/nix-build .#checks.aarch64-darwin.nixos-test-backup Build done.
buildbot/nix-build .#checks.x86_64-linux.package-gui-installer-rpm Build done.
buildbot/nix-build .#checks.x86_64-linux.devShell-docs Build done.
buildbot/nix-build .#checks.x86_64-linux."clan-dep-python3.11-qemu" Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-dep-rsync Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-dep-sops Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-dep-sshpass Build done.
buildbot/nix-build .#checks.x86_64-linux.package-gui-installer-apk Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-app-no-breakpoints Build done.
buildbot/nix-build .#checks.x86_64-linux.check-for-breakpoints Build done.
buildbot/nix-build .#checks.x86_64-linux.package-gui-installer-archlinux Build done.
buildbot/nix-build .#checks.x86_64-linux.package-gui-installer-deb Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-dep-bash Build done.
buildbot/nix-build .#checks.x86_64-linux.nixos-test-backup Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-dep-e2fsprogs Build done.
buildbot/nix-build .#checks.x86_64-linux.package-module-docs Build done.
buildbot/nix-build .#checks.aarch64-linux.nixos-iso-installer Build done.
buildbot/nix-build .#checks.aarch64-linux.nixos-test-backup Build done.
buildbot/nix-build .#checks.x86_64-linux.renderClanOptions Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-dep-openssh Build done.
buildbot/nix-build .#checks.x86_64-linux."clan-dep-python3.11-mypy" Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-dep-tor Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-dep-zbar Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-dep-nix Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-app-pytest Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-pytest-without-core Build done.
buildbot/nix-build .#checks.x86_64-linux.devShell-clan-cli Build done.
buildbot/nix-build .#checks.x86_64-linux.devShell-default Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-dep-age Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-dep-git Build done.
buildbot/nix-build .#checks.x86_64-linux.devShell-webview-ui Build done.
buildbot/nix-build .#checks.x86_64-linux.devShell-inventory-schema Build done.
buildbot/nix-build .#checks.x86_64-linux.devShell-clan-app Build done.
buildbot/nix-build .#checks.x86_64-linux.lib-jsonschema-example-valid Build done.
buildbot/nix-build .#checks.x86_64-linux.lib-inventory-schema Build done.
buildbot/nix-build .#checks.x86_64-linux.borgbackup Build done.
buildbot/nix-build .#checks.x86_64-linux.deltachat Build done.
buildbot/nix-build .#checks.x86_64-linux.package-deploy-docs Build done.
buildbot/nix-build .#checks.x86_64-linux.package-clan-app Build done.
buildbot/nix-build .#checks.x86_64-linux.package-clan-cli-docs Build done.
buildbot/nix-build .#checks.x86_64-linux.package-clan-ts-api Build done.
buildbot/nix-build .#checks.x86_64-linux.container Build done.
buildbot/nix-build .#checks.x86_64-linux.matrix-synapse Build done.
buildbot/nix-build .#checks.x86_64-linux.treefmt Build done.
buildbot/nix-build .#checks.x86_64-linux.package-default Build done.
buildbot/nix-build .#checks.x86_64-linux.module-schema Build done.
buildbot/nix-build .#checks.x86_64-linux.lib-jsonschema-nix-unit-tests Build done.
buildbot/nix-build .#checks.x86_64-linux.package-clan-cli Build done.
buildbot/nix-build .#checks.x86_64-linux.package-editor Build done.
buildbot/nix-build .#checks.x86_64-linux.package-impure-checks Build done.
buildbot/nix-build .#checks.x86_64-linux.package-merge-after-ci Build done.
buildbot/nix-build .#checks.x86_64-linux.nixos-flash-installer Build done.
buildbot/nix-build .#checks.x86_64-linux.nixos-minimal-inventory-machine Build done.
buildbot/nix-build .#checks.x86_64-linux.nixos-test_install_machine Build done.
buildbot/nix-build .#checks.x86_64-linux.package-moonlight-sunshine-accept Build done.
buildbot/nix-build .#checks.x86_64-linux.package-tea-create-pr Build done.
buildbot/nix-build .#checks.x86_64-linux.package-webview-ui Build done.
buildbot/nix-build .#checks.x86_64-linux.package-zerotier-members Build done.
buildbot/nix-build .#checks.x86_64-linux.package-pending-reviews Build done.
buildbot/nix-build .#checks.x86_64-linux.package-zt-tcp-relay Build done.
buildbot/nix-build .#checks.x86_64-linux.package-module-schema Build done.
buildbot/nix-build .#checks.x86_64-linux.template-minimal Build done.
buildbot/nix-build .#checks.x86_64-linux.zt-tcp-relay Build done.
buildbot/nix-build .#checks.x86_64-linux.package-iso-installer Build done.
buildbot/nix-build .#checks.x86_64-linux.wayland-proxy-virtwl Build done.
buildbot/nix-build .#checks.x86_64-linux.test-installation Build done.
buildbot/nix-eval Build done.
buildbot/nix-build .#checks.x86_64-linux.package-docs Build done.
buildbot/nix-build .#checks.x86_64-linux.package-zerotierone Build done.
buildbot/nix-build .#checks.x86_64-linux.nixos-iso-installer Build done.
buildbot/nix-build .#checks.x86_64-linux.postgresql Build done.
buildbot/nix-build .#checks.x86_64-linux.secrets Build done.
buildbot/nix-build .#checks.x86_64-linux.package-function-schema Build done.
buildbot/nix-build .#checks.x86_64-linux.syncthing Build done.
buildbot/nix-build .#checks.x86_64-linux.lib-inventory-eval Build done.
buildbot/nix-build .#checks.x86_64-linux.module-clan-vars-eval Build done.
buildbot/nix-build .#checks.x86_64-linux.package-gui-install-test-ubuntu-22-04 Build done.
buildbot/nix-build .#checks.x86_64-linux.test-backups Build done.
buildbot/nix-build .#checks.x86_64-linux.clan-pytest-with-core Build done.
buildbot/nix-build .#checks.x86_64-linux.flash Build done.
checks / checks-impure (pull_request) Successful in 2m38s
255 lines
9.1 KiB
Nix
255 lines
9.1 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
{
|
|
options.clan.core.facts = {
|
|
secretStore = lib.mkOption {
|
|
type = lib.types.enum [
|
|
"sops"
|
|
"password-store"
|
|
"vm"
|
|
"custom"
|
|
];
|
|
default = "sops";
|
|
description = ''
|
|
method to store secret facts
|
|
custom can be used to define a custom secret fact store.
|
|
'';
|
|
};
|
|
|
|
secretModule = lib.mkOption {
|
|
type = lib.types.str;
|
|
internal = true;
|
|
description = ''
|
|
the python import path to the secret module
|
|
'';
|
|
};
|
|
|
|
secretUploadDirectory = lib.mkOption {
|
|
type = lib.types.nullOr lib.types.path;
|
|
default = null;
|
|
description = ''
|
|
The directory where secrets are uploaded into, This is backend specific.
|
|
'';
|
|
};
|
|
|
|
secretPathFunction = lib.mkOption {
|
|
type = lib.types.raw;
|
|
description = ''
|
|
The function to use to generate the path for a secret.
|
|
The default function will use the path attribute of the secret.
|
|
The function will be called with the secret submodule as an argument.
|
|
'';
|
|
};
|
|
|
|
publicStore = lib.mkOption {
|
|
type = lib.types.enum [
|
|
"in_repo"
|
|
"vm"
|
|
"custom"
|
|
];
|
|
default = "in_repo";
|
|
description = ''
|
|
method to store public facts.
|
|
custom can be used to define a custom public fact store.
|
|
'';
|
|
};
|
|
publicModule = lib.mkOption {
|
|
type = lib.types.str;
|
|
internal = true;
|
|
description = ''
|
|
the python import path to the public module
|
|
'';
|
|
};
|
|
publicDirectory = lib.mkOption {
|
|
type = lib.types.nullOr lib.types.path;
|
|
default = null;
|
|
description = ''
|
|
The directory where public facts are stored.
|
|
'';
|
|
};
|
|
|
|
services = lib.mkOption {
|
|
description = ''
|
|
Services to generate secrets and facts for.
|
|
Each service can have a generator script which generates the secrets and facts.
|
|
The generator script is expected to generate all secrets and facts defined for this service.
|
|
|
|
A `service` does not need to ba analogous to a systemd service, it can be any group of facts and secrets that need to be generated together.
|
|
'';
|
|
default = { };
|
|
type = lib.types.attrsOf (
|
|
lib.types.submodule (service: {
|
|
options = {
|
|
name = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = service.config._module.args.name;
|
|
description = ''
|
|
Namespace of the service
|
|
'';
|
|
};
|
|
generator = lib.mkOption {
|
|
description = ''
|
|
The generator to generate the secrets and facts for this service.
|
|
'';
|
|
type = lib.types.submodule (
|
|
{ config, ... }:
|
|
{
|
|
options = {
|
|
path = lib.mkOption {
|
|
type = lib.types.listOf (lib.types.either lib.types.path lib.types.package);
|
|
default = [ ];
|
|
description = ''
|
|
Extra paths to add to the PATH environment variable when running the generator.
|
|
'';
|
|
};
|
|
prompt = lib.mkOption {
|
|
type = lib.types.nullOr lib.types.str;
|
|
default = null;
|
|
description = ''
|
|
prompt text to ask for a value.
|
|
This value will be passed to the script as the environment variable $prompt_value.
|
|
'';
|
|
};
|
|
script = lib.mkOption {
|
|
type = lib.types.str;
|
|
description = ''
|
|
Shell script snippet to generate the secrets and facts.
|
|
The script has access to the following environment variables:
|
|
- prompt_value: prompted value in case a prompt was defined
|
|
- facts: path to a directory where facts can be stored
|
|
- secrets: path to a directory where secrets can be stored
|
|
The script is expected to generate all secrets and facts defined for this service.
|
|
'';
|
|
};
|
|
finalScript = lib.mkOption {
|
|
type = lib.types.str;
|
|
readOnly = true;
|
|
internal = true;
|
|
defaultText = "read only script";
|
|
default = ''
|
|
set -eu -o pipefail
|
|
|
|
export PATH="${lib.makeBinPath config.path}:${pkgs.coreutils}/bin"
|
|
|
|
${lib.optionalString (pkgs.stdenv.hostPlatform.isLinux) ''
|
|
# prepare sandbox user on platforms where this is supported
|
|
mkdir -p /etc
|
|
|
|
cat > /etc/group <<EOF
|
|
root:x:0:
|
|
nixbld:!:$(id -g):
|
|
nogroup:x:65534:
|
|
EOF
|
|
|
|
cat > /etc/passwd <<EOF
|
|
root:x:0:0:Nix build user:/build:/noshell
|
|
nixbld:x:$(id -u):$(id -g):Nix build user:/build:/noshell
|
|
nobody:x:65534:65534:Nobody:/:/noshell
|
|
EOF
|
|
|
|
cat > /etc/hosts <<EOF
|
|
127.0.0.1 localhost
|
|
::1 localhost
|
|
EOF
|
|
''}
|
|
${config.script}
|
|
'';
|
|
};
|
|
};
|
|
}
|
|
);
|
|
};
|
|
secret = lib.mkOption {
|
|
description = ''
|
|
Secret facts to generate for this service.
|
|
'';
|
|
default = { };
|
|
type = lib.types.attrsOf (
|
|
lib.types.submodule (secret: {
|
|
options =
|
|
{
|
|
name = lib.mkOption {
|
|
type = lib.types.str;
|
|
description = ''
|
|
name of the secret
|
|
'';
|
|
default = secret.config._module.args.name;
|
|
};
|
|
path = lib.mkOption {
|
|
type = lib.types.str;
|
|
description = ''
|
|
path to a secret which is generated by the generator
|
|
'';
|
|
default = config.clan.core.facts.secretPathFunction secret;
|
|
};
|
|
}
|
|
// lib.optionalAttrs (config.clan.core.facts.secretModule == "clan_cli.facts.secret_modules.sops") {
|
|
groups = lib.mkOption {
|
|
type = lib.types.listOf lib.types.str;
|
|
default = config.clan.core.sops.defaultGroups;
|
|
description = ''
|
|
Groups to decrypt the secret for. By default we always use the user's key.
|
|
'';
|
|
};
|
|
};
|
|
})
|
|
);
|
|
};
|
|
public = lib.mkOption {
|
|
description = ''
|
|
Public facts to generate for this service.
|
|
'';
|
|
default = { };
|
|
type = lib.types.attrsOf (
|
|
lib.types.submodule (fact: {
|
|
options = {
|
|
name = lib.mkOption {
|
|
type = lib.types.str;
|
|
description = ''
|
|
name of the public fact
|
|
'';
|
|
default = fact.config._module.args.name;
|
|
};
|
|
path = lib.mkOption {
|
|
type = lib.types.path;
|
|
description = ''
|
|
path to a fact which is generated by the generator
|
|
'';
|
|
defaultText = lib.literalExpression "\${config.clan.core.clanDir}/machines/\${config.clan.core.machineName}/facts/\${fact.config.name}";
|
|
default =
|
|
config.clan.core.clanDir + "/machines/${config.clan.core.machineName}/facts/${fact.config.name}";
|
|
};
|
|
value = lib.mkOption {
|
|
description = ''
|
|
The value of the public fact.
|
|
'';
|
|
defaultText = lib.literalExpression "\${config.clan.core.clanDir}/\${fact.config.path}";
|
|
type = lib.types.nullOr lib.types.str;
|
|
default =
|
|
if builtins.pathExists fact.config.path then lib.strings.fileContents fact.config.path else null;
|
|
};
|
|
};
|
|
})
|
|
);
|
|
};
|
|
};
|
|
})
|
|
);
|
|
};
|
|
};
|
|
imports = [
|
|
./compat.nix
|
|
|
|
./secret/sops.nix
|
|
./secret/password-store.nix
|
|
./secret/vm.nix
|
|
|
|
./public/in_repo.nix
|
|
./public/vm.nix
|
|
];
|
|
}
|