159 lines
3.8 KiB
Nix
159 lines
3.8 KiB
Nix
{ lib, shb, ... }:
|
|
let
|
|
inherit (lib)
|
|
concatStringsSep
|
|
literalMD
|
|
mkOption
|
|
optionalAttrs
|
|
optionalString
|
|
;
|
|
inherit (lib.types) listOf submodule str;
|
|
inherit (shb) anyNotNull;
|
|
in
|
|
{
|
|
mkRequest =
|
|
{
|
|
mode ? "0400",
|
|
modeText ? null,
|
|
owner ? "root",
|
|
ownerText ? null,
|
|
group ? "root",
|
|
groupText ? null,
|
|
restartUnits ? [ ],
|
|
restartUnitsText ? null,
|
|
}:
|
|
mkOption {
|
|
description = ''
|
|
Request part of the secret contract.
|
|
|
|
Options set by the requester module
|
|
enforcing some properties the secret should have.
|
|
'';
|
|
|
|
default = {
|
|
inherit
|
|
mode
|
|
owner
|
|
group
|
|
restartUnits
|
|
;
|
|
};
|
|
|
|
defaultText =
|
|
optionalString
|
|
(anyNotNull [
|
|
modeText
|
|
ownerText
|
|
groupText
|
|
restartUnitsText
|
|
])
|
|
(literalMD ''
|
|
{
|
|
mode = ${if modeText != null then modeText else mode};
|
|
owner = ${if ownerText != null then ownerText else owner};
|
|
group = ${if groupText != null then groupText else group};
|
|
restartUnits = ${
|
|
if restartUnitsText != null then
|
|
restartUnitsText
|
|
else
|
|
"[ " + concatStringsSep " " restartUnits + " ]"
|
|
};
|
|
}
|
|
'');
|
|
|
|
type = submodule {
|
|
options = {
|
|
mode =
|
|
mkOption {
|
|
description = ''
|
|
Mode of the secret file.
|
|
'';
|
|
type = str;
|
|
default = mode;
|
|
}
|
|
// optionalAttrs (modeText != null) {
|
|
defaultText = literalMD modeText;
|
|
};
|
|
|
|
owner = mkOption (
|
|
{
|
|
description = ''
|
|
Linux user owning the secret file.
|
|
'';
|
|
type = str;
|
|
default = owner;
|
|
}
|
|
// optionalAttrs (ownerText != null) {
|
|
defaultText = literalMD ownerText;
|
|
}
|
|
);
|
|
|
|
group =
|
|
mkOption {
|
|
description = ''
|
|
Linux group owning the secret file.
|
|
'';
|
|
type = str;
|
|
default = group;
|
|
}
|
|
// optionalAttrs (groupText != null) {
|
|
defaultText = literalMD groupText;
|
|
};
|
|
|
|
restartUnits = mkOption (
|
|
{
|
|
description = ''
|
|
Systemd units to restart after the secret is updated.
|
|
'';
|
|
type = listOf str;
|
|
default = restartUnits;
|
|
}
|
|
// optionalAttrs (restartUnitsText != null) {
|
|
defaultText = literalMD restartUnitsText;
|
|
}
|
|
);
|
|
};
|
|
};
|
|
};
|
|
|
|
mkResult =
|
|
{
|
|
path ? "/run/secrets/secret",
|
|
pathText ? null,
|
|
}:
|
|
mkOption (
|
|
{
|
|
description = ''
|
|
Result part of the secret contract.
|
|
|
|
Options set by the provider module that indicates where the secret can be found.
|
|
'';
|
|
default = {
|
|
inherit path;
|
|
};
|
|
type = submodule {
|
|
options = {
|
|
path =
|
|
mkOption {
|
|
type = lib.types.path;
|
|
description = ''
|
|
Path to the file containing the secret generated out of band.
|
|
|
|
This path will exist after deploying to a target host,
|
|
it is not available through the nix store.
|
|
'';
|
|
default = path;
|
|
}
|
|
// optionalAttrs (pathText != null) {
|
|
defaultText = pathText;
|
|
};
|
|
};
|
|
};
|
|
}
|
|
// optionalAttrs (pathText != null) {
|
|
defaultText = {
|
|
path = pathText;
|
|
};
|
|
}
|
|
);
|
|
}
|