105 lines
2.5 KiB
Nix
105 lines
2.5 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
shb,
|
|
...
|
|
}:
|
|
let
|
|
cfg = config.shb.hardcodedsecret;
|
|
|
|
inherit (lib) mapAttrs' mkOption nameValuePair;
|
|
inherit (lib.types)
|
|
attrsOf
|
|
nullOr
|
|
str
|
|
submodule
|
|
;
|
|
inherit (pkgs) writeText;
|
|
in
|
|
{
|
|
imports = [
|
|
../../lib/module.nix
|
|
];
|
|
|
|
options.shb.hardcodedsecret = mkOption {
|
|
default = { };
|
|
description = ''
|
|
Hardcoded secrets. These should only be used in tests.
|
|
'';
|
|
example = lib.literalExpression ''
|
|
{
|
|
mySecret = {
|
|
request = {
|
|
user = "me";
|
|
mode = "0400";
|
|
restartUnits = [ "myservice.service" ];
|
|
};
|
|
settings.content = "My Secret";
|
|
};
|
|
}
|
|
'';
|
|
type = attrsOf (
|
|
submodule (
|
|
{ name, ... }:
|
|
{
|
|
options = shb.contracts.secret.mkProvider {
|
|
settings = mkOption {
|
|
description = ''
|
|
Settings specific to the hardcoded secret module.
|
|
|
|
Give either `content` or `source`.
|
|
'';
|
|
|
|
type = submodule {
|
|
options = {
|
|
content = mkOption {
|
|
type = nullOr str;
|
|
description = ''
|
|
Content of the secret as a string.
|
|
|
|
This will be stored in the nix store and should only be used for testing or maybe in dev.
|
|
'';
|
|
default = null;
|
|
};
|
|
|
|
source = mkOption {
|
|
type = nullOr str;
|
|
description = ''
|
|
Source of the content of the secret as a path in the nix store.
|
|
'';
|
|
default = null;
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
resultCfg = {
|
|
path = "/run/hardcodedsecrets/hardcodedsecret_${name}";
|
|
};
|
|
};
|
|
}
|
|
)
|
|
);
|
|
};
|
|
|
|
config = {
|
|
system.activationScripts = mapAttrs' (
|
|
n: cfg':
|
|
let
|
|
source =
|
|
if cfg'.settings.source != null then
|
|
cfg'.settings.source
|
|
else
|
|
writeText "hardcodedsecret_${n}_content" cfg'.settings.content;
|
|
in
|
|
nameValuePair "hardcodedsecret_${n}" ''
|
|
mkdir -p "$(dirname "${cfg'.result.path}")"
|
|
touch "${cfg'.result.path}"
|
|
chmod ${cfg'.request.mode} "${cfg'.result.path}"
|
|
chown ${cfg'.request.owner}:${cfg'.request.group} "${cfg'.result.path}"
|
|
cp ${source} "${cfg'.result.path}"
|
|
''
|
|
) cfg;
|
|
};
|
|
}
|