From fe7b092075ecbf962e333151de138e68da1b4fcd Mon Sep 17 00:00:00 2001
From: Daniel Barlow <dan@telent.net>
Date: Wed, 28 Aug 2024 20:53:59 +0100
Subject: [PATCH] (untested) http basic auth for outboard secrets

---
 examples/router-with-l2tp.nix | 2 ++
 modules/secrets/default.nix   | 9 +++++++++
 modules/secrets/outboard.nix  | 7 ++++++-
 3 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/examples/router-with-l2tp.nix b/examples/router-with-l2tp.nix
index e9c53c7..6c54dc7 100644
--- a/examples/router-with-l2tp.nix
+++ b/examples/router-with-l2tp.nix
@@ -68,6 +68,8 @@ in rec {
   services.secrets = svc.secrets.outboard.build {
     name = "secret-service";
     url = "http://10.0.0.1/liminix/examples/real-secrets.json";
+    username = "demo";
+    password = "demo";
     interval = 5;
     dependencies = [ services.wan-address-for-secrets ];
   };
diff --git a/modules/secrets/default.nix b/modules/secrets/default.nix
index 5106ff0..154f0b5 100644
--- a/modules/secrets/default.nix
+++ b/modules/secrets/default.nix
@@ -26,6 +26,15 @@ in {
         description = "source url";
         type = types.strMatching "https?://.*";
       };
+      username = mkOption {
+        description = "username for HTTP basic auth";
+        type = types.nullOr types.str;
+      };
+      password = mkOption {
+        description = "password for HTTP basic auth";
+        type = types.nullOr types.str;
+      };
+
       name = mkOption {
         description = "service name";
         type = types.str;
diff --git a/modules/secrets/outboard.nix b/modules/secrets/outboard.nix
index 7e61e39..ac78ca0 100644
--- a/modules/secrets/outboard.nix
+++ b/modules/secrets/outboard.nix
@@ -1,14 +1,19 @@
 {
   liminix, lib, json-to-fstree, serviceFns
 }:
-{ name, url, interval } :
+{ name, url, interval, username, password  } :
 let
   inherit (liminix.services) oneshot longrun;
+  inherit (lib) optionalString;
 in longrun {
   inherit name;
   buildInputs = [ json-to-fstree ];
   run = ''
     . ${serviceFns}
+    ${optionalString (username != null) ''
+      export NETRC=$(mkstate ${name})/netrc
+      (echo default ; echo login ${username} ; echo password ${password} ) > $NETRC
+    ''}
     ( in_outputs ${name}
       while : ; do
         ${json-to-fstree}/bin/json-to-fstree ${url} .