(untested) http basic auth for outboard secrets

examples/router-with-l2tp.nix

@@ -68,6 +68,8 @@ in rec {
   services.secrets = svc.secrets.outboard.build {
     name = "secret-service";
     url = "http://10.0.0.1/liminix/examples/real-secrets.json";
+    username = "demo";
+    password = "demo";
     interval = 5;
     dependencies = [ services.wan-address-for-secrets ];
   };

modules/secrets/default.nix

@@ -26,6 +26,15 @@ in {
         description = "source url";
         type = types.strMatching "https?://.*";
       };
+      username = mkOption {
+        description = "username for HTTP basic auth";
+        type = types.nullOr types.str;
+      };
+      password = mkOption {
+        description = "password for HTTP basic auth";
+        type = types.nullOr types.str;
+      };
+
       name = mkOption {
         description = "service name";
         type = types.str;

modules/secrets/outboard.nix

@@ -1,14 +1,19 @@
 {
   liminix, lib, json-to-fstree, serviceFns
 }:
-{ name, url, interval } :
+{ name, url, interval, username, password  } :
 let
   inherit (liminix.services) oneshot longrun;
+  inherit (lib) optionalString;
 in longrun {
   inherit name;
   buildInputs = [ json-to-fstree ];
   run = ''
     . ${serviceFns}
+    ${optionalString (username != null) ''
+      export NETRC=$(mkstate ${name})/netrc
+      (echo default ; echo login ${username} ; echo password ${password} ) > $NETRC
+    ''}
     ( in_outputs ${name}
       while : ; do
         ${json-to-fstree}/bin/json-to-fstree ${url} .