liminix

Unnamed repository; edit this file 'description' to name the repository.
Log | Files | Refs | README | LICENSE

default.nix (3021B)

      1 ## Secrets
      2 
      3 ## various ways to manage secrets without writing them to the
      4 ## nix store
      5 
      6 {
      7   lib,
      8   pkgs,
      9   config,
     10   ...
     11 }:
     12 let
     13   inherit (lib) mkOption types;
     14   inherit (pkgs) liminix;
     15 in
     16 {
     17   options.system.service.secrets = {
     18     outboard = mkOption {
     19       description = "fetch secrets from external vault with https";
     20       type = liminix.lib.types.serviceDefn;
     21     };
     22     tang = mkOption {
     23       description = "fetch secrets from encrypted local pathname, using tang";
     24       type = liminix.lib.types.serviceDefn;
     25     };
     26     subscriber = mkOption {
     27       description = "wrapper around a service that needs notifying (e.g. restarting) when secrets change";
     28       type = liminix.lib.types.serviceDefn;
     29     };
     30 
     31   };
     32   config.system.service.secrets = {
     33     outboard = config.system.callService ./outboard.nix {
     34       url = mkOption {
     35         description = "source url";
     36         type = types.strMatching "https?://.*";
     37       };
     38       username = mkOption {
     39         description = "username for HTTP basic auth";
     40         type = types.nullOr types.str;
     41       };
     42       password = mkOption {
     43         description = "password for HTTP basic auth";
     44         type = types.nullOr types.str;
     45       };
     46       tlsCertificate = mkOption {
     47         description = "client certificate to present for mTLS";
     48         type = types.nullOr types.path;
     49       };
     50       tlsCaCertificate = mkOption {
     51         description = "CA certificate";
     52         type = types.nullOr types.path;
     53       };
     54       tlsPrivateKey = mkOption {
     55         description = "client private key to use for mTLS";
     56         type = types.nullOr types.path;
     57       };
     58       name = mkOption {
     59         description = "service name";
     60         type = types.str;
     61       };
     62       interval = mkOption {
     63         type = types.int;
     64         default = 30;
     65         description = "how often to check the source, in minutes";
     66       };
     67     };
     68     tang = config.system.callService ./tang.nix {
     69       path = mkOption {
     70         description = "encrypted source pathname";
     71         type = types.path;
     72       };
     73       name = mkOption {
     74         description = "service name";
     75         type = types.str;
     76       };
     77       interval = mkOption {
     78         type = types.int;
     79         default = 30;
     80         description = "how often to check the source, in minutes";
     81       };
     82     };
     83     subscriber = config.system.callService ./subscriber.nix {
     84       watch = mkOption {
     85         description = "secrets paths to subscribe to";
     86         type = types.listOf (types.functionTo types.anything);
     87       };
     88       service = mkOption {
     89         description = "subscribing service that will receive notification";
     90         type = liminix.lib.types.service;
     91       };
     92       action = mkOption {
     93         description = "how do we notify the service to regenerate its config";
     94         default = "restart-all";
     95         type = types.enum [
     96           "restart"
     97           "restart-all"
     98           "hup"
     99           "int"
    100           "quit"
    101           "kill"
    102           "term"
    103           "winch"
    104           "usr1"
    105           "usr2"
    106         ];
    107       };
    108     };
    109   };
    110 }