liminix

Unnamed repository; edit this file 'description' to name the repository.
Log | Files | Refs | README | LICENSE

default.nix (2650B)

      1 ## Secrets
      2 
      3 ## various ways to manage secrets without writing them to the
      4 ## nix store
      5 
      6 {
      7   lib,
      8   pkgs,
      9   config,
     10   ...
     11 }:
     12 let
     13   inherit (lib) mkOption types;
     14   inherit (pkgs) liminix;
     15   inherit (pkgs.liminix.services) longrun;
     16 in
     17 {
     18   options.system.service.secrets = {
     19     outboard = mkOption {
     20       description = "fetch secrets from external vault with https";
     21       type = liminix.lib.types.serviceDefn;
     22     };
     23     tang = mkOption {
     24       description = "fetch secrets from encrypted local pathname, using tang";
     25       type = liminix.lib.types.serviceDefn;
     26     };
     27     subscriber = mkOption {
     28       description = "wrapper around a service that needs notifying (e.g. restarting) when secrets change";
     29       type = liminix.lib.types.serviceDefn;
     30     };
     31 
     32   };
     33   config.system.service.secrets = {
     34     outboard = config.system.callService ./outboard.nix {
     35       url = mkOption {
     36         description = "source url";
     37         type = types.strMatching "https?://.*";
     38       };
     39       username = mkOption {
     40         description = "username for HTTP basic auth";
     41         type = types.nullOr types.str;
     42       };
     43       password = mkOption {
     44         description = "password for HTTP basic auth";
     45         type = types.nullOr types.str;
     46       };
     47       name = mkOption {
     48         description = "service name";
     49         type = types.str;
     50       };
     51       interval = mkOption {
     52         type = types.int;
     53         default = 30;
     54         description = "how often to check the source, in minutes";
     55       };
     56     };
     57     tang = config.system.callService ./tang.nix {
     58       path = mkOption {
     59         description = "encrypted source pathname";
     60         type = types.path;
     61       };
     62       name = mkOption {
     63         description = "service name";
     64         type = types.str;
     65       };
     66       interval = mkOption {
     67         type = types.int;
     68         default = 30;
     69         description = "how often to check the source, in minutes";
     70       };
     71     };
     72     subscriber = config.system.callService ./subscriber.nix {
     73       watch = mkOption {
     74         description = "secrets paths to subscribe to";
     75         type = types.listOf (types.functionTo types.anything);
     76       };
     77       service = mkOption {
     78         description = "subscribing service that will receive notification";
     79         type = liminix.lib.types.service;
     80       };
     81       action = mkOption {
     82         description = "how do we notify the service to regenerate its config";
     83         default = "restart-all";
     84         type = types.enum [
     85           "restart"
     86           "restart-all"
     87           "hup"
     88           "int"
     89           "quit"
     90           "kill"
     91           "term"
     92           "winch"
     93           "usr1"
     94           "usr2"
     95         ];
     96       };
     97     };
     98   };
     99 }