git.delta.rocks / fleet / refs/commits / ddc0a9996bc8

125  };125  };
126  services.gitlab = let secrets = config.secrets; in {126  services.gitlab = let secrets = config.secrets; in {
127    enable = true;127    enable = true;
128    initialRootPasswordFile = secrets.gitlab-initial-root.secretPath;128    initialRootPasswordFile = secrets.gitlab-initial-root.secret.path;
129    secrets = {129    secrets = {
130      secretFile = secrets.gitlab-secret.secretPath;130      secretFile = secrets.gitlab-secret.secret.path;
131      otpFile = secrets.gitlab-otp.secretPath;131      otpFile = secrets.gitlab-otp.secret.path;
132      dbFile = secrets.gitlab-db.secretPath;132      dbFile = secrets.gitlab-db.secret.path;
133      jwsFile = secrets.gitlab-jws.secretPath;133      jwsFile = secrets.gitlab-jws.secret.path;
134    };134    };
135  };135  };
136}136}
200        set -eu200        set -eu
201        export OPENSSL_CONF=${openssl-conf}201        export OPENSSL_CONF=${openssl-conf}
202        # Yay, using secrets to generate secrets!202        # Yay, using secrets to generate secrets!
203        HSM_PIN=$(cat ${config.secrets.hsm-pin.secretPath})203        HSM_PIN=$(cat ${config.secrets.hsm-pin.secret.path})
204        exec ${pkgs.openssl}/bin/openssl "$@" -keyform=engine -CAkeyform=engine -engine=pkcs11 -passin=pass:"$HSM_PIN"204        exec ${pkgs.openssl}/bin/openssl "$@" -keyform=engine -CAkeyform=engine -engine=pkcs11 -passin=pass:"$HSM_PIN"
205      '';205      '';
206    })206    })
207    (pkgs.writeShellApplication {207    (pkgs.writeShellApplication {
208      name = "hsmt";208      name = "hsmt";
209      text = ''209      text = ''
210        set -eu210        set -eu
211        HSM_PIN=$(cat ${config.secrets.hsm-pin.secretPath})211        HSM_PIN=$(cat ${config.secrets.hsm-pin.secret.path})
212        exec ${pkgs.opensc}/bin/pkcs11-tool -l --pin="$HSM_PIN" "$@"212        exec ${pkgs.opensc}/bin/pkcs11-tool -l --pin="$HSM_PIN" "$@"
213      '';213      '';
214    })214    })

160          mkImpureSecretGenerator,160          mkImpureSecretGenerator,
161        }:161        }:
162        mkImpureSecretGenerator {162        mkImpureSecretGenerator {
163          # TODO: Escape prompt/part (preferrably just use env) to prevent shell injection
164          script = ''163          script = ''
165            mkdir $out164            mkdir $out
166            ${kdePackages.kdialog}/bin/kdialog --inputbox "${prompt}" | gh private -o $out/${part}165            ${kdePackages.kdialog}/bin/kdialog --inputbox "${prompt}" | gh private -o $out/${part}