1{2 lib,3 fleetLib,4 config,5 ...6}:7let8 inherit (fleetLib.options) mkDataOption;9 inherit (lib.options) mkOption;10 inherit (lib.types)11 nullOr12 listOf13 str14 attrsOf15 submodule16 bool17 unspecified18 ;19 inherit (lib.attrsets)20 mapAttrsToList21 mapAttrs22 filterAttrs23 genAttrs24 ;25 inherit (lib.lists) sort unique concatLists;26 inherit (lib.strings) toJSON;2728 secretDataValue = {29 options = {30 raw = mkOption {31 type = nullOr str;32 description = "Raw secret data in unspecified encoded and optionally encrypted format.";33 default = null;34 };35 };36 };3738 sharedSecretData = {39 freeformType = attrsOf (submodule secretDataValue);40 options = {41 createdAt = mkOption {42 type = str;43 description = "Timestamp of secret generation/last rotation.";44 default = null;45 };46 expiresAt = mkOption {47 type = nullOr str;48 description = "Expiration timestamp triggering mandatory secret rotation.";49 default = null;50 };5152 owners = mkOption {53 type = listOf str;54 description = ''55 List of hosts currently authorized to decrypt this shared secret.5657 If owners differ from expected owners, the secret is considered outdated58 and requires regeneration or re-encryption.59 '';60 default = [ ];61 };62 generationData = mkOption {63 type = unspecified;64 description = "Contextual metadata associated with secret part.";65 default = null;66 };67 };68 config = { };69 };7071 hostSecretData = {72 freeformType = attrsOf (submodule secretDataValue);73 options = {74 createdAt = mkOption {75 type = str;76 description = "Timestamp of secret generation/last rotation.";77 default = null;78 };79 expiresAt = mkOption {80 type = nullOr str;81 description = "Expiration timestamp triggering mandatory secret rotation.";82 default = null;83 };84 shared = mkOption {85 type = bool;86 description = "Indicates if secret is a shared secret, so other hosts might have the same piece of secret data.";87 default = false;88 };89 generationData = mkOption {90 type = unspecified;91 description = "Contextual metadata associated with secret part.";92 default = null;93 };94 };95 config = { };96 };97 managerKey = {98 options = {99 name = mkOption {100 type = str;101 description = "Who does this manager key belongs to.";102 };103 key = mkOption {104 type = str;105 description = "Age-compatible key";106 };107 };108 config = { };109 };110in111{112 options.data = mkDataOption (113 { config, ... }:114 {115 options = {116 managerKeys = mkOption {117 type = listOf (submodule managerKey);118 };119 sharedSecrets = mkOption {120 type = attrsOf (submodule sharedSecretData);121 default = { };122 description = "Shared secret data.";123 };124 hostSecrets = mkOption {125 type = attrsOf (attrsOf (submodule hostSecretData));126 default = { };127 description = "Host-specific secrets.";128 internal = true;129 };130 };131 config.hostSecrets =132 let133 hostsWithSharedSecrets = unique (134 concatLists (mapAttrsToList (_: s: s.owners) config.sharedSecrets)135 );136 secretsHavingHost = host: filterAttrs (_: secret: lib.elem host secret.owners) config.sharedSecrets;137 toHostSecret = _: secret: (removeAttrs secret [ "owners" ]) // { shared = true; };138 in139 genAttrs hostsWithSharedSecrets (host: mapAttrs toHostSecret (secretsHavingHost host));140 }141 );142 config = {143 assertions =144 (mapAttrsToList (name: secret: {145 assertion =146 secret.expectedOwners == null147 ||148 sort (a: b: a < b) (config.data.sharedSecrets.${name} or { owners = [ ]; }).owners149 == sort (a: b: a < b) secret.expectedOwners;150 message = "Shared secret ${name} is expected to be encrypted for ${toJSON secret.expectedOwners}, but it is encrypted for ${151 toJSON (config.data.sharedSecrets.${name} or { owners = [ ]; }).owners152 }. Run fleet secrets regenerate to fix";153 }) config.sharedSecrets)154 ++ (mapAttrsToList (name: secret: {155 156 assertion =157 (config.data.sharedSecrets.${name} or { generationData = null; }).generationData158 == secret.expectedGenerationData;159 message = "Shared secret ${name} has unexpected generation data ${toJSON secret.expectedGenerationData} != ${160 toJSON (config.data.sharedSecrets.${name} or { generationData = null; }).generationData161 }. Run fleet secrets regenerate to fix";162 }) config.sharedSecrets);163 sharedSecrets = mapAttrs (_: _: { }) config.data.sharedSecrets;164 };165}