1{2 lib,3 fleetLib,4 config,5 ...6}:7let8 inherit (fleetLib.options) mkDataOption;9 inherit (lib.options) mkOption;10 inherit (lib.types)11 nullOr12 listOf13 str14 attrsOf15 submodule16 bool17 unspecified18 ;19 inherit (lib.attrsets)20 mapAttrsToList21 mapAttrs22 filterAttrs23 genAttrs24 ;25 inherit (lib.lists) sort unique concatLists;26 inherit (lib.strings) toJSON;2728 secretDataValue = {29 options = {30 raw = mkOption {31 type = nullOr str;32 description = "Raw secret data in unspecified encoded and optionally encrypted format.";33 default = null;34 };35 };36 };3738 sharedSecretData = {39 freeformType = attrsOf (submodule secretDataValue);40 options = {41 managed = mkOption {42 type = nullOr bool;43 description = "Is current fleet data value is generated by generator";44 default = null;45 };4647 createdAt = mkOption {48 type = str;49 description = "Timestamp of secret generation/last rotation.";50 default = null;51 };52 expiresAt = mkOption {53 type = nullOr str;54 description = "Expiration timestamp triggering mandatory secret rotation.";55 default = null;56 };5758 owners = mkOption {59 type = listOf str;60 description = ''61 List of hosts currently authorized to decrypt this shared secret.6263 If owners differ from expected owners, the secret is considered outdated64 and requires regeneration or re-encryption.65 '';66 default = [ ];67 };68 generationData = mkOption {69 type = unspecified;70 description = "Contextual metadata associated with secret part.";71 default = null;72 };73 };74 config = { };75 };7677 hostSecretData = {78 freeformType = attrsOf (submodule secretDataValue);79 options = {80 createdAt = mkOption {81 type = str;82 description = "Timestamp of secret generation/last rotation.";83 default = null;84 };85 expiresAt = mkOption {86 type = nullOr str;87 description = "Expiration timestamp triggering mandatory secret rotation.";88 default = null;89 };90 shared = mkOption {91 type = bool;92 description = "Indicates if secret is a shared secret, so other hosts might have the same piece of secret data.";93 default = false;94 };95 generationData = mkOption {96 type = unspecified;97 description = "Contextual metadata associated with secret part.";98 default = null;99 };100 };101 config = { };102 };103 managerKey = {104 options = {105 name = mkOption {106 type = str;107 description = "Who does this manager key belongs to.";108 };109 key = mkOption {110 type = str;111 description = "Age-compatible key";112 };113 };114 config = { };115 };116in117{118 options.data = mkDataOption ({ config, ... }:119 {120 options = {121 managerKeys = mkOption {122 type = listOf (submodule managerKey);123 };124 sharedSecrets = mkOption {125 type = attrsOf (submodule sharedSecretData);126 default = { };127 description = "Shared secret data.";128 };129 hostSecrets = mkOption {130 type = attrsOf (attrsOf (submodule hostSecretData));131 default = { };132 description = "Host-specific secrets.";133 internal = true;134 };135 };136 config.hostSecrets =137 let138 hostsWithSharedSecrets = unique (139 concatLists (mapAttrsToList (_: s: s.owners) config.sharedSecrets)140 );141 secretsHavingHost = host: filterAttrs (_: secret: lib.elem host secret.owners) config.sharedSecrets;142 toHostSecret = _: secret: (removeAttrs secret [ "owners" ]) // { shared = true; };143 in144 genAttrs hostsWithSharedSecrets (host: mapAttrs toHostSecret (secretsHavingHost host));145 });146 config = {147 assertions =148 (mapAttrsToList (name: secret: {149 assertion =150 secret.expectedOwners == null151 ||152 sort (a: b: a < b) (config.data.sharedSecrets.${name} or { owners = [ ]; }).owners153 == sort (a: b: a < b) secret.expectedOwners;154 message = "Shared secret ${name} is expected to be encrypted for ${toJSON secret.expectedOwners}, but it is encrypted for ${155 toJSON (config.data.sharedSecrets.${name} or { owners = [ ]; }).owners156 }. Run fleet secrets regenerate to fix";157 }) config.sharedSecrets)158159 ++ (mapAttrsToList (name: secret: {160 161 assertion =162 (config.data.sharedSecrets.${name} or { generationData = null; }).generationData163 == secret.expectedGenerationData;164 message = "Shared secret ${name} has unexpected generation data ${toJSON secret.expectedGenerationData} != ${165 toJSON (config.data.sharedSecrets.${name} or { generationData = null; }).generationData166 }. Run fleet secrets regenerate to fix";167 }) config.sharedSecrets);168 };169}