git.delta.rocks / jrsonnet / refs/commits / 5a5b360a3403

1{2  lib,3  ...4}:5let6  inherit (lib.options) mkOption literalExpression;7  inherit (lib.types)8    unspecified9    nullOr10    listOf11    str12    bool13    attrsOf14    submodule15    functionTo16    package17    uniq18    ;19  inherit (lib.strings) concatStringsSep;2021  sharedSecret =22    { config, ... }:23    {24      options = {25        expectedOwners = mkOption {26          type = nullOr (listOf str);27          description = ''28            Specifies the list of hosts authorized to decrypt and access this shared secret.2930            When null, secret ownership is managed manually via fleet.nix and CLI.31            Decrypted secrets will be stored at /run/secrets/$\{name} on authorized hosts.32          '';33          default = null;34        };35        regenerateOnOwnerAdded = mkOption {36          type = bool;37          description = ''38            Controls whether the secret must be regenerated when new owners are added.3940            Set to true when the secret contains owner-specific references (e.g., X.509 Subject Alternative Names).41            When true, adding a new owner will trigger secret regeneration instead of simple re-encryption.42          '';43        };44        regenerateOnOwnerRemoved = mkOption {45          default = config.regenerateOnOwnerAdded;46          defaultText = literalExpression "regenerateOnOwnerAdded";47          type = bool;48          description = ''49            Determines secret behavior when owners are removed from the configuration.5051            Typically mirrors regenerateOnOwnerAdded. Override cautiously.52            Set to false if host permissions are revoked through alternative mechanisms like firewall rules.53          '';54        };55        allowDifferent = mkOption {56          type = bool;57          description = ''58            When adding owner, do not update secret value for other owners, instead creating a new distribution59          '';60        };61        generator = mkOption {62          type = uniq (nullOr (functionTo package));63          description = ''64            Function evaluating to nix derivation responsible for (re)generating the secret's content.6566            An input to this function - `pkgs` of a generator host with implementation-defined representation of extra encryption data,67            use `mkSecretGenerator` helpers to implement own generators.68          '';69          default = null;70        };71        expectedGenerationData = mkOption {72          type = unspecified;73          description = "Contextual metadata embedded within the secret part value";74          default = null;75        };76        expectedPrivateParts = mkOption {77          type = listOf str;78          default = [ ];79          description = "List of parts that are expected to be encrypted";80        };81        expectedPublicParts = mkOption {82          type = listOf str;83          default = [ ];84          description = "List of parts that are expected to be public";85        };86      };87    };88in89{90  options = {91    secrets = mkOption {92      type = attrsOf (submodule sharedSecret);93      default = { };94      description = "Collection of secrets shared across multiple hosts with configurable ownership";95    };96  };97  config = {98    nixpkgs.overlays = [99      (final: prev: {100        mkSecretGenerators =101          { recipients }:102          rec {103            # TODO: Merge both generators to one with consistent options syntax?104            # Impure generator is built on local machine, then built closure is copied to remote machine,105            # and then it is ran in inpure context, so that this generator may access HSMs and other things.106            mkImpureSecretGenerator =107              {108                script,109                # If set - script will be run on remote machine, otherwise it will be run with fleet project in CWD110                # (Some secrets-encryption-in-git/managed PKI solution is expected)111                impureOn ? null,112                parts,113              }:114              (prev.writeShellScript "impureGenerator.sh" ''115                #!/bin/sh116                set -eu117118                export GENERATOR_HELPER_IDENTITIES="${concatStringsSep "\n" recipients}";119                export PATH=${final.fleet-generator-helper}/bin:$PATH120121                # TODO: Provide tempdir from outside, to make it securely erasurable as needed?122                tmp=$(mktemp -d)123                cd $tmp124                # cd /var/empty125126                created_at=$(date -u +"%Y-%m-%dT%H:%M:%S.%NZ")127128                ${script}129130                if ! test -d $out; then131                  echo "impure generator script did not produce expected \$out output"132                  exit 1133                fi134135                echo -n $created_at > $out/created_at136                echo -n SUCCESS > $out/marker137              '').overrideAttrs138                (old: {139                  passthru = {140                    inherit impureOn parts;141                    generatorKind = "impure";142                  };143                });144            # Pure generators are disabled for now145            mkSecretGenerator = { script, parts }: mkImpureSecretGenerator { inherit script parts; };146147            # TODO: Implement consistent naming148            # Pure secret generator is supposed to be run entirely by nix, using `__impure` derivation type...149            # But for now, it is ran the same way as `impureSecretGenerator`, but on the local machine.150            # mkSecretGenerator = {script}:151            #   (prev.writeShellScript "generator.sh" ''152            #     #!/bin/sh153            #     set -eu154            #     # TODO: make nix daemon build secret, not just the script.155            #     cd /var/empty156            #157            #     created_at=$(date -u +"%Y-%m-%dT%H:%M:%S.%NZ")158            #159            #     ${script}160            #     if ! test -d $out; then161            #       echo "impure generator script did not produce expected \$out output"162            #       exit 1163            #     fi164            #165            #     echo -n $created_at > $out/created_at166            #     echo -n SUCCESS > $out/marker167            #   '')168            #   .overrideAttrs (old: {169            #     passthru = {170            #       generatorKind = "pure";171            #     };172            #     # TODO: make nix daemon build secret, not just the script.173            #     # __impure = true;174            #   });175          };176      })177    ];178  };179}