1{2 lib,3 fleetLib,4 config,5 ...6}:7let8 inherit (fleetLib.options) mkDataOption;9 inherit (lib.options) mkOption;10 inherit (lib.types)11 nullOr12 listOf13 str14 attrsOf15 submodule16 bool17 unspecified18 ;19 inherit (lib.attrsets)20 mapAttrsToList21 mapAttrs22 filterAttrs23 genAttrs24 ;25 inherit (lib.lists) sort unique concatLists;26 inherit (lib.strings) toJSON;2728 secretDataValue = {29 options = {30 raw = mkOption {31 type = nullOr str;32 description = "Raw secret data in unspecified encoded and optionally encrypted format.";33 default = null;34 };35 };36 };3738 sharedSecretData = {39 freeformType = attrsOf (submodule secretDataValue);40 options = {41 managed = mkOption {42 type = nullOr bool;43 description = "Is current fleet data value is generated by generator";44 default = null;45 };4647 createdAt = mkOption {48 type = str;49 description = "Timestamp of secret generation/last rotation.";50 default = null;51 };52 expiresAt = mkOption {53 type = nullOr str;54 description = "Expiration timestamp triggering mandatory secret rotation.";55 default = null;56 };5758 owners = mkOption {59 type = listOf str;60 description = ''61 List of hosts currently authorized to decrypt this shared secret.6263 If owners differ from expected owners, the secret is considered outdated64 and requires regeneration or re-encryption.65 '';66 default = [ ];67 };68 generationData = mkOption {69 type = unspecified;70 description = "Contextual metadata associated with secret part.";71 default = null;72 };73 };74 config = { };75 };7677 hostSecretData = {78 freeformType = attrsOf (submodule secretDataValue);79 options = {80 createdAt = mkOption {81 type = str;82 description = "Timestamp of secret generation/last rotation.";83 default = null;84 };85 expiresAt = mkOption {86 type = nullOr str;87 description = "Expiration timestamp triggering mandatory secret rotation.";88 default = null;89 };90 shared = mkOption {91 type = bool;92 description = "Indicates if secret is a shared secret, so other hosts might have the same piece of secret data.";93 default = false;94 };95 generationData = mkOption {96 type = unspecified;97 description = "Contextual metadata associated with secret part.";98 default = null;99 };100 };101 config = { };102 };103 managerKey = {104 options = {105 name = mkOption {106 type = str;107 description = "Who does this manager key belongs to.";108 };109 key = mkOption {110 type = str;111 description = "Age-compatible key";112 };113 };114 config = { };115 };116in117{118 options.data = mkDataOption (119 { config, ... }:120 {121 options = {122 managerKeys = mkOption {123 type = listOf (submodule managerKey);124 };125 sharedSecrets = mkOption {126 type = attrsOf (submodule sharedSecretData);127 default = { };128 description = "Shared secret data.";129 };130 hostSecrets = mkOption {131 type = attrsOf (attrsOf (submodule hostSecretData));132 default = { };133 description = "Host-specific secrets.";134 internal = true;135 };136 };137 config.hostSecrets =138 let139 hostsWithSharedSecrets = unique (140 concatLists (mapAttrsToList (_: s: s.owners) config.sharedSecrets)141 );142 secretsHavingHost = host: filterAttrs (_: secret: lib.elem host secret.owners) config.sharedSecrets;143 toHostSecret = _: secret: (removeAttrs secret [ "owners" ]) // { shared = true; };144 in145 genAttrs hostsWithSharedSecrets (host: mapAttrs toHostSecret (secretsHavingHost host));146 }147 );148 config = {149 assertions =150 (mapAttrsToList (name: secret: {151 assertion =152 secret.expectedOwners == null153 ||154 sort (a: b: a < b) (config.data.sharedSecrets.${name} or { owners = [ ]; }).owners155 == sort (a: b: a < b) secret.expectedOwners;156 message = "Shared secret ${name} is expected to be encrypted for ${toJSON secret.expectedOwners}, but it is encrypted for ${157 toJSON (config.data.sharedSecrets.${name} or { owners = [ ]; }).owners158 }. Run fleet secrets regenerate to fix";159 }) config.sharedSecrets)160161 ++ (mapAttrsToList (name: secret: {162 163 assertion =164 (config.data.sharedSecrets.${name} or { generationData = null; }).generationData165 == secret.expectedGenerationData;166 message = "Shared secret ${name} has unexpected generation data ${toJSON secret.expectedGenerationData} != ${167 toJSON (config.data.sharedSecrets.${name} or { generationData = null; }).generationData168 }. Run fleet secrets regenerate to fix";169 }) config.sharedSecrets);170 };171}