git.delta.rocks / jrsonnet / refs/commits / c007b07c706f

1{ lib, config, pkgs, ... }: with lib;2let3  sysConfig = config;4  secretType = types.submodule ({ config, ... }: {5    config = {6      path = mkOptionDefault (if config.secret == null then (error "secret is not set") else "/run/secrets/${config._module.args.name}");7      publicPath = mkOptionDefault (pkgs.writeText "pub-${config._module.args.name}" config.public);8    };9    options = {10      public = mkOption {11        type = types.nullOr types.str;12        description = "Secret public data";13        default = null;14      };15      secret = mkOption {16        type = types.nullOr types.str;17        description = "Encrypted secret data";18        default = null;19      };20      mode = mkOption {21        type = types.str;22        description = "Secret mode";23        default = "0440";24      };25      owner = mkOption {26        type = types.str;27        description = "Owner of the secret";28        default = "root";29      };30      group = mkOption {31        type = types.str;32        description = "Group of the secret";33        default = sysConfig.users.users.${config.owner}.group;34      };3536      path = mkOption {37        type = types.str;38        readOnly = true;39        description = "Path to the decrypted secret";40      };41      publicPath = mkOption {42        type = types.package;43        readOnly = true;44        description = "Path to the public part of secret";45      };46    };47  });48  secretsFile = pkgs.writeTextFile {49    name = "secrets.json";50    text = builtins.toJSON config.secrets;51  };52in53{54  options = {55    secrets = mkOption {56      type = types.attrsOf secretType;57      default = { };58      description = "Host-local secrets";59    };60  };61  config = {62    system.activationScripts.decryptSecrets = ''63      1>&2 echo "setting up secrets"64      ${pkgs.fleet-install-secrets}/bin/fleet-install-secrets ${secretsFile}65    '';66  };67}