difftreelog
fix mkAskPass should create out
in: trunk
1 file changed
lib/default.nixdiffbeforeafterboth1# Shared functions for fleet configuration, available as `fleet` module argument2{ lib }:3let4 inherit (lib.trivial) isFunction functionArgs;5 inherit (lib.options) mkOption mergeOneOption;6 inherit (lib.modules) mkOverride;7 inherit (lib.types)8 listOf9 submodule10 attrsOf11 mkOptionType12 ;13 inherit (lib.strings) optionalString hasPrefix removePrefix;14in15rec {16 types = {17 overlay = mkOptionType {18 name = "nixpkgs-overlay";19 description = "nixpkgs overlay";20 check = {21 __functor = _self: isFunction;22 isV2MergeCoherent = true;23 };24 merge = mergeOneOption;25 };26 listOfOverlay = listOf types.overlay;2728 mkHostsType = module: attrsOf (submodule module);29 mkDataType = module: submodule module;30 };3132 options = {33 mkHostsOption =34 module:35 mkOption {36 type = types.mkHostsType module;37 };38 mkDataOption =39 module:40 mkOption {41 type = types.mkDataType module;42 };43 };4445 inherit (options) mkHostsOption;4647 modules = {48 /**49 Use in places, where fleet might know better than nixpkgs defaults to50 */51 mkFleetDefault = mkOverride 999;52 /**53 Some generators use mkDefault, but optionDefault is set by nixpkgs.54 */55 mkFleetGeneratorDefault = mkOverride 1001;56 };5758 inherit (modules) mkFleetDefault mkFleetGeneratorDefault;5960 secrets = {6162 /**63 Generate a random secret password, 32 ascii characters by default6465 Options:66 size: generated password length in ascii characters (bytes).67 noSymbols: by default, character set includes various special characters ($ , ! + * : ~), and might68 not be accepted in some contexts, this option switches charset to just [A-Za-z0-9].6970 Output:71 Resulting secret has only part: secret, which contains encrypted password.72 */73 mkPassword =74 {75 size ? 32,76 }:77 (78 {79 coreutils,80 mkSecretGenerator,81 }:82 mkSecretGenerator {83 script = ''84 mkdir $out85 gh generate password -o $out/secret --size ${toStringsize}86 '';87 parts.secret.encrypted = true;88 }89 );9091 /**92 Generate a random ed25519 keypair9394 Options:95 noEmbedPublic: By default, secret key also embeds public key in itself ("extended" format, 64 bytes)96 When noEmbedPublis is enabled - only the private scalar is included.97 encoding: Encoring of public and secret parts, can be "raw" (default), "base64" or "hex".9899 Output:100 Resulting secret has two parts: public and secret, where the secret part is encrypted.101102 This secret format is used by e.g Garage S3 server103 */104 mkEd25519 =105 {106 noEmbedPublic ? false,107 encoding ? null,108 }:109 (110 { mkSecretGenerator }:111 mkSecretGenerator {112 script = ''113 mkdir $out114 gh generate ed25519 -p $out/public -s $out/secret \115 ${optionalStringnoEmbedPublic"--no-embed-public"} \116 ${optionalString(encoding!=null)"--encoding=${encoding}"}117 '';118 parts.secret.encrypted = true;119 parts.public.encrypted = false;120 }121 );122123 /**124 Generate a random x25519 keypair125126 Options:127 encoding: Encoring of public and secret parts, can be "raw" (default), "base64" or "hex".128129 Output:130 Resulting secret has two parts: public and secret, where the secret part is encrypted.131132 This secret format is used by e.g Wireguard VPN for peers (base64-encoded)133 */134 mkX25519 =135 {136 encoding ? null,137 }:138 (139 { mkSecretGenerator }:140 mkSecretGenerator {141 script = ''142 mkdir $out143 gh generate x25519 -p $out/public -s $out/secret \144 ${optionalString(encoding!=null)"--encoding=${encoding}"}145 '';146147 parts.secret.encrypted = true;148 parts.public.encrypted = false;149 }150 );151152 mkAskPass =153 {154 prompt ? "Secret value",155 part ? "secret",156 }:157 (158 {159 kdePackages,160 mkImpureSecretGenerator,161 }:162 mkImpureSecretGenerator {163 # TODO: Escape prompt/part (preferrably just use env) to prevent shell injection164 script = ''165 mkdir $out166 ${kdePackages.kdialog}/bin/kdialog --inputbox "${prompt}" | gh private -o $out/${part}167 '';168169 parts.${part}.encrypted = true;170 }171 );172173 /**174 Generate a random RSA keypair175176 Options:177 size: RSA key size, 4096 by default178179 Output:180 Resulting secret has two parts: public and secret, where the secret part is encrypted.181 Both parts are PEM encoded.182 */183 mkRsa =184 {185 size ? 4096,186 }:187 (188 {189 openssl,190 mkSecretGenerator,191 }:192 mkSecretGenerator {193 script = ''194 mkdir $out195196 ${openssl}/bin/openssl genrsa -out rsa_private.key ${toStringsize}197 ${openssl}/bin/openssl rsa -in rsa_private.key -pubout -out rsa_public.key198199 cat rsa_private.key | gh private -o $out/secret200 cat rsa_public.key | gh public -o $out/public201 '';202203 parts.secret.encrypted = true;204 parts.public.encrypted = false;205 }206 );207208 /**209 Generate a random byte sequence210211 Options:212 size: generated password length in bytes, 32 by default.213 encoding: how the generated bytes should be encoded, "raw" (default), "hex" or "base64"214 noNuls: prevent output byte sequence from containing internal \0, useful for some C applications215 that can't handle their strings properly.216217 Output:218 Resulting secret has only part: secret, which contains encrypted bytes.219220 Might be used for e.g. Wireguard VPN PSK keys (base64-encoded)221 */222 mkBytes =223 {224 count ? 32,225 encoding,226 noNuls ? false,227 }:228 (229 { mkSecretGenerator }:230 mkSecretGenerator {231 script = ''232 mkdir $out233 gh generate bytes --count=${toStringcount} --encoding=${encoding} -o $out/secret \234 ${optionalStringnoNuls"--no-nuls"}235 '';236 parts.secret.encrypted = true;237 }238 );239 /**240 Shorthand for `mkBytes`, which defaults to "hex" encoding241 */242 mkHexBytes =243 {244 count ? 32,245 }:246 mkBytes {247 inherit count;248 encoding = "hex";249 };250 /**251 Shorthand for `mkBytes`, which defaults to "base64" encoding252 */253 mkBase64Bytes =254 {255 count ? 32,256 }:257 mkBytes {258 inherit count;259 encoding = "base64";260 };261262 # Wireguard263 # mkWireguard = {}: mkX25519 {encoding = "base64";};264 # mkWireguardPsk = {}: mkBase64Bytes {count = 32;};265 };266267 inherit (secrets)268 mkPassword269 mkEd25519270 mkX25519271 mkRsa272 mkBytes273 mkHexBytes274 mkBase64Bytes275 mkAskPass276 ;277278 strings =279 let280 plaintextPrefix = "<PLAINTEXT>";281 plaintextNewlinePrefix = "<PLAINTEXT-NL>";282 in283 {284 /**285 Decode public secret part into string286 */287 decodeRawSecret =288 raw:289 if hasPrefix plaintextPrefix raw then290 removePrefix plaintextPrefix raw291 else if hasPrefix plaintextNewlinePrefix raw then292 removePrefix plaintextNewlinePrefix raw293 else294 throw "decodeRawSecret only works with plaintext-encoded secret public parts, got ${raw}";295 };296297 inherit (strings) decodeRawSecret;298}