difftreelog
feat use builtin for getting secret
in: trunk
12 files changed
Cargo.lockdiffbeforeafterboth722source = "registry+https://github.com/rust-lang/crates.io-index"722source = "registry+https://github.com/rust-lang/crates.io-index"723checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"723checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"724725[[package]]726name = "convert_case"727version = "0.7.1"728source = "registry+https://github.com/rust-lang/crates.io-index"729checksum = "bb402b8d4c85569410425650ce3eddc7d698ed96d39a73f941b08fb63082f1e7"730dependencies = [731 "unicode-segmentation",732]733724734[[package]]725[[package]]735name = "cookie-factory"726name = "cookie-factory"764 "cfg-if",755 "cfg-if",765]756]766767[[package]]768name = "crossterm"769version = "0.29.0"770source = "registry+https://github.com/rust-lang/crates.io-index"771checksum = "d8b9f2e4c67f833b660cdb0a3523065869fb35570177239812ed4c905aeff87b"772dependencies = [773 "bitflags",774 "crossterm_winapi",775 "derive_more",776 "document-features",777 "filedescriptor",778 "mio",779 "parking_lot",780 "rustix 1.1.2",781 "signal-hook",782 "signal-hook-mio",783 "winapi",784]785786[[package]]787name = "crossterm_winapi"788version = "0.9.1"789source = "registry+https://github.com/rust-lang/crates.io-index"790checksum = "acdd7c62a3665c7f6830a51635d9ac9b23ed385797f70a83bb8bafe9c572ab2b"791dependencies = [792 "winapi",793]794757795[[package]]758[[package]]796name = "crypto-common"759name = "crypto-common"934 "serde_core",897 "serde_core",935]898]936937[[package]]938name = "derive_more"939version = "2.0.1"940source = "registry+https://github.com/rust-lang/crates.io-index"941checksum = "093242cf7570c207c83073cf82f79706fe7b8317e98620a47d5be7c3d8497678"942dependencies = [943 "derive_more-impl",944]945946[[package]]947name = "derive_more-impl"948version = "2.0.1"949source = "registry+https://github.com/rust-lang/crates.io-index"950checksum = "bda628edc44c4bb645fbe0f758797143e4e07926f7ebf4e9bdfbd3d2ce621df3"951dependencies = [952 "convert_case",953 "proc-macro2",954 "quote",955 "syn",956]957899958[[package]]900[[package]]959name = "digest"901name = "digest"978 "syn",920 "syn",979]921]980981[[package]]982name = "document-features"983version = "0.2.11"984source = "registry+https://github.com/rust-lang/crates.io-index"985checksum = "95249b50c6c185bee49034bcb378a49dc2b5dff0be90ff6616d31d64febab05d"986dependencies = [987 "litrs",988]989922990[[package]]923[[package]]991name = "ed25519"924name = "ed25519"1072source = "registry+https://github.com/rust-lang/crates.io-index"1005source = "registry+https://github.com/rust-lang/crates.io-index"1073checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"1006checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"10741075[[package]]1076name = "filedescriptor"1077version = "0.8.3"1078source = "registry+https://github.com/rust-lang/crates.io-index"1079checksum = "e40758ed24c9b2eeb76c35fb0aebc66c626084edd827e07e1552279814c6682d"1080dependencies = [1081 "libc",1082 "thiserror 1.0.69",1083 "winapi",1084]108510071086[[package]]1008[[package]]1087name = "find-crate"1009name = "find-crate"1128 "chrono",1050 "chrono",1129 "clap",1051 "clap",1130 "clap_complete",1052 "clap_complete",1131 "crossterm",1132 "fleet-base",1053 "fleet-base",1133 "fleet-shared",1054 "fleet-shared",1134 "futures",1055 "futures",1142 "openssh",1063 "openssh",1143 "opentelemetry",1064 "opentelemetry",1144 "opentelemetry_sdk",1065 "opentelemetry_sdk",1145 "owo-colors",1146 "peg",1066 "peg",1147 "regex",1067 "regex",1148 "serde",1068 "serde",1502source = "registry+https://github.com/rust-lang/crates.io-index"1422source = "registry+https://github.com/rust-lang/crates.io-index"1503checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"1423checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"15041505[[package]]1506name = "hermit-abi"1507version = "0.5.2"1508source = "registry+https://github.com/rust-lang/crates.io-index"1509checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"151014241511[[package]]1425[[package]]1512name = "hex"1426name = "hex"1963 "serde",1877 "serde",1964]1878]19651966[[package]]1967name = "is-terminal"1968version = "0.4.16"1969source = "registry+https://github.com/rust-lang/crates.io-index"1970checksum = "e04d7f318608d35d4b61ddd75cbdaee86b023ebe2bd5a66ee0915f0bf93095a9"1971dependencies = [1972 "hermit-abi",1973 "libc",1974 "windows-sys 0.59.0",1975]19761977[[package]]1978name = "is_ci"1979version = "1.2.0"1980source = "registry+https://github.com/rust-lang/crates.io-index"1981checksum = "7655c9839580ee829dfacba1d1278c2b7883e50a277ff7541299489d6bdfdc45"198218791983[[package]]1880[[package]]1984name = "is_terminal_polyfill"1881name = "is_terminal_polyfill"2084source = "registry+https://github.com/rust-lang/crates.io-index"1981source = "registry+https://github.com/rust-lang/crates.io-index"2085checksum = "241eaef5fd12c88705a01fc1066c48c4b36e0dd4377dcdc7ec3942cea7a69956"1982checksum = "241eaef5fd12c88705a01fc1066c48c4b36e0dd4377dcdc7ec3942cea7a69956"20862087[[package]]2088name = "litrs"2089version = "0.4.2"2090source = "registry+https://github.com/rust-lang/crates.io-index"2091checksum = "f5e54036fe321fd421e10d732f155734c4e4afd610dd556d9a82833ab3ee0bed"209219832093[[package]]1984[[package]]2094name = "lock_api"1985name = "lock_api"2161checksum = "78bed444cc8a2160f01cbcf811ef18cac863ad68ae8ca62092e8db51d51c761c"2052checksum = "78bed444cc8a2160f01cbcf811ef18cac863ad68ae8ca62092e8db51d51c761c"2162dependencies = [2053dependencies = [2163 "libc",2054 "libc",2164 "log",2165 "wasi 0.11.1+wasi-snapshot-preview1",2055 "wasi 0.11.1+wasi-snapshot-preview1",2166 "windows-sys 0.59.0",2056 "windows-sys 0.59.0",2167]2057]2427 "thiserror 2.0.17",2317 "thiserror 2.0.17",2428]2318]24292430[[package]]2431name = "owo-colors"2432version = "4.2.3"2433source = "registry+https://github.com/rust-lang/crates.io-index"2434checksum = "9c6901729fa79e91a0913333229e9ca5dc725089d1c363b2f4b4760709dc4a52"2435dependencies = [2436 "supports-color 2.1.0",2437 "supports-color 3.0.2",2438]243923192440[[package]]2320[[package]]2441name = "papergrid"2321name = "papergrid"3336source = "registry+https://github.com/rust-lang/crates.io-index"3216source = "registry+https://github.com/rust-lang/crates.io-index"3337checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"3217checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"33383339[[package]]3340name = "signal-hook"3341version = "0.3.18"3342source = "registry+https://github.com/rust-lang/crates.io-index"3343checksum = "d881a16cf4426aa584979d30bd82cb33429027e42122b169753d6ef1085ed6e2"3344dependencies = [3345 "libc",3346 "signal-hook-registry",3347]33483349[[package]]3350name = "signal-hook-mio"3351version = "0.2.4"3352source = "registry+https://github.com/rust-lang/crates.io-index"3353checksum = "34db1a06d485c9142248b7a054f034b349b212551f3dfd19c94d45a754a217cd"3354dependencies = [3355 "libc",3356 "mio",3357 "signal-hook",3358]335932183360[[package]]3219[[package]]3361name = "signal-hook-registry"3220name = "signal-hook-registry"3448source = "registry+https://github.com/rust-lang/crates.io-index"3307source = "registry+https://github.com/rust-lang/crates.io-index"3449checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"3308checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"34503451[[package]]3452name = "supports-color"3453version = "2.1.0"3454source = "registry+https://github.com/rust-lang/crates.io-index"3455checksum = "d6398cde53adc3c4557306a96ce67b302968513830a77a95b2b17305d9719a89"3456dependencies = [3457 "is-terminal",3458 "is_ci",3459]34603461[[package]]3462name = "supports-color"3463version = "3.0.2"3464source = "registry+https://github.com/rust-lang/crates.io-index"3465checksum = "c64fc7232dd8d2e4ac5ce4ef302b1d81e0b80d055b9d77c7c4f51f6aa4c867d6"3466dependencies = [3467 "is_ci",3468]346933093470[[package]]3310[[package]]3471name = "syn"3311name = "syn"4169source = "registry+https://github.com/rust-lang/crates.io-index"4009source = "registry+https://github.com/rust-lang/crates.io-index"4170checksum = "f63a545481291138910575129486daeaf8ac54aee4387fe7906919f7830c7d9d"4010checksum = "f63a545481291138910575129486daeaf8ac54aee4387fe7906919f7830c7d9d"41714172[[package]]4173name = "unicode-segmentation"4174version = "1.12.0"4175source = "registry+https://github.com/rust-lang/crates.io-index"4176checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"417740114178[[package]]4012[[package]]4179name = "unicode-width"4013name = "unicode-width"4450 "rustix 0.38.44",4284 "rustix 0.38.44",4451]4285]44524453[[package]]4454name = "winapi"4455version = "0.3.9"4456source = "registry+https://github.com/rust-lang/crates.io-index"4457checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"4458dependencies = [4459 "winapi-i686-pc-windows-gnu",4460 "winapi-x86_64-pc-windows-gnu",4461]44624463[[package]]4464name = "winapi-i686-pc-windows-gnu"4465version = "0.4.0"4466source = "registry+https://github.com/rust-lang/crates.io-index"4467checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"446842864469[[package]]4287[[package]]4470name = "winapi-util"4288name = "winapi-util"4475 "windows-sys 0.61.2",4293 "windows-sys 0.61.2",4476]4294]44774478[[package]]4479name = "winapi-x86_64-pc-windows-gnu"4480version = "0.4.0"4481source = "registry+https://github.com/rust-lang/crates.io-index"4482checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"448342954484[[package]]4296[[package]]4485name = "windows-core"4297name = "windows-core"README.adocdiffbeforeafterboth--- a/README.adoc
+++ b/README.adoc
@@ -211,7 +211,7 @@
];
# And finally, I have secrets, which are shared between machines.
# Note that this example is somewhat wrong, as this goes not into the machine configuration, but to fleet configuration.
- sharedSecrets = {
+ secrets = {
"ca.pem" = {
# This is just the public key, no need to regenerate it to change owner list
regenerateOnOwnerAdded = false;
cmds/fleet/Cargo.tomldiffbeforeafterboth--- a/cmds/fleet/Cargo.toml
+++ b/cmds/fleet/Cargo.toml
@@ -28,12 +28,10 @@
async-trait = "0.1"
base64 = "0.22.1"
chrono = { version = "0.4", features = ["serde"] }
-crossterm = { version = "0.29.0", features = ["use-dev-tty"] }
futures = "0.3"
hostname = "0.4.1"
itertools = "0.14"
openssh = "0.11"
-owo-colors = { version = "4.2", features = ["supports-color", "supports-colors"] }
peg = "0.8"
regex = "1.11"
shlex = "1.3"
cmds/fleet/src/cmds/secrets/mod.rsdiffbeforeafterboth--- a/cmds/fleet/src/cmds/secrets/mod.rs
+++ b/cmds/fleet/src/cmds/secrets/mod.rs
@@ -11,11 +11,10 @@
fleetdata::{FleetSecretData, FleetSecretDistribution, FleetSecretPart, encrypt_secret_data},
host::Config,
opts::FleetOpts,
- secret::{Expectations, RegenerationReason, SharedSecretDefinition, secret_needs_regeneration},
+ secret::{Expectations, RegenerationReason, secret_needs_regeneration},
};
use fleet_shared::SecretData;
use nix_eval::{NixType, Value, nix_go, nix_go_json};
-use owo_colors::OwoColorize;
use serde::Deserialize;
use tabled::{Table, Tabled};
use tokio::{fs::read, task::spawn_blocking};
@@ -69,6 +68,7 @@
},
}
+/*
#[allow(clippy::too_many_arguments)]
#[tracing::instrument(skip(config, secret, definition, prefer_identities))]
async fn maybe_regenerate_shared_secret(
@@ -143,6 +143,7 @@
Ok(secret)
}
}
+*/
#[derive(Deserialize)]
#[serde(rename_all = "camelCase")]
@@ -314,6 +315,7 @@
}
}
}
+/*
async fn generate_shared(
config: &Config,
display_name: &str,
@@ -332,7 +334,7 @@
.await?,
owners: expectations.owners.clone(),
})
-}
+}*/
async fn parse_public(
public: Option<String>,
@@ -625,10 +627,11 @@
#[tabled(rename = "Owners")]
owners: String,
}
- let mut table = vec![];
+ // let mut table = vec![];
for name in configured.iter().cloned() {
let config = config.clone();
let data = config.shared_secret(&name).expect("exists");
+ /*
let definition = config.shared_secret_definition(&name)?;
let expectations = definition.expectations()?;
let owners = data
@@ -645,8 +648,9 @@
owners: owners.join(", "),
name,
})
+*/
}
- info!("loaded\n{}", Table::new(table).to_string())
+ // info!("loaded\n{}", Table::new(table).to_string())
}
Secret::Edit {
name,
crates/fleet-base/src/host.rsdiffbeforeafterboth--- a/crates/fleet-base/src/host.rs
+++ b/crates/fleet-base/src/host.rs
@@ -23,7 +23,6 @@
use crate::{
command::MyCommand,
fleetdata::{FleetData, FleetSecretData, FleetSecretDistribution, FleetSecretDistributions},
- secret::{HostSecretDefinition, SharedSecretDefinition},
};
pub struct FleetConfigInternals {
@@ -31,7 +30,7 @@
pub directory: PathBuf,
/// builtins.currentSystem
pub local_system: String,
- pub data: Mutex<FleetData>,
+ pub data: Arc<Mutex<FleetData>>,
pub nix_args: Vec<OsString>,
/// fleet_config.config
pub config_field: Value,
@@ -520,13 +519,6 @@
let nixos = self.nixos_unchecked_config()?;
let secrets = nix_go!(nixos.secrets);
secrets.list_fields()
- }
- pub fn secret_definition(&self, name: &str) -> Result<HostSecretDefinition> {
- let nixos = self.nixos_unchecked_config()?;
- Ok(HostSecretDefinition(
- self.name.clone(),
- nix_go!(nixos.secrets[{ name }]),
- ))
}
/// Packages for this host, resolved with nixpkgs overlays
@@ -665,12 +657,6 @@
pub fn shared_secret(&self, secret: &str) -> Option<FleetSecretDistributions> {
let data = self.data();
data.secrets.get(secret).cloned()
- }
- pub fn shared_secret_definition(&self, secret: &str) -> Result<SharedSecretDefinition> {
- let config_field = &self.config_field;
- Ok(SharedSecretDefinition(nix_go!(
- config_field.sharedSecrets[{ secret }]
- )))
}
// TODO: Should this be something modifiable from other processes?
crates/fleet-base/src/opts.rsdiffbeforeafterboth--- a/crates/fleet-base/src/opts.rs
+++ b/crates/fleet-base/src/opts.rs
@@ -211,7 +211,7 @@
}
let bytes =
std::fs::read_to_string(&fleet_data_path).context("reading fleet state (fleet.nix)")?;
- let data = Mutex::new(FleetData::from_str(&bytes)?);
+ let data = Arc::new(Mutex::new(FleetData::from_str(&bytes)?));
let mut fetch_settings = FetchSettings::new();
fetch_settings.set(c"warn-dirty", c"false");
@@ -239,8 +239,7 @@
let builtins_field = Value::eval("builtins")?;
let fleet_root = flake.get_field("fleetConfigurations")?;
- let data_val = Value::serialized(&data)?;
- let fleet_field = nix_go!(fleet_root.default(data_val));
+ let fleet_field = nix_go!(fleet_root.default(Obj {}));
let config_field = nix_go!(fleet_field.config);
crates/fleet-base/src/primops.rsdiffbeforeafterboth--- a/crates/fleet-base/src/primops.rs
+++ b/crates/fleet-base/src/primops.rs
@@ -1,4 +1,9 @@
-use nix_eval::NativeFn;
+use std::collections::HashMap;
+use std::sync::{Arc, Mutex};
+
+use nix_eval::{NativeFn, Value};
+
+use crate::fleetdata::{FleetData, FleetSecrets};
#[derive(thiserror::Error, Debug)]
enum Error {}
@@ -15,30 +20,32 @@
fn host_parts(&self, host: &str, name: &str) -> Parts;
}
-struct FsSecretsBackend {
+struct FsSecretsBackend {}
-}
-
-pub fn init_primops() {
+pub fn init_primops(secrets: Arc<Mutex<FleetData>>) {
NativeFn::new(
- c"fleet_ensure_secret",
+ c"fleet_ensure_host_secret",
c"Ensure secret existence for a host, regenerating it in case of some mismatch",
- [
- c"host",
- c"secret",
- c"expected_parts",
- c"expected_encrypted_parts",
- c"generator",
- ],
- |[
- host,
- secret,
- expected_parts,
- expected_encrypted_parts,
- generator,
- ]| {
-
- todo!()
+ [c"host", c"secret", c"generator"],
+ |[host, secret, generator]| {
+ todo!("ensure secret");
+ Ok(Value::new_attrs(HashMap::from_iter([(
+ "raw",
+ Value::new_str("rawData"),
+ )])))
+ },
+ )
+ .register();
+ NativeFn::new(
+ c"fleet_ensure_host_secret",
+ c"Ensure secret existence for a host, regenerating it in case of some mismatch",
+ [c"host", c"secret", c"generator"],
+ |[host, secret, generator]| {
+ todo!("ensure secret");
+ Ok(Value::new_attrs(HashMap::from_iter([(
+ "raw",
+ Value::new_str("rawData"),
+ )])))
},
)
.register();
crates/fleet-base/src/secret.rsdiffbeforeafterboth--- a/crates/fleet-base/src/secret.rs
+++ b/crates/fleet-base/src/secret.rs
@@ -1,8 +1,6 @@
use std::collections::BTreeSet;
-use anyhow::Result;
use chrono::{DateTime, Utc};
-use nix_eval::{Value, nix_go, nix_go_json};
use crate::fleetdata::FleetSecretData;
@@ -12,63 +10,6 @@
pub generation_data: serde_json::Value,
pub public_parts: BTreeSet<String>,
pub private_parts: BTreeSet<String>,
-}
-
-pub struct HostSecretDefinition(pub(crate) String, pub(crate) Value);
-impl HostSecretDefinition {
- pub fn is_managed(&self) -> Result<bool> {
- let def = self.definition_value()?;
- Ok(!nix_go!(def.generator).is_null())
- }
- pub fn is_shared(&self) -> Result<bool> {
- let def = self.definition_value()?;
- Ok(nix_go_json!(def.shared))
- }
- pub fn expectations(&self) -> Result<Expectations> {
- let def = self.definition_value()?;
- let parts = nix_go!(def.parts);
-
- let mut public_parts = BTreeSet::new();
- let mut private_parts = BTreeSet::new();
- for part in parts.list_fields()? {
- if nix_go_json!(parts[&part].encrypted) {
- private_parts.insert(part.clone());
- } else {
- public_parts.insert(part.clone());
- }
- }
-
- Ok(Expectations {
- owners: BTreeSet::from([self.0.clone()]),
- generation_data: nix_go_json!(def.expectedGenerationData),
- public_parts,
- private_parts,
- })
- }
- pub fn definition_value(&self) -> Result<Value> {
- let value = &self.1;
- Ok(nix_go!(value.definition))
- }
-}
-
-pub struct SharedSecretDefinition(pub(crate) Value);
-impl SharedSecretDefinition {
- pub fn is_managed(&self) -> Result<bool> {
- let value = &self.0;
- Ok(!nix_go!(value.generator).is_null())
- }
- pub fn expectations(&self) -> Result<Expectations> {
- let value = &self.0;
- Ok(Expectations {
- owners: nix_go_json!(value.expectedOwners),
- generation_data: nix_go_json!(value.expectedGenerationData),
- public_parts: nix_go_json!(value.expectedPublicParts),
- private_parts: nix_go_json!(value.expectedPrivateParts),
- })
- }
- pub fn definition_value(&self) -> Value {
- self.0.clone()
- }
}
#[derive(thiserror::Error, Debug)]
modules/module-list.nixdiffbeforeafterboth--- a/modules/module-list.nix
+++ b/modules/module-list.nix
@@ -6,5 +6,4 @@
./nixos.nix
./nixpkgs.nix
./secrets.nix
- ./secrets-data.nix
]
modules/nixos/secrets.nixdiffbeforeafterboth--- a/modules/nixos/secrets.nix
+++ b/modules/nixos/secrets.nix
@@ -8,50 +8,26 @@
let
inherit (builtins)
hashString
- elemAt
- length
toJSON
- filter
;
inherit (lib.stringsWithDeps) stringAfter;
inherit (lib.options) mkOption literalExpression;
inherit (lib.lists) optional;
- inherit (lib.attrsets) mapAttrs mapAttrsToList;
- inherit (lib.modules) mkIf mkMerge;
+ inherit (lib.attrsets) mapAttrs;
+ inherit (lib.modules) mkIf;
inherit (lib.types)
submodule
str
attrsOf
nullOr
unspecified
- lazyAttrsOf
uniq
functionTo
package
- listOf
- bool
;
inherit (fleetLib.strings) decodeRawSecret;
sysConfig = config;
- secretPartDataType = submodule {
- options = {
- raw = mkOption {
- type = str;
- internal = true;
- description = "Encoded & Encrypted secret part data, passed from fleet.nix";
- };
- };
- };
- secretDataType = submodule {
- freeformType = lazyAttrsOf secretPartDataType;
- options = {
- shared = mkOption {
- description = "Is this secret owned by this machine, or propagated from shared secrets";
- default = false;
- };
- };
- };
secretPartType =
secretName:
submodule (
@@ -61,11 +37,6 @@
in
{
options = {
- encrypted = mkOption {
- type = bool;
- description = "Is this secret part supposed to be encrypted?";
- };
-
hash = mkOption {
type = str;
description = "Hash of secret in encoded format";
@@ -82,17 +53,17 @@
type = str;
description = "Secret public data (only available for plaintext)";
};
+ raw = mkOption {
+ type = str;
+ description = "Raw (encoded/encrypted secret part data)";
+ };
+ };
+ config = {
+ hash = hashString "sha1" config.raw;
+ data = decodeRawSecret config.raw;
+ path = "/run/secrets/${secretName}/${config.hash}-${partName}";
+ stablePath = "/run/secrets/${secretName}/${partName}";
};
- config =
- let
- raw = sysConfig.data.secrets.${secretName}.${partName}.raw;
- in
- {
- hash = hashString "sha1" raw;
- data = decodeRawSecret raw;
- path = "/run/secrets/${secretName}/${config.hash}-${partName}";
- stablePath = "/run/secrets/${secretName}/${partName}";
- };
}
);
secretType = submodule (
@@ -105,14 +76,9 @@
in
{
options = {
- shared = mkOption {
- type = bool;
- description = "Was this secret propagated from a shared secret?";
- };
parts = mkOption {
- type = lazyAttrsOf (secretPartType secretName);
+ type = attrsOf (secretPartType secretName);
description = "Definition of secret parts";
- default = { };
};
generator = mkOption {
type = uniq (nullOr (functionTo package));
@@ -134,47 +100,14 @@
description = "Group of the secret";
default = sysConfig.users.users.${config.owner}.group;
defaultText = literalExpression "config.users.users.$${owner}.group";
- };
- expectedGenerationData = mkOption {
- type = unspecified;
- description = "Data that gets embedded into secret part";
- default = null;
};
};
config = {
- shared = (sysConfig.data.secrets.${secretName} or { shared = false; }).shared;
- parts = mkMerge [
- (mkIf (config.generator != null)
- (
- # Get fake derivation body, in future it should be implemented the same way as in Rust.
- lib.callPackageWith (
- pkgs
- // {
- mkSecretGenerator = pkgs.stdenv.mkDerivation;
- mkImpureSecretGenerator = pkgs.stdenv.mkDerivation;
- }
- ) config.generator { }
- ).parts
- )
- (mapAttrs (_: _: { }) (
- removeAttrs (sysConfig.data.secrets.${secretName} or { }) [
- "shared"
- "managed"
- ]
- ))
- ];
+ parts = builtins.fleet_ensure_host_secret sysConfig.networking.hostName secretName config.generator;
};
}
);
- processPart = secretName: partName: part: {
- inherit (part) path stablePath;
- raw = config.data.secrets.${secretName}.${partName}.raw;
- };
- processSecret = secretName: secret: {
- inherit (secret.definition) group mode owner;
- parts = (mapAttrs (processPart secretName) (secret.definition.parts));
- };
- secretsData = (mapAttrs (processSecret) config.secrets);
+ secretsData = (mapAttrs (_: s: s.definition) config.secrets);
secretsFile = pkgs.writeTextFile {
name = "secrets.json";
text = toJSON secretsData;
@@ -185,11 +118,6 @@
in
{
options = {
- data.secrets = mkOption {
- type = attrsOf secretDataType;
- default = { };
- description = "Host-local secret data";
- };
secrets = mkOption {
type = attrsOf secretType;
default = { };
modules/secrets-data.nixdiffbeforeafterboth--- a/modules/secrets-data.nix
+++ /dev/null
@@ -1,95 +0,0 @@
-{
- lib,
- fleetLib,
- ...
-}:
-let
- inherit (fleetLib.options) mkDataOption;
- inherit (lib.options) mkOption;
- inherit (lib.types)
- nullOr
- listOf
- str
- attrsOf
- submodule
- bool
- unspecified
- ;
-
- secretDataValue = {
- options = {
- raw = mkOption {
- type = nullOr str;
- description = "Raw secret data in unspecified encoded and optionally encrypted format.";
- default = null;
- };
- };
- };
-
- sharedSecretData = {
- freeformType = attrsOf (submodule secretDataValue);
- options = {
- managed = mkOption {
- type = nullOr bool;
- description = "Is current fleet data value is generated by generator";
- default = null;
- };
-
- createdAt = mkOption {
- type = str;
- description = "Timestamp of secret generation/last rotation.";
- default = null;
- };
- expiresAt = mkOption {
- type = nullOr str;
- description = "Expiration timestamp triggering mandatory secret rotation.";
- default = null;
- };
-
- owners = mkOption {
- type = listOf str;
- description = ''
- List of hosts currently authorized to decrypt this shared secret.
-
- If owners differ from expected owners, the secret is considered outdated
- and requires regeneration or re-encryption.
- '';
- default = [ ];
- };
- generationData = mkOption {
- type = unspecified;
- description = "Contextual metadata associated with secret part.";
- default = null;
- };
- };
- };
-
- managerKey = {
- options = {
- name = mkOption {
- type = str;
- description = "Who does this manager key belongs to.";
- };
- key = mkOption {
- type = str;
- description = "Age-compatible key";
- };
- };
- config = { };
- };
-in
-{
- options.data = mkDataOption ({ config, ... }:
- {
- options = {
- managerKeys = mkOption {
- type = listOf (submodule managerKey);
- };
- secrets = mkOption {
- type = attrsOf (listOf submodule sharedSecretData);
- default = { };
- description = "Shared secret data.";
- };
- };
- });
-}
modules/secrets.nixdiffbeforeafterboth--- a/modules/secrets.nix
+++ b/modules/secrets.nix
@@ -5,7 +5,6 @@
let
inherit (lib.options) mkOption literalExpression;
inherit (lib.types)
- unspecified
nullOr
listOf
str
@@ -66,22 +65,7 @@
An input to this function - `pkgs` of a generator host with implementation-defined representation of extra encryption data,
use `mkSecretGenerator` helpers to implement own generators.
'';
- default = null;
- };
- expectedGenerationData = mkOption {
- type = unspecified;
- description = "Contextual metadata embedded within the secret part value";
default = null;
- };
- expectedPrivateParts = mkOption {
- type = listOf str;
- default = [ ];
- description = "List of parts that are expected to be encrypted";
- };
- expectedPublicParts = mkOption {
- type = listOf str;
- default = [ ];
- description = "List of parts that are expected to be public";
};
};
};