Infinidoge/universe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

secrets: refactor to centralize setup

Browse source
This commit is contained in:
Infinidoge 2023-12-01 13:10:38 -05:00
parent 53ae9598b2
commit aade188ad5
Signed by: Infinidoge
SSH key fingerprint: SHA256:oAMyvotlNFraMmZmr+p6AxnNfW/GioTs1pOn3V4tQ7A
3 changed files with 28 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

7
hosts/Infini-SERVER/default.nix
View file

@ -59,13 +59,6 @@
]; ];
}; };
age.secrets."inx.moe.pem".owner = "nginx";
age.secrets."inx.moe.pem".group = "nginx";
age.secrets."inx.moe.key".owner = "nginx";
age.secrets."inx.moe.key".group = "nginx";
age.secrets."vaultwarden".owner = "vaultwarden";
age.secrets."vaultwarden".group = "vaultwarden";
services = { services = {
nginx = nginx =
let let

4
modules/global/options.nix
View file

@ -35,8 +35,6 @@ in
}; };
}; };
secrets = mkOpt (attrsOf path) { };
universe = { universe = {
packages = mkOpt (listOf package) [ ]; packages = mkOpt (listOf package) [ ];
}; };
@ -57,7 +55,5 @@ in
environment.variables = mkAliasDefinitions options.env; environment.variables = mkAliasDefinitions options.env;
environment.persistence."/persist" = mkAliasDefinitions options.persist; environment.persistence."/persist" = mkAliasDefinitions options.persist;
secrets = mapAttrs (n: v: v.path) config.age.secrets;
}; };
} }

33
secrets/default.nix
View file

@ -1,13 +1,36 @@
{ lib, self, config, ... }: { lib, self, config, ... }:
let let
inherit (lib) filterAttrs nameValuePair hasSuffix removeSuffix mapAttrs mapAttrs' hasAttr mkIf mkMerge optionalAttrs;
inherit (lib.our) mkOpt;
inherit (lib.types) bool attrsOf path;
folder = ./.; folder = ./.;
toFile = name: "${folder}/${name}"; toFile = name: "${folder}/${name}";
filterSecrets = key: value: value == "regular" && lib.hasSuffix ".age" key; filterSecrets = key: value: value == "regular" && hasSuffix ".age" key;
filtered = (lib.filterAttrs filterSecrets (builtins.readDir folder)); filtered = (filterAttrs filterSecrets (builtins.readDir folder));
secrets = lib.mapAttrs' (n: v: lib.nameValuePair (lib.removeSuffix ".age" n) { file = toFile n; }) filtered; secrets = mapAttrs' (n: v: nameValuePair (removeSuffix ".age" n) { file = toFile n; }) filtered;
setOwner = name: { owner = name; group = name; };
in in
{ {
options.modules.secrets.enable = lib.our.mkOpt lib.types.bool true; options = {
modules.secrets.enable = mkOpt bool true;
secrets = mkOpt (attrsOf path) { };
};
config.age.secrets = lib.mkIf config.modules.secrets.enable secrets; config = mkMerge [
{
age.secrets = mkIf config.modules.secrets.enable secrets;
secrets = mapAttrs (n: v: v.path) config.age.secrets;
}
# Set ownership of keys
(mkIf config.services.nginx.enable {
age.secrets."inx.moe.pem" = setOwner "nginx";
age.secrets."inx.moe.key" = setOwner "nginx";
})
(mkIf config.services.vaultwarden.enable {
age.secrets."vaultwarden" = setOwner "vaultwarden";
})
];
} }