mirror of
https://github.com/Mic92/sops-nix.git
synced 2025-03-16 21:48:15 +00:00
a4c33bfecb
```
sops.secrets = {
sslCertificate = {
sopsFile = ./secrets.yaml;
owner = "";
group = "";
uid = config.containers."nginx".config.users.users."nginx".uid;
gid = config.containers."nginx".config.users.groups."nginx".gid;
};
sslCertificateKey = {
sopsFile = ./secrets.yaml;
owner = "";
group = "";
uid = config.containers."nginx".config.users.users."nginx".uid;
gid = config.containers."nginx".config.users.groups."nginx".gid;
};
};
```
Co-authored-by: Jörg Thalheim <Mic92@users.noreply.github.com>
57 lines
2.3 KiB
Nix
57 lines
2.3 KiB
Nix
{ lib, options, config, pkgs, ... }:
|
|
let
|
|
cfg = config.sops;
|
|
secretsForUsers = lib.filterAttrs (_: v: v.neededForUsers) cfg.secrets;
|
|
manifestFor = pkgs.callPackage ../manifest-for.nix {
|
|
inherit cfg;
|
|
inherit (pkgs) writeTextFile;
|
|
};
|
|
withEnvironment = import ../with-environment.nix {
|
|
inherit cfg lib;
|
|
};
|
|
manifestForUsers = manifestFor "-for-users" secretsForUsers {
|
|
secretsMountPoint = "/run/secrets-for-users.d";
|
|
symlinkPath = "/run/secrets-for-users";
|
|
};
|
|
sysusersEnabled = options.systemd ? sysusers && config.systemd.sysusers.enable;
|
|
useSystemdActivation = sysusersEnabled ||
|
|
(options.services ? userborn && config.services.userborn.enable);
|
|
in
|
|
{
|
|
systemd.services.sops-install-secrets-for-users = lib.mkIf (secretsForUsers != { } && useSystemdActivation) {
|
|
wantedBy = [ "systemd-sysusers.service" ];
|
|
before = [ "systemd-sysusers.service" ];
|
|
environment = cfg.environment;
|
|
unitConfig.DefaultDependencies = "no";
|
|
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
ExecStart = [ "${cfg.package}/bin/sops-install-secrets -ignore-passwd ${manifestForUsers}" ];
|
|
RemainAfterExit = true;
|
|
};
|
|
};
|
|
|
|
system.activationScripts = lib.mkIf (secretsForUsers != { } && !useSystemdActivation) {
|
|
setupSecretsForUsers = lib.stringAfter ([ "specialfs" ] ++ lib.optional cfg.age.generateKey "generate-age-key") ''
|
|
[ -e /run/current-system ] || echo setting up secrets for users...
|
|
${withEnvironment "${cfg.package}/bin/sops-install-secrets -ignore-passwd ${manifestForUsers}"}
|
|
'' // lib.optionalAttrs (config.system ? dryActivationScript) {
|
|
supportsDryActivation = true;
|
|
};
|
|
|
|
users.deps = [ "setupSecretsForUsers" ];
|
|
};
|
|
|
|
assertions = [{
|
|
assertion = (lib.filterAttrs (_: v: (v.uid != 0 && v.owner != "root") || (v.gid != 0 && v.group != "root")) secretsForUsers) == { };
|
|
message = "neededForUsers cannot be used for secrets that are not root-owned";
|
|
} {
|
|
assertion = secretsForUsers != { } && sysusersEnabled -> config.users.mutableUsers;
|
|
message = ''
|
|
systemd.sysusers.enable in combination with sops.secrets.<name>.neededForUsers can only work with config.users.mutableUsers enabled.
|
|
See https://github.com/Mic92/sops-nix/issues/475
|
|
'';
|
|
}];
|
|
|
|
system.build.sops-nix-users-manifest = manifestForUsers;
|
|
}
|