You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

96 lines
2.3 KiB
Nix

2 years ago
{ config
, lib
, pkgs
, ...
}:
let
cfg = config.services.vault;
2 years ago
settingsFormat = pkgs.formats.json { };
autoAuthMethodModule = lib.types.submodule {
freeformType = lib.types.attrsOf lib.types.unspecified;
options = {
type = lib.mkOption {
type = lib.types.str;
};
config = lib.mkOption {
type = lib.types.attrsOf lib.types.unspecified;
};
};
};
autoAuthModule = lib.types.submodule {
freeformType = lib.types.attrsOf lib.types.unspecified;
options = {
method = lib.mkOption {
type = lib.types.listOf autoAuthMethodModule;
2 years ago
default = [ ];
};
};
};
templateConfigModule = lib.types.submodule {
freeformType = lib.types.attrsOf lib.types.unspecified;
options = {
exit_on_retry_failure = lib.mkOption {
type = lib.types.bool;
default = true;
};
};
};
agentConfigType = lib.types.submodule {
freeformType = lib.types.attrsOf lib.types.unspecified;
options = {
auto_auth = lib.mkOption {
type = autoAuthModule;
2 years ago
default = { };
};
template_config = lib.mkOption {
type = templateConfigModule;
2 years ago
default = { };
};
};
};
2 years ago
in
{
options.services.vault.agents = lib.mkOption {
2 years ago
default = { };
description = "Instances of vault agent";
type = lib.types.attrsOf (lib.types.submodule {
options = {
settings = lib.mkOption {
description = "agent configuration";
type = agentConfigType;
};
};
});
};
config = {
2 years ago
systemd.services = lib.mapAttrs'
(name: instanceCfg:
lib.nameValuePair "vault-agent-${name}" {
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
2 years ago
# Services that also have `stopIfChanged = false` might wait for secrets
# while `vault-agent` is still stopped. This for example happens with nginx.service.
2 years ago
stopIfChanged = false;
# Needs getent in PATH
path = [ pkgs.glibc ];
serviceConfig = {
Restart = "on-failure";
ExecStart = "${pkgs.vault}/bin/vault agent -config=${settingsFormat.generate "agent.json" instanceCfg.settings}";
};
})
cfg.agents;
};
}