systemd-openbao/nix/modules/vault-agent.nix

{ config
, lib
, pkgs
, ...
}:
let
  cfg = config.services.vault;
  settingsFormat = pkgs.formats.json { };

  autoAuthMethodModule = lib.types.submodule {
    freeformType = lib.types.attrsOf lib.types.unspecified;

    options = {
      type = lib.mkOption {
        type = lib.types.str;
      };

      config = lib.mkOption {
        type = lib.types.attrsOf lib.types.unspecified;
      };
    };
  };

  autoAuthModule = lib.types.submodule {
    freeformType = lib.types.attrsOf lib.types.unspecified;

    options = {
      method = lib.mkOption {
        type = lib.types.listOf autoAuthMethodModule;
        default = [ ];
      };
    };
  };

  templateConfigModule = lib.types.submodule {
    freeformType = lib.types.attrsOf lib.types.unspecified;

    options = {
      exit_on_retry_failure = lib.mkOption {
        type = lib.types.bool;
        default = true;
      };
    };
  };

  agentConfigType = lib.types.submodule {
    freeformType = lib.types.attrsOf lib.types.unspecified;

    options = {
      auto_auth = lib.mkOption {
        type = autoAuthModule;
        default = { };
      };

      template_config = lib.mkOption {
        type = templateConfigModule;
        default = { };
      };
    };
  };
in
{
  options.services.vault.agents = lib.mkOption {
    default = { };
    description = "Instances of vault agent";
    type = lib.types.attrsOf (lib.types.submodule {
      options = {
        settings = lib.mkOption {
          description = "agent configuration";
          type = agentConfigType;
        };
      };
    });
  };
  config = {
    systemd.services = lib.mapAttrs'
      (name: instanceCfg:
        lib.nameValuePair "vault-agent-${name}" {
          after = [ "network.target" ];
          wantedBy = [ "multi-user.target" ];

          # Services that also have `stopIfChanged = false` might wait for secrets
          # while `vault-agent` is still stopped. This for example happens with nginx.service.

          stopIfChanged = false;
          # Needs getent in PATH
          path = [ pkgs.glibc ];
          serviceConfig = {
            Restart = "on-failure";
            ExecStart = "${pkgs.vault}/bin/vault agent -config=${settingsFormat.generate "agent.json" instanceCfg.settings}";
          };
        })
      cfg.agents;
  };
}