|
|
|
@ -1,11 +1,11 @@
|
|
|
|
{
|
|
|
|
{ lib
|
|
|
|
lib,
|
|
|
|
, config
|
|
|
|
config,
|
|
|
|
, pkgs
|
|
|
|
pkgs,
|
|
|
|
, ...
|
|
|
|
...
|
|
|
|
}:
|
|
|
|
}: let
|
|
|
|
let
|
|
|
|
secretType = serviceName:
|
|
|
|
secretType = serviceName:
|
|
|
|
lib.types.submodule ({config, ...}: {
|
|
|
|
lib.types.submodule ({ config, ... }: {
|
|
|
|
options = {
|
|
|
|
options = {
|
|
|
|
name = lib.mkOption {
|
|
|
|
name = lib.mkOption {
|
|
|
|
type = lib.types.str;
|
|
|
|
type = lib.types.str;
|
|
|
|
@ -59,80 +59,85 @@
|
|
|
|
|
|
|
|
|
|
|
|
vaultTemplates = config:
|
|
|
|
vaultTemplates = config:
|
|
|
|
(lib.mapAttrsToList
|
|
|
|
(lib.mapAttrsToList
|
|
|
|
(serviceName: service:
|
|
|
|
(serviceName: _service:
|
|
|
|
getSecretTemplate serviceName services.${serviceName}.vault)
|
|
|
|
getSecretTemplate serviceName services.${serviceName}.vault)
|
|
|
|
(lib.filterAttrs (n: v: v.vault.secrets != {} && v.vault.agent == config._module.args.name) services))
|
|
|
|
(lib.filterAttrs (_n: v: v.vault.secrets != { } && v.vault.agent == config._module.args.name) services))
|
|
|
|
++ (lib.mapAttrsToList
|
|
|
|
++ (lib.mapAttrsToList
|
|
|
|
(serviceName: service:
|
|
|
|
(serviceName: _service:
|
|
|
|
getEnvironmentTemplate serviceName services.${serviceName}.vault)
|
|
|
|
getEnvironmentTemplate serviceName services.${serviceName}.vault)
|
|
|
|
(lib.filterAttrs (n: v: v.vault.environmentTemplate != null && v.vault.agent == config._module.args.name) services));
|
|
|
|
(lib.filterAttrs (_n: v: v.vault.environmentTemplate != null && v.vault.agent == config._module.args.name) services));
|
|
|
|
in {
|
|
|
|
in
|
|
|
|
|
|
|
|
{
|
|
|
|
options = {
|
|
|
|
options = {
|
|
|
|
systemd.services = lib.mkOption {
|
|
|
|
systemd.services = lib.mkOption {
|
|
|
|
type = lib.types.attrsOf (lib.types.submodule ({config, ...}: let
|
|
|
|
type = lib.types.attrsOf (lib.types.submodule ({ config, ... }:
|
|
|
|
serviceName = config._module.args.name;
|
|
|
|
let
|
|
|
|
in {
|
|
|
|
serviceName = config._module.args.name;
|
|
|
|
options.vault = {
|
|
|
|
in
|
|
|
|
changeAction = lib.mkOption {
|
|
|
|
{
|
|
|
|
description = ''
|
|
|
|
options.vault = {
|
|
|
|
What to do with the service if any secrets change
|
|
|
|
changeAction = lib.mkOption {
|
|
|
|
'';
|
|
|
|
description = ''
|
|
|
|
type = lib.types.nullOr (lib.types.enum [
|
|
|
|
What to do with the service if any secrets change
|
|
|
|
"none"
|
|
|
|
'';
|
|
|
|
"reload-or-restart"
|
|
|
|
type = lib.types.nullOr (lib.types.enum [
|
|
|
|
"restart"
|
|
|
|
"none"
|
|
|
|
]);
|
|
|
|
"reload-or-restart"
|
|
|
|
default = "reload-or-restart";
|
|
|
|
"restart"
|
|
|
|
};
|
|
|
|
]);
|
|
|
|
|
|
|
|
default = "reload-or-restart";
|
|
|
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
|
|
template = lib.mkOption {
|
|
|
|
template = lib.mkOption {
|
|
|
|
type = lib.types.lines;
|
|
|
|
type = lib.types.lines;
|
|
|
|
description = ''
|
|
|
|
description = ''
|
|
|
|
The vault agent template to use for secrets
|
|
|
|
The vault agent template to use for secrets
|
|
|
|
'';
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
|
|
environmentTemplate = lib.mkOption {
|
|
|
|
environmentTemplate = lib.mkOption {
|
|
|
|
type = lib.types.nullOr lib.types.lines;
|
|
|
|
type = lib.types.nullOr lib.types.lines;
|
|
|
|
default = null;
|
|
|
|
default = null;
|
|
|
|
description = ''
|
|
|
|
description = ''
|
|
|
|
The vault agent template to use for environment file
|
|
|
|
The vault agent template to use for environment file
|
|
|
|
'';
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
|
|
agent = lib.mkOption {
|
|
|
|
agent = lib.mkOption {
|
|
|
|
type = lib.types.str;
|
|
|
|
type = lib.types.str;
|
|
|
|
default = "default";
|
|
|
|
default = "default";
|
|
|
|
description = ''
|
|
|
|
description = ''
|
|
|
|
Agent instance to use for this service
|
|
|
|
Agent instance to use for this service
|
|
|
|
'';
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
|
|
secrets = lib.mkOption {
|
|
|
|
secrets = lib.mkOption {
|
|
|
|
type = lib.types.attrsOf (secretType serviceName);
|
|
|
|
type = lib.types.attrsOf (secretType serviceName);
|
|
|
|
default = {};
|
|
|
|
default = { };
|
|
|
|
description = "List of secrets to load from vault agent template";
|
|
|
|
description = "List of secrets to load from vault agent template";
|
|
|
|
example = {
|
|
|
|
example = {
|
|
|
|
some-secret.template = ''{{ with secret "secret/some-secret" }}{{ .Data.data.some-key }}{{ end }}'';
|
|
|
|
some-secret.template = ''{{ with secret "secret/some-secret" }}{{ .Data.data.some-key }}{{ end }}'';
|
|
|
|
|
|
|
|
};
|
|
|
|
};
|
|
|
|
};
|
|
|
|
};
|
|
|
|
};
|
|
|
|
};
|
|
|
|
config =
|
|
|
|
config = let
|
|
|
|
let
|
|
|
|
mkIfHasEnv = lib.mkIf (config.vault.environmentTemplate != null);
|
|
|
|
mkIfHasEnv = lib.mkIf (config.vault.environmentTemplate != null);
|
|
|
|
in {
|
|
|
|
in
|
|
|
|
after = mkIfHasEnv ["${serviceName}-envfile.service"];
|
|
|
|
{
|
|
|
|
bindsTo = mkIfHasEnv ["${serviceName}-envfile.service"];
|
|
|
|
after = mkIfHasEnv [ "${serviceName}-envfile.service" ];
|
|
|
|
|
|
|
|
bindsTo = mkIfHasEnv [ "${serviceName}-envfile.service" ];
|
|
|
|
|
|
|
|
|
|
|
|
serviceConfig = {
|
|
|
|
serviceConfig = {
|
|
|
|
LoadCredential = lib.mapAttrsToList (_: config: "${config.name}:/run/systemd-vaultd/sock") config.vault.secrets;
|
|
|
|
LoadCredential = lib.mapAttrsToList (_: config: "${config.name}:/run/systemd-vaultd/sock") config.vault.secrets;
|
|
|
|
EnvironmentFile = mkIfHasEnv ["/run/systemd-vaultd/secrets/${serviceName}.service.EnvironmentFile"];
|
|
|
|
EnvironmentFile = mkIfHasEnv [ "/run/systemd-vaultd/secrets/${serviceName}.service.EnvironmentFile" ];
|
|
|
|
};
|
|
|
|
};
|
|
|
|
};
|
|
|
|
};
|
|
|
|
}));
|
|
|
|
}));
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
|
|
services.vault.agents = lib.mkOption {
|
|
|
|
services.vault.agents = lib.mkOption {
|
|
|
|
type = lib.types.attrsOf (lib.types.submodule ({config, ...}: {
|
|
|
|
type = lib.types.attrsOf (lib.types.submodule ({ config, ... }: {
|
|
|
|
config.settings.template = vaultTemplates config;
|
|
|
|
config.settings.template = vaultTemplates config;
|
|
|
|
}));
|
|
|
|
}));
|
|
|
|
};
|
|
|
|
};
|
|
|
|
@ -140,14 +145,17 @@ in {
|
|
|
|
|
|
|
|
|
|
|
|
config = {
|
|
|
|
config = {
|
|
|
|
# we cannot use `systemd.services` here since this would create infinite recursion
|
|
|
|
# we cannot use `systemd.services` here since this would create infinite recursion
|
|
|
|
systemd.packages = let
|
|
|
|
systemd.packages =
|
|
|
|
servicesWithEnv = builtins.attrNames (lib.filterAttrs (n: v: v.vault.environmentTemplate != null) services);
|
|
|
|
let
|
|
|
|
in [
|
|
|
|
servicesWithEnv = builtins.attrNames (lib.filterAttrs (_n: v: v.vault.environmentTemplate != null) services);
|
|
|
|
(pkgs.runCommand "env-services" {}
|
|
|
|
in
|
|
|
|
(''
|
|
|
|
[
|
|
|
|
|
|
|
|
(pkgs.runCommand "env-services" { }
|
|
|
|
|
|
|
|
(''
|
|
|
|
mkdir -p $out/lib/systemd/system
|
|
|
|
mkdir -p $out/lib/systemd/system
|
|
|
|
''
|
|
|
|
''
|
|
|
|
+ (lib.concatMapStringsSep "\n" (service: ''
|
|
|
|
+ (lib.concatMapStringsSep "\n"
|
|
|
|
|
|
|
|
(service: ''
|
|
|
|
cat > $out/lib/systemd/system/${service}-envfile.service <<EOF
|
|
|
|
cat > $out/lib/systemd/system/${service}-envfile.service <<EOF
|
|
|
|
[Unit]
|
|
|
|
[Unit]
|
|
|
|
Before=${service}.service
|
|
|
|
Before=${service}.service
|
|
|
|
@ -165,6 +173,6 @@ in {
|
|
|
|
EOF
|
|
|
|
EOF
|
|
|
|
'')
|
|
|
|
'')
|
|
|
|
servicesWithEnv)))
|
|
|
|
servicesWithEnv)))
|
|
|
|
];
|
|
|
|
];
|
|
|
|
};
|
|
|
|
};
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
Jörg Thalheim
2 years ago
committed by
GitHub