You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
94 lines
2.2 KiB
Nix
94 lines
2.2 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}: let
|
|
cfg = config.services.vault;
|
|
settingsFormat = pkgs.formats.json {};
|
|
|
|
autoAuthMethodModule = lib.types.submodule {
|
|
freeformType = lib.types.attrsOf lib.types.unspecified;
|
|
|
|
options = {
|
|
type = lib.mkOption {
|
|
type = lib.types.str;
|
|
};
|
|
|
|
config = lib.mkOption {
|
|
type = lib.types.attrsOf lib.types.unspecified;
|
|
};
|
|
};
|
|
};
|
|
|
|
autoAuthModule = lib.types.submodule {
|
|
freeformType = lib.types.attrsOf lib.types.unspecified;
|
|
|
|
options = {
|
|
method = lib.mkOption {
|
|
type = lib.types.listOf autoAuthMethodModule;
|
|
default = [];
|
|
};
|
|
};
|
|
};
|
|
|
|
templateConfigModule = lib.types.submodule {
|
|
freeformType = lib.types.attrsOf lib.types.unspecified;
|
|
|
|
options = {
|
|
exit_on_retry_failure = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = true;
|
|
};
|
|
};
|
|
};
|
|
|
|
agentConfigType = lib.types.submodule {
|
|
freeformType = lib.types.attrsOf lib.types.unspecified;
|
|
|
|
options = {
|
|
auto_auth = lib.mkOption {
|
|
type = autoAuthModule;
|
|
default = {};
|
|
};
|
|
|
|
template_config = lib.mkOption {
|
|
type = templateConfigModule;
|
|
default = {};
|
|
};
|
|
};
|
|
};
|
|
in {
|
|
options.services.vault.agents = lib.mkOption {
|
|
default = {};
|
|
description = "Instances of vault agent";
|
|
type = lib.types.attrsOf (lib.types.submodule {
|
|
options = {
|
|
settings = lib.mkOption {
|
|
description = "agent configuration";
|
|
type = agentConfigType;
|
|
};
|
|
};
|
|
});
|
|
};
|
|
config = {
|
|
systemd.services = lib.mapAttrs' (name: instanceCfg:
|
|
lib.nameValuePair "vault-agent-${name}" {
|
|
after = ["network.target"];
|
|
wantedBy = ["multi-user.target"];
|
|
|
|
# Services that also have `stopIfChanged = false` might wait for secrets
|
|
# while `vault-agent` is still stopped. This for example happens with nginx.service.
|
|
|
|
stopIfChanged = false;
|
|
# Needs getent in PATH
|
|
path = [pkgs.glibc];
|
|
serviceConfig = {
|
|
Restart = "on-failure";
|
|
ExecStart = "${pkgs.vault}/bin/vault agent -config=${settingsFormat.generate "agent.json" instanceCfg.settings}";
|
|
};
|
|
})
|
|
cfg.agents;
|
|
};
|
|
}
|