privatevoid.net/depot
1
1
Fork 0
Code Issues 18 Pull requests 2 Projects 3 Releases Packages Wiki Activity Actions

cluster/services/locksmith: allow waiting for keys

Browse source
This commit is contained in:
Max Headroom 2024-07-10 23:01:49 +02:00
parent d7f816ee39
commit 55741bc8f6
1 changed files with 74 additions and 38 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

112
cluster/services/locksmith/receiver.nix
View file

@ -10,44 +10,80 @@ let
in
{
systemd.tmpfiles.settings.locksmith = {
"/run/locksmith".d = {
mode = "0711";
};
options.services.locksmith.waitForSecrets = lib.mkOption {
type = with lib.types; attrsOf (listOf str);
};
systemd.services.locksmith = {
description = "The Locksmith's Chant";
wantedBy = [ "multi-user.target" ];
wants = [ "consul.service" ];
after = [ "consul.service" ];
chant.enable = true;
path = [
config.services.consul.package
];
environment = {
CONSUL_HTTP_ADDR = consulHttpAddr;
};
serviceConfig = {
PrivateTmp = true;
WorkingDirectory = "/tmp";
IPAddressDeny = [ "any" ];
IPAddressAllow = [ consulIpAddr ];
LoadCredential = lib.mkForce [];
};
script = ''
consul kv get --keys ${kvRoot}/ | ${pkgs.gnused}/bin/sed 's,/$,,g' | while read secret; do
out="$(mktemp -u /run/locksmith/.locksmith-secret.XXXXXXXXXXXXXXXX)"
if [[ "$(consul kv get --keys "$secret/${kvValue}")" == "$secret/${kvValue}" ]]; then
owner="$(consul kv get "$secret/owner")"
group="$(consul kv get "$secret/group")"
mode="$(consul kv get "$secret/mode")"
consul kv get "$secret/${kvValue}" | ${pkgs.age}/bin/age --decrypt -i /etc/ssh/ssh_host_ed25519_key -o $out
chown -v "$owner:$group" $out
chmod -v "$mode" $out
mv -v $out "/run/locksmith/$(basename "$secret")"
fi
done
'';
};
config = lib.mkMerge [
{
systemd.services = lib.mapAttrs' (name: secrets: {
name = "locksmith-wait-secrets-${name}";
value = {
description = "Wait for secrets: ${name}";
after = [ "locksmith.service" ];
before = [ "${name}.service" ];
requiredBy = [ "${name}.service" ];
serviceConfig = {
Type = "oneshot";
IPAddressDeny = [ "any" ];
};
path = [
pkgs.inotify-tools
];
script = ''
for key in ${lib.escapeShellArgs secrets}; do
if ! test -e "$key"; then
echo "Waiting for secret: $key"
inotifywait -qq -e create,moved_to --include "$key" /run/locksmith
fi
echo "Heard secret: $key"
done
echo "All secrets known."
'';
};
}) config.services.locksmith.waitForSecrets;
}
{
systemd.tmpfiles.settings.locksmith = {
"/run/locksmith".d = {
mode = "0711";
};
};
systemd.services.locksmith = {
description = "The Locksmith's Chant";
wantedBy = [ "multi-user.target" ];
wants = [ "consul.service" ];
after = [ "consul.service" ];
chant.enable = true;
path = [
config.services.consul.package
];
environment = {
CONSUL_HTTP_ADDR = consulHttpAddr;
};
serviceConfig = {
PrivateTmp = true;
WorkingDirectory = "/tmp";
IPAddressDeny = [ "any" ];
IPAddressAllow = [ consulIpAddr ];
LoadCredential = lib.mkForce [];
};
script = ''
consul kv get --keys ${kvRoot}/ | ${pkgs.gnused}/bin/sed 's,/$,,g' | while read secret; do
out="$(mktemp -u /run/locksmith/.locksmith-secret.XXXXXXXXXXXXXXXX)"
if [[ "$(consul kv get --keys "$secret/${kvValue}")" == "$secret/${kvValue}" ]]; then
owner="$(consul kv get "$secret/owner")"
group="$(consul kv get "$secret/group")"
mode="$(consul kv get "$secret/mode")"
consul kv get "$secret/${kvValue}" | ${pkgs.age}/bin/age --decrypt -i /etc/ssh/ssh_host_ed25519_key -o $out
chown -v "$owner:$group" $out
chmod -v "$mode" $out
mv -v $out "/run/locksmith/$(basename "$secret")"
fi
done
'';
};
}
];
}