privatevoid.net/depot
1
1
Fork 0
Code Issues 23 Pull requests 2 Projects 3 Releases Packages Wiki Activity Actions

cluster/services/locksmith: allow waiting for keys

Browse source
This commit is contained in:
Max Headroom 2024-07-10 23:01:49 +02:00
parent d7f816ee39
commit 55741bc8f6
1 changed files with 74 additions and 38 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

112
cluster/services/locksmith/receiver.nix
View file

@ -10,44 +10,80 @@ let
in in
{ {
systemd.tmpfiles.settings.locksmith = { options.services.locksmith.waitForSecrets = lib.mkOption {
"/run/locksmith".d = { type = with lib.types; attrsOf (listOf str);
mode = "0711";
};
}; };
systemd.services.locksmith = { config = lib.mkMerge [
description = "The Locksmith's Chant"; {
wantedBy = [ "multi-user.target" ]; systemd.services = lib.mapAttrs' (name: secrets: {
wants = [ "consul.service" ]; name = "locksmith-wait-secrets-${name}";
after = [ "consul.service" ]; value = {
chant.enable = true; description = "Wait for secrets: ${name}";
path = [ after = [ "locksmith.service" ];
config.services.consul.package before = [ "${name}.service" ];
]; requiredBy = [ "${name}.service" ];
environment = { serviceConfig = {
CONSUL_HTTP_ADDR = consulHttpAddr; Type = "oneshot";
}; IPAddressDeny = [ "any" ];
serviceConfig = { };
PrivateTmp = true; path = [
WorkingDirectory = "/tmp"; pkgs.inotify-tools
IPAddressDeny = [ "any" ]; ];
IPAddressAllow = [ consulIpAddr ]; script = ''
LoadCredential = lib.mkForce []; for key in ${lib.escapeShellArgs secrets}; do
}; if ! test -e "$key"; then
script = '' echo "Waiting for secret: $key"
consul kv get --keys ${kvRoot}/ | ${pkgs.gnused}/bin/sed 's,/$,,g' | while read secret; do inotifywait -qq -e create,moved_to --include "$key" /run/locksmith
out="$(mktemp -u /run/locksmith/.locksmith-secret.XXXXXXXXXXXXXXXX)" fi
if [[ "$(consul kv get --keys "$secret/${kvValue}")" == "$secret/${kvValue}" ]]; then echo "Heard secret: $key"
owner="$(consul kv get "$secret/owner")" done
group="$(consul kv get "$secret/group")" echo "All secrets known."
mode="$(consul kv get "$secret/mode")" '';
consul kv get "$secret/${kvValue}" | ${pkgs.age}/bin/age --decrypt -i /etc/ssh/ssh_host_ed25519_key -o $out };
chown -v "$owner:$group" $out }) config.services.locksmith.waitForSecrets;
chmod -v "$mode" $out }
mv -v $out "/run/locksmith/$(basename "$secret")" {
fi systemd.tmpfiles.settings.locksmith = {
done "/run/locksmith".d = {
''; mode = "0711";
}; };
};
systemd.services.locksmith = {
description = "The Locksmith's Chant";
wantedBy = [ "multi-user.target" ];
wants = [ "consul.service" ];
after = [ "consul.service" ];
chant.enable = true;
path = [
config.services.consul.package
];
environment = {
CONSUL_HTTP_ADDR = consulHttpAddr;
};
serviceConfig = {
PrivateTmp = true;
WorkingDirectory = "/tmp";
IPAddressDeny = [ "any" ];
IPAddressAllow = [ consulIpAddr ];
LoadCredential = lib.mkForce [];
};
script = ''
consul kv get --keys ${kvRoot}/ | ${pkgs.gnused}/bin/sed 's,/$,,g' | while read secret; do
out="$(mktemp -u /run/locksmith/.locksmith-secret.XXXXXXXXXXXXXXXX)"
if [[ "$(consul kv get --keys "$secret/${kvValue}")" == "$secret/${kvValue}" ]]; then
owner="$(consul kv get "$secret/owner")"
group="$(consul kv get "$secret/group")"
mode="$(consul kv get "$secret/mode")"
consul kv get "$secret/${kvValue}" | ${pkgs.age}/bin/age --decrypt -i /etc/ssh/ssh_host_ed25519_key -o $out
chown -v "$owner:$group" $out
chmod -v "$mode" $out
mv -v $out "/run/locksmith/$(basename "$secret")"
fi
done
'';
};
}
];
} }