cluster/services/locksmith: init

cluster/services/locksmith/default.nix

@@ -0,0 +1,10 @@
+{ config, ... }:
+
+{
+  services.locksmith = {
+    nodes.receiver = config.services.consul.nodes.agent;
+    nixos.receiver = [
+      ./receiver.nix
+    ];
+  };
+}

cluster/services/locksmith/receiver.nix

@@ -0,0 +1,53 @@
+{ config, lib, pkgs, ... }:
+
+let
+  consulCfg = config.services.consul.extraConfig;
+  consulIpAddr = consulCfg.addresses.http or "127.0.0.1";
+  consulHttpAddr = "${consulIpAddr}:${toString (consulCfg.ports.http or 8500)}";
+
+  kvRoot = "secrets/locksmith";
+  kvValue = "recipient/${config.networking.hostName}";
+in
+
+{
+  systemd.tmpfiles.settings.locksmith = {
+    "/run/locksmith".d = {
+      mode = "0711";
+    };
+  };
+
+  systemd.services.locksmith = {
+    description = "The Locksmith's Chant";
+    wantedBy = [ "multi-user.target" ];
+    wants = [ "consul.service" ];
+    after = [ "consul.service" ];
+    chant.enable = true;
+    path = [
+      config.services.consul.package
+    ];
+    environment = {
+      CONSUL_HTTP_ADDR = consulHttpAddr;
+    };
+    serviceConfig = {
+      PrivateTmp = true;
+      WorkingDirectory = "/tmp";
+      IPAddressDeny = [ "any" ];
+      IPAddressAllow = [ consulIpAddr ];
+      LoadCredential = lib.mkForce [];
+    };
+    script = ''
+      consul kv get --keys ${kvRoot}/ | ${pkgs.gnused}/bin/sed 's,/$,,g' | while read secret; do
+        out="$(mktemp -u /run/locksmith/.locksmith-secret.XXXXXXXXXXXXXXXX)"
+        if [[ "$(consul kv get --keys "$secret/${kvValue}")" == "$secret/${kvValue}" ]]; then
+          owner="$(consul kv get "$secret/owner")"
+          group="$(consul kv get "$secret/group")"
+          mode="$(consul kv get "$secret/mode")"
+          consul kv get "$secret/${kvValue}" | ${pkgs.age}/bin/age --decrypt -i /etc/ssh/ssh_host_ed25519_key -o $out
+          chown -v "$owner:$group" $out
+          chmod -v "$mode" $out
+          mv -v $out "/run/locksmith/$(basename "$secret")"
+        fi
+      done
+    '';
+  };
+}