privatevoid.net/depot
1
1
Fork 0
Code Issues 23 Pull requests 2 Projects 3 Releases Packages Wiki Activity Actions

Cluster secrets #100

Merged
max merged 17 commits from pr-cluster-secrets into master 2024-07-08 22:23:11 +03:00
Conversation 1 Commits 17 Files changed 90 +21 -7
2 changed files with 21 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit 482a594aa1 - Show all commits

22
cluster/lib/services.nix
View file

@ -7,13 +7,21 @@ let
lib.mapAttrsToList (groupName: _: svcConfig.nixos.${groupName}) lib.mapAttrsToList (groupName: _: svcConfig.nixos.${groupName})
(lib.filterAttrs (_: lib.elem hostName) svcConfig.nodes); (lib.filterAttrs (_: lib.elem hostName) svcConfig.nodes);
secretsConfig.age.secrets = lib.mapAttrs' (secretName: secretConfig: { secretsConfig = let
name = "cluster-${svcName}-${secretName}"; secrets = lib.filterAttrs (_: secret: lib.any (node: node == hostName) secret.nodes) svcConfig.secrets;
value = { in {
inherit (secretConfig) path mode owner group; age.secrets = lib.mapAttrs' (secretName: secretConfig: {
file = ../secrets/${svcName}-${secretName}${lib.optionalString (!secretConfig.shared) "-${hostName}"}.age; name = "cluster-${svcName}-${secretName}";
}; value = {
}) (lib.filterAttrs (_: secret: lib.any (node: node == hostName) secret.nodes) svcConfig.secrets); inherit (secretConfig) path mode owner group;
file = ../secrets/${svcName}-${secretName}${lib.optionalString (!secretConfig.shared) "-${hostName}"}.age;
};
}) secrets;
systemd.services = lib.mkMerge (lib.mapAttrsToList (secretName: secretConfig: lib.genAttrs secretConfig.services (systemdServiceName: {
restartTriggers = [ "${../secrets/${svcName}-${secretName}${lib.optionalString (!secretConfig.shared) "-${hostName}"}.age}" ];
})) secrets);
};
in serviceConfigs ++ [ in serviceConfigs ++ [
secretsConfig secretsConfig
]; ];

6
cluster/lib/services/secrets.nix
View file

@ -44,6 +44,12 @@ in
type = lib.types.str; type = lib.types.str;
default = "root"; default = "root";
}; };
services = lib.mkOption {
type = with lib.types; listOf str;
description = "Services to restart when this secret changes.";
default = [];
};
}; };
})); }));
default = {}; default = {};