cluster/default.nix

@@ -15,6 +15,7 @@ lib.evalModules {
     ./lib/inject-nixos-config.nix
     ./lib/port-magic-multi.nix
     ./lib/mesh.nix
+    ./lib/secrets.nix
 
     ./import-services.nix
   ];

cluster/lib/secrets.nix

@@ -0,0 +1,14 @@
+{ lib, ... }:
+
+{
+  options.secrets = {
+    extraKeys = lib.mkOption {
+      type = with lib.types; listOf str;
+      description = "Additional keys with which to encrypt all secrets.";
+      default = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL5C7mC5S2gM0K6x0L/jNwAeQYbFSzs16Q73lONUlIkL max@TITAN"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMmdWfmAs/0rno8zJlhBFMY2SumnHbTNdZUXJqxgd9ON max@jericho"
+      ];
+    };
+  };
+}

cluster/lib/service-module.nix

@@ -7,6 +7,10 @@ let
 in
 
 {
+  imports = [
+    ./services/secrets.nix
+  ];
+
   options = {
     nodes = mkOption {
       description = ''

cluster/lib/services/secrets.nix

@@ -0,0 +1,51 @@
+{ lib, name, ... }:
+
+let
+  serviceName = name;
+in
+
+{
+  options.secrets = lib.mkOption {
+    type = lib.types.lazyAttrsOf (lib.types.submodule ({ config, name, ... }: {
+      options = {
+        shared = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+          description = "Whether this secret should be the same on all nodes.";
+        };
+
+        nodes = lib.mkOption {
+          type = with lib.types; listOf str;
+          default = [ ];
+        };
+
+        generate = lib.mkOption {
+          type = with lib.types; nullOr (functionTo str);
+          description = "Command used to generate this secret.";
+          default = null;
+        };
+
+        path = lib.mkOption {
+          type = lib.types.path;
+          default = "/run/agenix/cluster-${serviceName}-${name}";
+        };
+
+        mode = lib.mkOption {
+          type = lib.types.str;
+          default = "0400";
+        };
+
+        owner = lib.mkOption {
+          type = lib.types.str;
+          default = "root";
+        };
+
+        group = lib.mkOption {
+          type = lib.types.str;
+          default = "root";
+        };
+      };
+    }));
+    default = {};
+  };
+}