aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authortv <tv@krebsco.de>2024-01-11 04:37:02 +0100
committertv <tv@krebsco.de>2024-01-11 11:23:11 +0100
commita6c7ecd8ba90c1eb2515cb235d85649295848e68 (patch)
tree6759fc1f2479ff6b250741dd9e2798db285ff4e3
parentcbc475bdf46c115ac0f28008a531164567a12f87 (diff)
populate: add passage source typeHEAD1.29.0master
-rw-r--r--README.md24
-rw-r--r--lib/types/populate.nix26
-rw-r--r--pkgs/populate/default.nix33
3 files changed, 82 insertions, 1 deletions
diff --git a/README.md b/README.md
index a10b836..d8268e5 100644
--- a/README.md
+++ b/README.md
@@ -6,6 +6,7 @@ krops is a lightweight toolkit to deploy NixOS systems, remotely or locally.
## Some Features
- store your secrets in [password store](https://www.passwordstore.org/)
+ or [passage](https://github.com/FiloSottile/passage)
- build your systems remotely
- minimal overhead (it's basically just `nixos-rebuild switch`!)
- run from custom nixpkgs branch/checkout/fork
@@ -298,6 +299,29 @@ Supported attributes:
sub-directory in the password store.
+### `passage`
+
+The passage source type decrypts files from a local
+[passage store](https://github.com/FiloSottile/passage)
+and transfers them to the target using
+[`rsync`](https://rsync.samba.org/).
+
+Supported attributes:
+
+* `dir` -
+ Path to the passage store.
+ For a partial transfer, this may point to a subdirectory.
+ Example: `~/.passage/store/hosts/MYHOSTNAME`
+
+* `identities_file` (optional) -
+ Path to the identities file.
+ Defaults to `~/.passage/identities`.
+
+* `age` (optional) -
+ Path of the age binary.
+ Defaults to `age` (absolute path gets resolved using `passage`'s search path.)
+
+
### `pipe`
Executes a local command, capture its stdout, and send that as a file to the
diff --git a/lib/types/populate.nix b/lib/types/populate.nix
index 18b5cd8..6264f99 100644
--- a/lib/types/populate.nix
+++ b/lib/types/populate.nix
@@ -39,6 +39,17 @@
default = null;
type = lib.types.nullOr source-types.pass;
};
+ passage = lib.mkOption {
+ apply = x:
+ if lib.types.pathname.check x
+ then { dir = x; }
+ else x;
+ default = null;
+ type = lib.types.nullOr (lib.types.oneOf [
+ lib.types.pathname
+ source-types.passage
+ ]);
+ };
pipe = lib.mkOption {
apply = x:
if lib.types.absolute-pathname.check x
@@ -160,6 +171,21 @@
};
};
};
+ passage = lib.types.submodule {
+ options = {
+ age = lib.mkOption {
+ default = "age";
+ type = lib.types.pathname;
+ };
+ dir = lib.mkOption {
+ type = lib.types.pathname;
+ };
+ identities_file = lib.mkOption {
+ default = toString ~/.passage/identities;
+ type = lib.types.pathname;
+ };
+ };
+ };
pipe = lib.types.submodule {
options = {
command = lib.mkOption {
diff --git a/pkgs/populate/default.nix b/pkgs/populate/default.nix
index 80e2b96..7129b90 100644
--- a/pkgs/populate/default.nix
+++ b/pkgs/populate/default.nix
@@ -1,7 +1,7 @@
with import ../../lib;
with shell;
-{ coreutils, dash, findutils, git, jq, openssh, pass, rsync, writers }:
+{ coreutils, dash, findutils, git, jq, openssh, pass, passage, rsync, writers }:
let
check = { force, target }: let
@@ -171,6 +171,37 @@ let
${rsync' target rsyncDefaultConfig /* sh */ "$tmp_dir"}
'';
+ pop.passage = target: source: /* sh */ ''
+ set -efu
+
+ export PASSAGE_AGE=${quote source.age}
+ export PASSAGE_DIR=${quote source.dir}
+ export PASSAGE_IDENTITIES_FILE=${quote source.identities_file}
+
+ umask 0077
+
+ tmp_dir=$(${coreutils}/bin/mktemp -dt populate-passage.XXXXXXXX)
+ trap cleanup EXIT
+ cleanup() {
+ rm -fR "$tmp_dir"
+ }
+
+ ${findutils}/bin/find "$PASSAGE_DIR" -type f -name \*.age -follow |
+ while read -r age_path; do
+
+ rel_name=''${age_path#$PASSAGE_DIR}
+ rel_name=''${rel_name%.age}
+
+ tmp_path=$tmp_dir/$rel_name
+
+ ${coreutils}/bin/mkdir -p "$(${coreutils}/bin/dirname "$tmp_path")"
+ ${passage}/bin/passage show "$rel_name" > "$tmp_path"
+ ${coreutils}/bin/touch -r "$age_path" "$tmp_path"
+ done
+
+ ${rsync' target rsyncDefaultConfig /* sh */ "$tmp_dir"}
+ '';
+
pop.pipe = target: source: /* sh */ ''
${quote source.command} | {
${runShell target /* sh */ "cat > ${quote target.path}"}