diff options
| -rw-r--r-- | README.md | 24 | ||||
| -rw-r--r-- | lib/types/populate.nix | 26 | ||||
| -rw-r--r-- | pkgs/populate/default.nix | 33 |
3 files changed, 82 insertions, 1 deletions
@@ -6,6 +6,7 @@ krops is a lightweight toolkit to deploy NixOS systems, remotely or locally. ## Some Features - store your secrets in [password store](https://www.passwordstore.org/) + or [passage](https://github.com/FiloSottile/passage) - build your systems remotely - minimal overhead (it's basically just `nixos-rebuild switch`!) - run from custom nixpkgs branch/checkout/fork @@ -298,6 +299,29 @@ Supported attributes: sub-directory in the password store. +### `passage` + +The passage source type decrypts files from a local +[passage store](https://github.com/FiloSottile/passage) +and transfers them to the target using +[`rsync`](https://rsync.samba.org/). + +Supported attributes: + +* `dir` - + Path to the passage store. + For a partial transfer, this may point to a subdirectory. + Example: `~/.passage/store/hosts/MYHOSTNAME` + +* `identities_file` (optional) - + Path to the identities file. + Defaults to `~/.passage/identities`. + +* `age` (optional) - + Path of the age binary. + Defaults to `age` (absolute path gets resolved using `passage`'s search path.) + + ### `pipe` Executes a local command, capture its stdout, and send that as a file to the diff --git a/lib/types/populate.nix b/lib/types/populate.nix index 18b5cd8..6264f99 100644 --- a/lib/types/populate.nix +++ b/lib/types/populate.nix @@ -39,6 +39,17 @@ default = null; type = lib.types.nullOr source-types.pass; }; + passage = lib.mkOption { + apply = x: + if lib.types.pathname.check x + then { dir = x; } + else x; + default = null; + type = lib.types.nullOr (lib.types.oneOf [ + lib.types.pathname + source-types.passage + ]); + }; pipe = lib.mkOption { apply = x: if lib.types.absolute-pathname.check x @@ -160,6 +171,21 @@ }; }; }; + passage = lib.types.submodule { + options = { + age = lib.mkOption { + default = "age"; + type = lib.types.pathname; + }; + dir = lib.mkOption { + type = lib.types.pathname; + }; + identities_file = lib.mkOption { + default = toString ~/.passage/identities; + type = lib.types.pathname; + }; + }; + }; pipe = lib.types.submodule { options = { command = lib.mkOption { diff --git a/pkgs/populate/default.nix b/pkgs/populate/default.nix index 80e2b96..7129b90 100644 --- a/pkgs/populate/default.nix +++ b/pkgs/populate/default.nix @@ -1,7 +1,7 @@ with import ../../lib; with shell; -{ coreutils, dash, findutils, git, jq, openssh, pass, rsync, writers }: +{ coreutils, dash, findutils, git, jq, openssh, pass, passage, rsync, writers }: let check = { force, target }: let @@ -171,6 +171,37 @@ let ${rsync' target rsyncDefaultConfig /* sh */ "$tmp_dir"} ''; + pop.passage = target: source: /* sh */ '' + set -efu + + export PASSAGE_AGE=${quote source.age} + export PASSAGE_DIR=${quote source.dir} + export PASSAGE_IDENTITIES_FILE=${quote source.identities_file} + + umask 0077 + + tmp_dir=$(${coreutils}/bin/mktemp -dt populate-passage.XXXXXXXX) + trap cleanup EXIT + cleanup() { + rm -fR "$tmp_dir" + } + + ${findutils}/bin/find "$PASSAGE_DIR" -type f -name \*.age -follow | + while read -r age_path; do + + rel_name=''${age_path#$PASSAGE_DIR} + rel_name=''${rel_name%.age} + + tmp_path=$tmp_dir/$rel_name + + ${coreutils}/bin/mkdir -p "$(${coreutils}/bin/dirname "$tmp_path")" + ${passage}/bin/passage show "$rel_name" > "$tmp_path" + ${coreutils}/bin/touch -r "$age_path" "$tmp_path" + done + + ${rsync' target rsyncDefaultConfig /* sh */ "$tmp_dir"} + ''; + pop.pipe = target: source: /* sh */ '' ${quote source.command} | { ${runShell target /* sh */ "cat > ${quote target.path}"} |