From ec91d1b83cfad151033433159a04eb7b5381bc73 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 4 Aug 2020 22:22:43 +0200 Subject: krebs.secret: restart units on secret change --- krebs/3modules/exim-smarthost.nix | 3 +- krebs/3modules/repo-sync.nix | 3 +- krebs/3modules/secret.nix | 68 +++++++++++++++++++-------------- krebs/3modules/tinc.nix | 3 +- lass/2configs/binary-cache/server.nix | 2 +- lass/2configs/websites/sqlBackup.nix | 2 +- lass/3modules/ejabberd/default.nix | 4 +- lib/default.nix | 3 ++ lib/types.nix | 6 +-- makefu/2configs/binary-cache/server.nix | 2 +- makefu/3modules/netdata.nix | 2 +- tv/2configs/binary-cache/default.nix | 2 +- tv/3modules/charybdis/default.nix | 4 +- tv/3modules/ejabberd/default.nix | 4 +- tv/3modules/x0vncserver.nix | 1 + 15 files changed, 67 insertions(+), 42 deletions(-) diff --git a/krebs/3modules/exim-smarthost.nix b/krebs/3modules/exim-smarthost.nix index 2a97f9d6e..c5969caac 100644 --- a/krebs/3modules/exim-smarthost.nix +++ b/krebs/3modules/exim-smarthost.nix @@ -26,6 +26,7 @@ let private_key = mkOption { type = types.secret-file; default = { + name = "exim.dkim_private_key/${config.domain}"; path = "/run/krebs.secret/${config.domain}.dkim_private_key"; owner.name = "exim"; source-path = toString + "/${config.domain}.dkim.priv"; @@ -118,7 +119,7 @@ let after = flip map cfg.dkim (dkim: config.krebs.secret.files."exim.dkim_private_key/${dkim.domain}".service ); - requires = flip map cfg.dkim (dkim: + partOf = flip map cfg.dkim (dkim: config.krebs.secret.files."exim.dkim_private_key/${dkim.domain}".service ); }; diff --git a/krebs/3modules/repo-sync.nix b/krebs/3modules/repo-sync.nix index 892f34049..91111f3eb 100644 --- a/krebs/3modules/repo-sync.nix +++ b/krebs/3modules/repo-sync.nix @@ -124,6 +124,7 @@ let privateKeyFile = mkOption { type = types.secret-file; default = { + name = "repo-sync-key"; path = "${cfg.stateDir}/ssh.priv"; owner = cfg.user; source-path = toString + "/repo-sync.ssh.key"; @@ -170,7 +171,7 @@ let config.krebs.secret.files.repo-sync-key.service "network.target" ]; - requires = [ + partOf = [ config.krebs.secret.files.repo-sync-key.service ]; diff --git a/krebs/3modules/secret.nix b/krebs/3modules/secret.nix index 672c503b0..bf2c62cc9 100644 --- a/krebs/3modules/secret.nix +++ b/krebs/3modules/secret.nix @@ -1,4 +1,5 @@ -{ config, lib, pkgs, ... }@args: with import ; let +with import ; +{ config, lib, pkgs, ... }: let cfg = config.krebs.secret; in { options.krebs.secret = { @@ -8,32 +9,43 @@ in { }; }; config = lib.mkIf (cfg.files != {}) { - systemd.services.secret = let - # TODO fail if two files have the same path but differ otherwise - files = unique (map (flip removeAttrs ["_module"]) - (attrValues cfg.files)); - in { - serviceConfig = { - Type = "oneshot"; - RemainAfterExit = "yes"; - SyslogIdentifier = "secret"; - ExecStart = pkgs.writeDash "install-secret-files" '' - exit_code=0 - ${concatMapStringsSep "\n" (file: '' - ${pkgs.coreutils}/bin/install \ - -D \ - --compare \ - --verbose \ - --mode=${shell.escape file.mode} \ - --owner=${shell.escape file.owner.name} \ - --group=${shell.escape file.group-name} \ - ${shell.escape file.source-path} \ - ${shell.escape file.path} \ - || exit_code=1 - '') files} - exit $exit_code - ''; - }; - }; + systemd.paths = + mapAttrs' + (name: file: nameValuePair "secret-trigger-${systemd.encodeName name}" { + wantedBy = ["multi-user.target"]; + pathConfig.PathChanged = file.source-path; + }) + cfg.files; + systemd.services = + mapAttrs' + (name: file: nameValuePair "secret-trigger-${systemd.encodeName name}" { + wantedBy = ["multi-user.target"]; + serviceConfig = { + Type = "oneshot"; + ExecStart = "${pkgs.systemd}/bin/systemctl restart ${file.service}"; + }; + }) + cfg.files + // + mapAttrs' + (name: file: nameValuePair "secret-${systemd.encodeName name}" { + wantedBy = ["multi-user.target"]; + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = "yes"; + ExecStart = toString [ + "${pkgs.coreutils}/bin/install" + "-D" + "--compare" + "--verbose" + "--mode=${file.mode}" + "--owner=${file.owner.name}" + "--group=${file.group-name}" + file.source-path + file.path + ]; + }; + }) + cfg.files; }; } diff --git a/krebs/3modules/tinc.nix b/krebs/3modules/tinc.nix index 0be16d8f6..1fca7de5c 100644 --- a/krebs/3modules/tinc.nix +++ b/krebs/3modules/tinc.nix @@ -158,6 +158,7 @@ let privkey = mkOption { type = types.secret-file; default = { + name = "${tinc.config.netname}.rsa_key.priv"; path = "${tinc.config.user.home}/tinc.rsa_key.priv"; owner = tinc.config.user; source-path = toString + "/${tinc.config.netname}.rsa_key.priv"; @@ -223,7 +224,7 @@ let config.krebs.secret.files."${netname}.rsa_key.priv".service "network.target" ]; - requires = [ + partOf = [ config.krebs.secret.files."${netname}.rsa_key.priv".service ]; wantedBy = [ "multi-user.target" ]; diff --git a/lass/2configs/binary-cache/server.nix b/lass/2configs/binary-cache/server.nix index fbaf16a3c..9b91035a8 100644 --- a/lass/2configs/binary-cache/server.nix +++ b/lass/2configs/binary-cache/server.nix @@ -12,7 +12,7 @@ after = [ config.krebs.secret.files.nix-serve-key.service ]; - requires = [ + partOf = [ config.krebs.secret.files.nix-serve-key.service ]; }; diff --git a/lass/2configs/websites/sqlBackup.nix b/lass/2configs/websites/sqlBackup.nix index 72d7c7b9a..c9783bece 100644 --- a/lass/2configs/websites/sqlBackup.nix +++ b/lass/2configs/websites/sqlBackup.nix @@ -17,7 +17,7 @@ after = [ config.krebs.secret.files.mysql_rootPassword.service ]; - requires = [ + partOf = [ config.krebs.secret.files.mysql_rootPassword.service ]; }; diff --git a/lass/3modules/ejabberd/default.nix b/lass/3modules/ejabberd/default.nix index 9642c64c9..20a38d572 100644 --- a/lass/3modules/ejabberd/default.nix +++ b/lass/3modules/ejabberd/default.nix @@ -17,6 +17,7 @@ in { certfile = mkOption { type = types.secret-file; default = { + name = "ejabberd-certfile"; path = "${cfg.user.home}/ejabberd.pem"; owner = cfg.user; source-path = "/var/lib/acme/lassul.us/full.pem"; @@ -25,6 +26,7 @@ in { dhfile = mkOption { type = types.secret-file; default = { + name = "ejabberd-dhfile"; path = "${cfg.user.home}/dhparams.pem"; owner = cfg.user; source-path = "/dev/null"; @@ -79,7 +81,7 @@ in { config.krebs.secret.files.ejabberd-s2s_certfile.service "network.target" ]; - requires = [ + partOf = [ config.krebs.secret.files.ejabberd-certfile.service config.krebs.secret.files.ejabberd-s2s_certfile.service ]; diff --git a/lib/default.nix b/lib/default.nix index 5a948bbf3..f02959bba 100644 --- a/lib/default.nix +++ b/lib/default.nix @@ -8,6 +8,9 @@ let krebs = import ./krebs lib; krops = import ../submodules/krops/lib; shell = import ./shell.nix { inherit lib; }; + systemd = { + encodeName = replaceChars ["/"] ["\\x2f"]; + }; types = nixpkgs-lib.types // import ./types.nix { inherit lib; }; xml = import ./xml.nix { inherit lib; }; diff --git a/lib/types.nix b/lib/types.nix index 66b01fd12..1eb4d947c 100644 --- a/lib/types.nix +++ b/lib/types.nix @@ -238,7 +238,7 @@ rec { secret-file = submodule ({ config, ... }: { options = { name = mkOption { - type = filename; + type = pathname; default = config._module.args.name; }; path = mkOption { @@ -257,8 +257,8 @@ rec { default = "root"; }; service = mkOption { - type = filename; - default = "secret.service"; + type = systemd.unit-name; + default = "secret-${lib.systemd.encodeName config.name}.service"; }; source-path = mkOption { type = str; diff --git a/makefu/2configs/binary-cache/server.nix b/makefu/2configs/binary-cache/server.nix index 3fc174a1b..1d729b9bb 100644 --- a/makefu/2configs/binary-cache/server.nix +++ b/makefu/2configs/binary-cache/server.nix @@ -12,7 +12,7 @@ after = [ config.krebs.secret.files.nix-serve-key.service ]; - requires = [ + partOf = [ config.krebs.secret.files.nix-serve-key.service ]; }; diff --git a/makefu/3modules/netdata.nix b/makefu/3modules/netdata.nix index a3c789eb2..bfa6f404c 100644 --- a/makefu/3modules/netdata.nix +++ b/makefu/3modules/netdata.nix @@ -74,7 +74,7 @@ in after = [ config.krebs.secret.files.netdata-stream.service ]; - requires = [ + partOf = [ config.krebs.secret.files.netdata-stream.service ]; }; diff --git a/tv/2configs/binary-cache/default.nix b/tv/2configs/binary-cache/default.nix index 970f705f0..866434cb5 100644 --- a/tv/2configs/binary-cache/default.nix +++ b/tv/2configs/binary-cache/default.nix @@ -12,7 +12,7 @@ after = [ config.krebs.secret.files.binary-cache-seckey.service ]; - requires = [ + partOf = [ config.krebs.secret.files.binary-cache-seckey.service ]; }; diff --git a/tv/3modules/charybdis/default.nix b/tv/3modules/charybdis/default.nix index 3809da404..a0638e1eb 100644 --- a/tv/3modules/charybdis/default.nix +++ b/tv/3modules/charybdis/default.nix @@ -17,6 +17,7 @@ in { ssl_dh_params = mkOption { type = types.secret-file; default = { + name = "charybdis-ssl_dh_params"; path = "${cfg.user.home}/dh.pem"; owner = cfg.user; source-path = toString + "/charybdis.dh.pem"; @@ -25,6 +26,7 @@ in { ssl_private_key = mkOption { type = types.secret-file; default = { + name = "charybdis-ssl_private_key"; path = "${cfg.user.home}/ssl.key.pem"; owner = cfg.user; source-path = toString + "/charybdis.key.pem"; @@ -56,7 +58,7 @@ in { config.krebs.secret.files.charybdis-ssl_private_key.service "network-online.target" ]; - requires = [ + partOf = [ config.krebs.secret.files.charybdis-ssl_dh_params.service config.krebs.secret.files.charybdis-ssl_private_key.service ]; diff --git a/tv/3modules/ejabberd/default.nix b/tv/3modules/ejabberd/default.nix index b995c145a..aaf262fa1 100644 --- a/tv/3modules/ejabberd/default.nix +++ b/tv/3modules/ejabberd/default.nix @@ -18,6 +18,7 @@ in { certfile = mkOption { type = types.secret-file; default = { + name = "ejabberd-certfile"; path = "${cfg.user.home}/ejabberd.pem"; owner = cfg.user; source-path = toString + "/ejabberd.pem"; @@ -26,6 +27,7 @@ in { dhfile = mkOption { type = types.secret-file; default = { + name = "ejabberd-dhfile"; path = "${cfg.user.home}/dhparams.pem"; owner = cfg.user; source-path = "/dev/null"; @@ -100,7 +102,7 @@ in { config.krebs.secret.files.ejabberd-s2s_certfile.service "network.target" ]; - requires = [ + partOf = [ config.krebs.secret.files.ejabberd-certfile.service config.krebs.secret.files.ejabberd-s2s_certfile.service ]; diff --git a/tv/3modules/x0vncserver.nix b/tv/3modules/x0vncserver.nix index 8b9cfa89d..ba79c4a49 100644 --- a/tv/3modules/x0vncserver.nix +++ b/tv/3modules/x0vncserver.nix @@ -12,6 +12,7 @@ in { enable = mkEnableOption "tv.x0vncserver"; pwfile = mkOption { default = { + name = "x0vncserver-pwfile"; owner = cfg.user; path = "${cfg.user.home}/.vncpasswd"; source-path = toString + "/vncpasswd"; -- cgit v1.2.3