feat(dgn-secrets): Add a matches option

This option allows specifying regexes tied to options.
When a secret matches a pattern, the the options are applied to it.

lib/default.nix

@@ -1,9 +1,23 @@
 _:
 
 let
-  inherit ((import sources.nixpkgs { })) lib;
-
   sources = import ../npins;
-in
 
-import sources.nix-lib { inherit lib; keysRoot = ../keys; metaRoot = ../meta; }
+  nix-lib = import sources.nix-lib {
+    inherit ((import sources.nixpkgs { })) lib;
+
+    keysRoot = ../keys;
+    metaRoot = ../meta;
+  };
+
+in nix-lib // (with nix-lib; {
+  # Get publickeys associated to a node
+  getNodeKeys = node:
+    let
+      meta = import ../meta;
+      names =
+        builtins.foldl' (names: group: names ++ meta.members.groups.${group})
+        (meta.nodes.${node}.admins ++ [ "/machines/${node}" ])
+        (meta.nodes.${node}.adminGroups ++ [ "root" ]);
+    in getAllKeys names;
+})

machines/compute01/ds-fr/default.nix

@@ -1,9 +1,6 @@
-{ config, lib, dgn-lib, ... }:
+{ config, ... }:
 
-let
-  inherit (dgn-lib) setDefault;
-
-  host = "demarches.dgnum.eu";
+let host = "demarches.dgnum.eu";
 in {
   imports = [ ./module.nix ];
 
@@ -28,7 +25,8 @@ in {
       S3_REGION = "garage";
       S3_FORCE_PATH_STYLE = "true";
       S3_ACCESS_KEY_ID = "GK4d244118eac2336ae0ab2dd9";
-      S3_SECRET_ACCESS_KEY = "61100261fb0a0c861371596f9ffcd1e83134301a6d0c665a077135af04ba18c3";
+      S3_SECRET_ACCESS_KEY =
+        "61100261fb0a0c861371596f9ffcd1e83134301a6d0c665a077135af04ba18c3";
 
       # SAML_IDP_ENABLED = "enabled";
 
@@ -51,8 +49,7 @@ in {
       CONTACT_EMAIL = "demarches@infra.dgnum.eu";
       EQUIPE_EMAIL = "equipe@infra.dgnum.eu";
       TECH_EMAIL = "tech@infra.dgnum.eu";
-      NO_REPLY_EMAIL =
-        ''"Ne pas répondre <demarches@infra.dgnum.eu>"'';
+      NO_REPLY_EMAIL = ''"Ne pas répondre <demarches@infra.dgnum.eu>"'';
       OLD_CONTACT_EMAIL = "";
       CONTACT_PHONE = "";
 
@@ -63,10 +60,7 @@ in {
     };
   };
 
-  dgn-secrets.options = [
-    (setDefault { owner = "ds-fr"; }
-      (builtins.filter (lib.hasPrefix "ds_fr") config.dgn-secrets.names))
-  ];
+  dgn-secrets.matches."^ds_fr-.*$" = { owner = "ds-fr"; };
 
   users.users.ds-fr.extraGroups = [ "sendmail" ];
 }

machines/compute01/mastodon.nix

@@ -1,9 +1,6 @@
-{ config, lib, dgn-lib, ... }:
+{ config, ... }:
 
-let
-  inherit (dgn-lib) setDefault;
-
-  host = "social.dgnum.eu";
+let host = "social.dgnum.eu";
 in {
   services.mastodon = {
     enable = true;
@@ -39,8 +36,5 @@ in {
     extraEnvFiles = [ config.age.secrets."mastodon-extra_env_file".path ];
   };
 
-  dgn-secrets.options = [
-    (setDefault { owner = "mastodon"; }
-      (builtins.filter (lib.hasPrefix "mastodon-") config.dgn-secrets.names))
-  ];
+  dgn-secrets.matches."^mastodon-.*$" = { owner = "mastodon"; };
 }

machines/compute01/nextcloud.nix

@@ -1,9 +1,6 @@
-{ config, lib, pkgs, dgn-lib, ... }:
+{ config, pkgs, ... }:
 
-let
-  inherit (dgn-lib) setDefault;
-
-  host = "cloud.dgnum.eu";
+let host = "cloud.dgnum.eu";
 in {
   services.nextcloud = {
     enable = true;
@@ -71,8 +68,5 @@ in {
     exif
   ];
 
-  dgn-secrets.options = [
-    (setDefault { owner = "nextcloud"; }
-      (builtins.filter (lib.hasPrefix "nextcloud-") config.dgn-secrets.names))
-  ];
+  dgn-secrets.matches."^nextcloud-.*$" = { owner = "nextcloud"; };
 }

machines/compute01/outline.nix

@@ -1,9 +1,6 @@
-{ config, lib, dgn-lib, ... }:
+{ config, ... }:
 
-let
-  inherit (dgn-lib) setDefault;
-
-  host = "docs.dgnum.eu";
+let host = "docs.dgnum.eu";
 in {
   services.outline = {
     enable = true;
@@ -57,8 +54,5 @@ in {
     };
   };
 
-  dgn-secrets.options = [
-    (setDefault { owner = "outline"; }
-      (builtins.filter (lib.hasPrefix "outline-") config.dgn-secrets.names))
-  ];
+  dgn-secrets.matches."^outline-.*$" = { owner = "outline"; };
 }

machines/compute01/satosa/default.nix

@@ -1,9 +1,6 @@
-{ config, lib, dgn-lib, ... }:
+{ config, ... }:
 
-let
-  inherit (dgn-lib) setDefault;
-
-  host = "saml-idp.dgnum.eu";
+let host = "saml-idp.dgnum.eu";
 in {
 
   imports = [ ./module.nix ];
@@ -147,8 +144,5 @@ in {
     forceSSL = true;
   };
 
-  dgn-secrets.options = [
-    (setDefault { owner = "satosa"; }
-      (builtins.filter (lib.hasPrefix "satosa-") config.dgn-secrets.names))
-  ];
+  dgn-secrets.matches."^satosa-.*$" = { owner = "satosa"; };
 }

machines/compute01/zammad.nix

@@ -51,5 +51,5 @@ in {
     };
   };
 
-  dgn-secrets.options = [{ zammad-secret_key_base_file.owner = "zammad"; }];
+  dgn-secrets.matches."^zammad-.*$" = { owner = "zammad"; };
 }

machines/storage01/forgejo.nix

@@ -1,11 +1,8 @@
-{ config, lib, pkgs, dgn-lib, ... }:
+{ config, pkgs, ... }:
 
 let
-  inherit (dgn-lib) setDefault;
-
   port = 3000;
   host = "git.dgnum.eu";
-
 in {
   services.forgejo = {
     enable = true;
@@ -22,9 +19,7 @@ in {
     };
 
     settings = {
-      DEFAULT = {
-        APP_NAME = "Forge git de la DGNum";
-      };
+      DEFAULT = { APP_NAME = "Forge git de la DGNum"; };
 
       server = {
         ROOT_URL = "https://${host}/";
@@ -90,8 +85,5 @@ in {
 
   users.groups.git = { };
 
-  dgn-secrets.options = [
-    (setDefault { owner = "git"; }
-      (builtins.filter (lib.hasPrefix "forgejo-") config.dgn-secrets.names))
-  ];
+  dgn-secrets.matches."^forgejo-.*$" = { owner = "git"; };
 }

machines/storage01/peertube.nix

@@ -1,10 +1,6 @@
-{ config, lib, dgn-lib, ... }:
-
-let
-  inherit (dgn-lib) setDefault;
-
-  host = "videos.dgnum.eu";
+{ config, ... }:
 
+let host = "videos.dgnum.eu";
 in {
   services.peertube = {
     enable = true;
@@ -63,8 +59,5 @@ in {
     forceSSL = true;
   };
 
-  dgn-secrets.options = [
-    (setDefault { owner = "peertube"; }
-      (builtins.filter (lib.hasPrefix "peertube-") config.dgn-secrets.names))
-  ];
+  dgn-secrets.matches."^peertube-.*$" = { owner = "peertube"; };
 }

modules/dgn-secrets.nix

@@ -1,4 +1,4 @@
-#  Copyright :
+# Copyright :
 #  - Tom Hubrecht <tom.hubrecht@dgnum.eu>      2023
 #
 #  Ce logiciel est un programme informatique servant à déployer des
@@ -39,43 +39,40 @@ let
 
     types;
 
-  inherit (dgn-lib)
-    getSecrets
-    mkBaseSecrets
-    recursiveFuse;
+  inherit (dgn-lib) getSecrets mkBaseSecrets recursiveFuse;
 
   cfg = config.dgn-secrets;
 
-  optionsType = with types; submodule ({ config, ... }: {
-    options = {
-      mode = mkOption {
-        type = str;
-        default = "0400";
-        description = ''
-          Permissions mode of the decrypted secret in a format understood by chmod.
-        '';
-      };
+  optionsType = with types;
+    submodule ({ config, ... }: {
+      options = {
+        mode = mkOption {
+          type = str;
+          default = "0400";
+          description = ''
+            Permissions mode of the decrypted secret in a format understood by chmod.
+          '';
+        };
 
-      owner = mkOption {
-        type = str;
-        default = "0";
-        description = ''
-          User of the decrypted secret.
-        '';
-      };
+        owner = mkOption {
+          type = str;
+          default = "0";
+          description = ''
+            User of the decrypted secret.
+          '';
+        };
 
-      group = mkOption {
-        type = str;
-        default = config.users.${config.owner}.group or "0";
-        description = ''
-          Group of the decrypted secret.
-        '';
+        group = mkOption {
+          type = str;
+          default = config.users.${config.owner}.group or "0";
+          description = ''
+            Group of the decrypted secret.
+          '';
+        };
       };
-    };
-  });
-in
+    });
 
-{
+in {
   options.dgn-secrets = {
     sources = mkOption {
       type = with types; listOf path;
@@ -95,18 +92,30 @@ in
 
     names = mkOption {
       type = with types; listOf str;
-      default = builtins.foldl' (acc: dir: acc ++ (dgn-lib.getSecrets dir)) [ ] cfg.sources;
+      default = builtins.foldl' (acc: dir: acc ++ (dgn-lib.getSecrets dir)) [ ]
+        cfg.sources;
       description = ''
         List of the names of the secrets.
       '';
     };
+
+    matches = mkOption {
+      type = with types; attrsOf optionsType;
+      default = { };
+      description = ''
+        Matches of secret names associated to options.
+      '';
+    };
   };
 
   config = {
-    age.secrets = recursiveFuse (cfg.options ++ (
-      builtins.map
-        (dir: mkBaseSecrets dir (getSecrets dir))
-        cfg.sources
-    ));
+    dgn-secrets.options = builtins.concatLists (builtins.attrValues
+      (builtins.mapAttrs (pattern: options:
+        builtins.map (secret: { ${secret} = options; })
+        (builtins.filter (secret: builtins.match pattern secret != null)
+          cfg.names)) cfg.matches));
+
+    age.secrets = recursiveFuse (cfg.options
+      ++ (builtins.map (dir: mkBaseSecrets dir (getSecrets dir)) cfg.sources));
   };
 }