infrastructure/modules/nixos/openbao/default.nix

# SPDX-FileCopyrightText: 2025 Ryan Lahfa <ryan.lahfa@dgnum.eu>
#
# SPDX-License-Identifier: MIT

{
  config,
  lib,
  pkgs,
  ...
}:

let
  inherit (lib)
    optionalAttrs
    optional
    escapeShellArgs
    concatMap
    mkEnableOption
    mkOption
    mkIf
    types
    literalExpression
    mkPackageOption
    escapeSystemdExecArgs
    getExe'
    genJqSecretsReplacementSnippet
    ;

  cfg = config.services.openbao;

  jsonFormat = pkgs.formats.json;

  configFile = jsonFormat.generate "openbao.json" (
    cfg.extraConfig
    // {
      listener.tcp =
        {
          inherit (cfg) address;
        }
        // (
          if cfg.tlsCertFile == null || cfg.tlsKeyFile == null then
            { tls_disable = true; }
          else
            {
              tls_cert_file = cfg.tlsCertFile;
              tls_key_file = cfg.tlsKeyFile;
            }
        )
        // cfg.listenerExtraConfig;

      storage.${cfg.storageBackend} =
        cfg.storageConfig // (optionalAttrs (cfg.storagePath != null) { path = cfg.storagePath; });
    }
    // (optionalAttrs (cfg.telemetryConfig != { }) { telemetry = cfg.telemetryConfig; })
  );

  allConfigPaths = [ "/var/lib/openbao/config.json" ] ++ cfg.extraSettingsPaths;
  configOptions = escapeShellArgs (
    concatMap (p: [
      "-config"
      p
    ]) allConfigPaths
  );

in

{
  options = {
    services.openbao = {
      enable = mkEnableOption "OpenBao daemon";

      package = mkPackageOption pkgs "openbao" { };

      address = mkOption {
        type = types.str;
        default = "127.0.0.1:8200";
        description = "The name of the ip interface to listen to";
      };

      tlsCertFile = mkOption {
        type = types.nullOr types.path;
        default = null;
        example = "/path/to/your/cert.pem";
        description = "TLS certificate file. TLS will be disabled unless this option is set";
      };

      tlsKeyFile = mkOption {
        type = types.nullOr types.path;
        default = null;
        example = "/path/to/your/key.pem";
        description = "TLS private key file. TLS will be disabled unless this option is set";
      };

      listenerExtraConfig = mkOption {
        inherit (jsonFormat) type;
        default = {
          tls_min_version = "tls12";
        };
        description = "Extra text appended to the listener section.";
      };

      storageBackend = mkOption {
        type = types.enum [
          "inmem"
          "file"
          "consul"
          "zookeeper"
          "s3"
          "azure"
          "dynamodb"
          "etcd"
          "mssql"
          "mysql"
          "postgresql"
          "swift"
          "gcs"
          "raft"
        ];
        default = "inmem";
        description = "The name of the type of storage backend";
      };

      storagePath = mkOption {
        type = types.nullOr types.path;
        default =
          if cfg.storageBackend == "file" || cfg.storageBackend == "raft" then "/var/lib/vault" else null;
        defaultText = literalExpression ''
          if config.storageBackend == "file" || cfg.storageBackend == "raft"
          then "/var/lib/vault"
          else null
        '';
        description = "Data directory for file backend";
      };

      storageConfig = mkOption {
        inherit (jsonFormat) type;
        default = { };
        description = ''
          JSON configuration to insert in the storageBackend section.

          Confidential values should not be specified here because this option's
          value is written to the Nix store, which is publicly readable.
          Provide credentials and such in a separate file using
          [](#opt-services.vault.extraSettingsPaths).
        '';
      };

      telemetryConfig = mkOption {
        type = types.lines;
        default = "";
        description = "Telemetry configuration";
      };

      extraConfig = mkOption {
        inherit (jsonFormat) type;
        default = "";
        description = "Extra text appended to {file}`vault.json`.";
      };

      extraSettingsPaths = mkOption {
        type = types.listOf types.path;
        default = [ ];
        description = ''
          Configuration files to load besides the immutable one defined by the NixOS module.
          This can be used to avoid putting credentials in the Nix store, which can be read by any user.

          Each path can point to a JSON- or HCL-formatted file, or a directory
          to be scanned for files with `.hcl` or
          `.json` extensions.

          To upload the confidential file with NixOps, use for example:

          ```
          # https://releases.nixos.org/nixops/latest/manual/manual.html#opt-deployment.keys
          deployment.keys."vault.hcl" = let db = import ./db-credentials.nix; in {
            text = ${"''"}
              storage "postgresql" {
                connection_url = "postgres://''${db.username}:''${db.password}@host.example.com/exampledb?sslmode=verify-ca"
              }
            ${"''"};
            user = "vault";
          };
          services.vault.extraSettingsPaths = ["/run/keys/vault.hcl"];
          services.vault.storageBackend = "postgresql";
          users.users.vault.extraGroups = ["keys"];
          ```
        '';
      };
    };
  };

  config = mkIf cfg.enable {
    environment.systemPackages = [ pkgs.openbao ];

    assertions = [
      {
        assertion = cfg.storageBackend == "inmem" -> (cfg.storagePath == null && cfg.storageConfig == null);
        message = ''The "inmem" storage expects no services.vault.storagePath nor services.vault.storageConfig'';
      }
      {
        assertion =
          (cfg.storageBackend == "file" -> (cfg.storagePath != null && cfg.storageConfig == null))
          && (cfg.storagePath != null -> (cfg.storageBackend == "file" || cfg.storageBackend == "raft"));
        message = ''You must set services.vault.storagePath only when using the "file" or "raft" backend'';
      }
    ];

    systemd.services.openbao = {
      description = "OpenBao server daemon";

      wantedBy = [ "multi-user.target" ];
      after = [
        "network.target"
      ] ++ optional (config.services.consul.enable && cfg.storageBackend == "consul") "consul.service";

      restartIfChanged = false; # do not restart on "nixos-rebuild switch". It would seal the storage and disrupt the clients.
      preStart = genJqSecretsReplacementSnippet configFile "/var/lib/openbao/config.json";

      startLimitIntervalSec = 60;
      startLimitBurst = 3;
      serviceConfig = {
        DynamicUser = true;
        ExecStart = escapeSystemdExecArgs [
          (lib.getExe cfg.package)
          "server"
          configOptions
        ];
        ExecReload = "${getExe' pkgs.coreutils "kill"} -SIGHUP $MAINPID";
        StateDirectory = "openbao";
        UMask = "0700";
        # In `dev` mode vault will put its token here
        PrivateDevices = true;
        PrivateTmp = true;
        ProtectSystem = "full";
        ProtectHome = "read-only";
        AmbientCapabilities = "cap_ipc_lock";
        NoNewPrivileges = true;
        LimitCORE = 0;
        KillSignal = "SIGINT";
        TimeoutStopSec = "30s";
        Restart = "on-failure";
      };

      unitConfig.RequiresMountsFor = optional (cfg.storagePath != null) cfg.storagePath;
    };
  };

}