lbailly/infrastructure
1
0
Fork 0
forked from DGNum/infrastructure
Code Pull requests Activity

feat(dgn-secrets): Add a matches option

Browse source 
This option allows specifying regexes tied to options.
When a secret matches a pattern, the the options are applied to it.
This commit is contained in:
Tom Hubrecht 2023-10-02 22:48:18 +02:00
parent 18c1fa1ddd
commit 5622bc3748
9 changed files with 71 additions and 107 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
machines/compute01/ds-fr/default.nix
View file

@ -1,9 +1,6 @@
{ config, lib, dgn-lib, ... }:
{ config, ... }:
let
inherit (dgn-lib) setDefault;
host = "demarches.dgnum.eu";
let host = "demarches.dgnum.eu";
in {
imports = [ ./module.nix ];
@ -28,7 +25,8 @@ in {
S3_REGION = "garage";
S3_FORCE_PATH_STYLE = "true";
S3_ACCESS_KEY_ID = "GK4d244118eac2336ae0ab2dd9";
S3_SECRET_ACCESS_KEY = "61100261fb0a0c861371596f9ffcd1e83134301a6d0c665a077135af04ba18c3";
S3_SECRET_ACCESS_KEY =
"61100261fb0a0c861371596f9ffcd1e83134301a6d0c665a077135af04ba18c3";
# SAML_IDP_ENABLED = "enabled";
@ -51,8 +49,7 @@ in {
CONTACT_EMAIL = "demarches@infra.dgnum.eu";
EQUIPE_EMAIL = "equipe@infra.dgnum.eu";
TECH_EMAIL = "tech@infra.dgnum.eu";
NO_REPLY_EMAIL =
''"Ne pas répondre <demarches@infra.dgnum.eu>"'';
NO_REPLY_EMAIL = ''"Ne pas répondre <demarches@infra.dgnum.eu>"'';
OLD_CONTACT_EMAIL = "";
CONTACT_PHONE = "";
@ -63,10 +60,7 @@ in {
};
};
dgn-secrets.options = [
(setDefault { owner = "ds-fr"; }
(builtins.filter (lib.hasPrefix "ds_fr") config.dgn-secrets.names))
];
dgn-secrets.matches."^ds_fr-.*$" = { owner = "ds-fr"; };
users.users.ds-fr.extraGroups = [ "sendmail" ];
}

12
machines/compute01/mastodon.nix
View file

@ -1,9 +1,6 @@
{ config, lib, dgn-lib, ... }:
{ config, ... }:
let
inherit (dgn-lib) setDefault;
host = "social.dgnum.eu";
let host = "social.dgnum.eu";
in {
services.mastodon = {
enable = true;
@ -39,8 +36,5 @@ in {
extraEnvFiles = [ config.age.secrets."mastodon-extra_env_file".path ];
};
dgn-secrets.options = [
(setDefault { owner = "mastodon"; }
(builtins.filter (lib.hasPrefix "mastodon-") config.dgn-secrets.names))
];
dgn-secrets.matches."^mastodon-.*$" = { owner = "mastodon"; };
}

12
machines/compute01/nextcloud.nix
View file

@ -1,9 +1,6 @@
{ config, lib, pkgs, dgn-lib, ... }:
{ config, pkgs, ... }:
let
inherit (dgn-lib) setDefault;
host = "cloud.dgnum.eu";
let host = "cloud.dgnum.eu";
in {
services.nextcloud = {
enable = true;
@ -71,8 +68,5 @@ in {
exif
];
dgn-secrets.options = [
(setDefault { owner = "nextcloud"; }
(builtins.filter (lib.hasPrefix "nextcloud-") config.dgn-secrets.names))
];
dgn-secrets.matches."^nextcloud-.*$" = { owner = "nextcloud"; };
}

12
machines/compute01/outline.nix
View file

@ -1,9 +1,6 @@
{ config, lib, dgn-lib, ... }:
{ config, ... }:
let
inherit (dgn-lib) setDefault;
host = "docs.dgnum.eu";
let host = "docs.dgnum.eu";
in {
services.outline = {
enable = true;
@ -57,8 +54,5 @@ in {
};
};
dgn-secrets.options = [
(setDefault { owner = "outline"; }
(builtins.filter (lib.hasPrefix "outline-") config.dgn-secrets.names))
];
dgn-secrets.matches."^outline-.*$" = { owner = "outline"; };
}

12
machines/compute01/satosa/default.nix
View file

@ -1,9 +1,6 @@
{ config, lib, dgn-lib, ... }:
{ config, ... }:
let
inherit (dgn-lib) setDefault;
host = "saml-idp.dgnum.eu";
let host = "saml-idp.dgnum.eu";
in {
imports = [ ./module.nix ];
@ -147,8 +144,5 @@ in {
forceSSL = true;
};
dgn-secrets.options = [
(setDefault { owner = "satosa"; }
(builtins.filter (lib.hasPrefix "satosa-") config.dgn-secrets.names))
];
dgn-secrets.matches."^satosa-.*$" = { owner = "satosa"; };
}

2
machines/compute01/zammad.nix
View file

@ -51,5 +51,5 @@ in {
};
};
dgn-secrets.options = [{ zammad-secret_key_base_file.owner = "zammad"; }];
dgn-secrets.matches."^zammad-.*$" = { owner = "zammad"; };
}

14
machines/storage01/forgejo.nix
View file

@ -1,11 +1,8 @@
{ config, lib, pkgs, dgn-lib, ... }:
{ config, pkgs, ... }:
let
inherit (dgn-lib) setDefault;
port = 3000;
host = "git.dgnum.eu";
in {
services.forgejo = {
enable = true;
@ -22,9 +19,7 @@ in {
};
settings = {
DEFAULT = {
APP_NAME = "Forge git de la DGNum";
};
DEFAULT = { APP_NAME = "Forge git de la DGNum"; };
server = {
ROOT_URL = "https://${host}/";
@ -90,8 +85,5 @@ in {
users.groups.git = { };
dgn-secrets.options = [
(setDefault { owner = "git"; }
(builtins.filter (lib.hasPrefix "forgejo-") config.dgn-secrets.names))
];
dgn-secrets.matches."^forgejo-.*$" = { owner = "git"; };
}

13
machines/storage01/peertube.nix
View file

@ -1,10 +1,6 @@
{ config, lib, dgn-lib, ... }:
let
inherit (dgn-lib) setDefault;
host = "videos.dgnum.eu";
{ config, ... }:
let host = "videos.dgnum.eu";
in {
services.peertube = {
enable = true;
@ -63,8 +59,5 @@ in {
forceSSL = true;
};
dgn-secrets.options = [
(setDefault { owner = "peertube"; }
(builtins.filter (lib.hasPrefix "peertube-") config.dgn-secrets.names))
];
dgn-secrets.matches."^peertube-.*$" = { owner = "peertube"; };
}

83
modules/dgn-secrets.nix
View file

@ -1,4 +1,4 @@
# Copyright :
# Copyright :
# - Tom Hubrecht <tom.hubrecht@dgnum.eu> 2023
#
# Ce logiciel est un programme informatique servant à déployer des
@ -39,43 +39,40 @@ let
types;
inherit (dgn-lib)
getSecrets
mkBaseSecrets
recursiveFuse;
inherit (dgn-lib) getSecrets mkBaseSecrets recursiveFuse;
cfg = config.dgn-secrets;
optionsType = with types; submodule ({ config, ... }: {
options = {
mode = mkOption {
type = str;
default = "0400";
description = ''
Permissions mode of the decrypted secret in a format understood by chmod.
'';
};
optionsType = with types;
submodule ({ config, ... }: {
options = {
mode = mkOption {
type = str;
default = "0400";
description = ''
Permissions mode of the decrypted secret in a format understood by chmod.
'';
};
owner = mkOption {
type = str;
default = "0";
description = ''
User of the decrypted secret.
'';
};
owner = mkOption {
type = str;
default = "0";
description = ''
User of the decrypted secret.
'';
};
group = mkOption {
type = str;
default = config.users.${config.owner}.group or "0";
description = ''
Group of the decrypted secret.
'';
group = mkOption {
type = str;
default = config.users.${config.owner}.group or "0";
description = ''
Group of the decrypted secret.
'';
};
};
};
});
in
});
{
in {
options.dgn-secrets = {
sources = mkOption {
type = with types; listOf path;
@ -95,18 +92,30 @@ in
names = mkOption {
type = with types; listOf str;
default = builtins.foldl' (acc: dir: acc ++ (dgn-lib.getSecrets dir)) [ ] cfg.sources;
default = builtins.foldl' (acc: dir: acc ++ (dgn-lib.getSecrets dir)) [ ]
cfg.sources;
description = ''
List of the names of the secrets.
'';
};
matches = mkOption {
type = with types; attrsOf optionsType;
default = { };
description = ''
Matches of secret names associated to options.
'';
};
};
config = {
age.secrets = recursiveFuse (cfg.options ++ (
builtins.map
(dir: mkBaseSecrets dir (getSecrets dir))
cfg.sources
));
dgn-secrets.options = builtins.concatLists (builtins.attrValues
(builtins.mapAttrs (pattern: options:
builtins.map (secret: { ${secret} = options; })
(builtins.filter (secret: builtins.match pattern secret != null)
cfg.names)) cfg.matches));
age.secrets = recursiveFuse (cfg.options
++ (builtins.map (dir: mkBaseSecrets dir (getSecrets dir)) cfg.sources));
};
}