chore: Significantly restructure folder layout
This moves the various projects from "type-based" folders (such as "services" or "tools") into more appropriate semantic folders (such as "nix", "ops" or "web"). Deprecated projects (nixcon-demo & gotest) which only existed for testing/demonstration purposes have been removed. (Note: *all* builds are broken with this commit)
This commit is contained in:
parent
e52eed3cd4
commit
03bfe08e1d
110 changed files with 1 additions and 998 deletions
60
ops/kms_pass.nix
Normal file
60
ops/kms_pass.nix
Normal file
|
@ -0,0 +1,60 @@
|
|||
# This tool mimics a subset of the interface of 'pass', but uses
|
||||
# Google Cloud KMS for encryption.
|
||||
#
|
||||
# It is intended to be compatible with how 'kontemplate' invokes
|
||||
# 'pass.'
|
||||
#
|
||||
# Only the 'show' and 'insert' commands are supported.
|
||||
|
||||
{ pkgs, kms, ... }:
|
||||
|
||||
let inherit (pkgs.third_party) google-cloud-sdk tree writeShellScriptBin;
|
||||
in (writeShellScriptBin "pass" ''
|
||||
set -eo pipefail
|
||||
|
||||
CMD="$1"
|
||||
readonly SECRET=$2
|
||||
readonly SECRET_PATH="$SECRETS_DIR/$SECRET"
|
||||
|
||||
function secret_check {
|
||||
if [[ -z $SECRET ]]; then
|
||||
echo 'Secret must be specified'
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
if [[ -z $CMD ]]; then
|
||||
CMD="ls"
|
||||
fi
|
||||
|
||||
case "$CMD" in
|
||||
ls)
|
||||
${tree}/bin/tree $SECRETS_DIR
|
||||
;;
|
||||
show)
|
||||
secret_check
|
||||
${google-cloud-sdk}/bin/gcloud kms decrypt \
|
||||
--project ${kms.project} \
|
||||
--location ${kms.region} \
|
||||
--keyring ${kms.keyring} \
|
||||
--key ${kms.key} \
|
||||
--ciphertext-file $SECRET_PATH \
|
||||
--plaintext-file -
|
||||
;;
|
||||
insert)
|
||||
secret_check
|
||||
${google-cloud-sdk}/bin/gcloud kms encrypt \
|
||||
--project ${kms.project} \
|
||||
--location ${kms.region} \
|
||||
--keyring ${kms.keyring} \
|
||||
--key ${kms.key} \
|
||||
--ciphertext-file $SECRET_PATH \
|
||||
--plaintext-file -
|
||||
echo "Inserted secret '$SECRET'"
|
||||
;;
|
||||
*)
|
||||
echo "Usage: pass show/insert <secret>"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
'') // { meta.enableCI = true; }
|
Loading…
Add table
Add a link
Reference in a new issue