nixos/modules/security/systemd-creds.nix

   1 { pkgs, lib, config, ... }:
   2 with builtins;
   3 with lib;
   4 let cfg = config.security.systemd-creds; in
   5 {
   6   options.security.systemd-creds = {
   7     target = mkOption {
   8       type = types.str;
   9       description = ''
  10         Destination address of the target host able to encrypt the credentials.
  11         Used by the default {option}`security.systemd-creds.shell`.
  12       '';
  13       default = "root@${config.networking.hostName}.${config.networking.domain}";
  14       defaultText = mdLiteral "root@\${config.networking.hostName}.\${config.networking.domain}";
  15       example = mdLiteral "''${config.networking.hostName}.wg";
  16     };
  17     decrypt = mkOption {
  18       type = with types; listOf str;
  19       description = mdDoc ''
  20         Command to get the cleartext of a credential.
  21         `credBase` is derived from the path of the credential in `LoadCredentialEncrypted=`,
  22         by removing the `storeDir` prefix and then one directory level if any.
  23       '';
  24       apply = concatStringsSep " ";
  25       default = [ "gpg" "--batch" "--decrypt" "\${credBase%.cred}.gpg" ];
  26       example = [ "pass" "\${credBase%.cred}" ];
  27     };
  28     shell = mkOption {
  29       type = with types; listOf str;
  30       description = mdDoc ''
  31         Command to get a shell on the target host.
  32       '';
  33       apply = concatStringsSep " ";
  34       default = [
  35         "ssh"
  36         "-o"
  37         "StrictHostKeyChecking=yes"
  38         "-o"
  39         "ControlMaster=auto"
  40         "-o"
  41         "ControlPersist=16s"
  42         "\"\${SYSTEMD_CREDS_TARGET:-${cfg.target}}\""
  43       ];
  44       defaultText = mdLiteral ''
  45         ssh -o StrictHostKeyChecking=yes \
  46             -o ControlMaster=auto \
  47             -o ControlPersist=16s \
  48             \"''${SYSTEMD_CREDS_TARGET:-root@''${config.security.systemd-creds.target}}\"
  49       '';
  50       example = [ "sudo" ];
  51     };
  52     encrypt = mkOption {
  53       type = with types; listOf str;
  54       description = mdDoc ''
  55         Command to run `systemd-creds encrypt` on the target host.
  56
  57         ::: {.warning}
  58         Beware that the files `/etc/machine-id`
  59         and `/var/lib/systemd/credential.secret` on the target host,
  60         are both used to encrypt and decrypt when using the `host` key mechanism.
  61         Meaning that reinstalling the system on a new drive
  62         without restoring those two files
  63         will require to reencrypt the credentials.
  64         :::
  65       '';
  66       apply = concatStringsSep " ";
  67       default = [ "systemd-creds" "encrypt" "--name" "\"$credID\"" "--with-key=auto" ];
  68       example = [ "sudo" "systemd-creds" "encrypt" "--with-key=host" ];
  69     };
  70     install = mkOption {
  71       type = with types; listOf str;
  72       apply = concatStringsSep " ";
  73       description = mdDoc ''
  74         Command to install the encrypted credential on the orchestrating host.
  75       '';
  76       default = [ "install" "-D" "-m" "640" "/dev/stdin" "\"$credBase\"" ];
  77     };
  78     script = mkOption {
  79       type = types.lines;
  80       apply = pkgs.writeShellScriptBin "systemd-creds-encrypt-${replaceStrings ["@"] ["-"] cfg.target}";
  81       description = mdDoc ''
  82         Encrypt credentials referenced in the `LoadCredentialEncrypted=`
  83         of enabled systemd services, by running `systemd-creds` on the {option}`security.systemd-creds.target` host.
  84         Only *existing* and *empty* credential files, are considered.
  85         Recursively if the credential path is a directory.
  86         Note that when using flakes, the sandboxing requires those empty files to be added to Git beforehand.
  87
  88         Example of use:
  89         ```console
  90         $ sudo wg genkey | gpg --encrypt --sign --recipient @$USER wireguard/wg-intra/privateKey.cred --output wireguard/wg-intra/privateKey.gpg
  91         $ tee </dev/null >wireguard/wg-intra/privateKey.cred
  92         $ git add wireguard/wg-intra/privateKey.cred
  93         ```
  94
  95         ```nix
  96         systemd.services."wireguard-wg-intra".serviceConfig.LoadCredentialEncrypted =
  97           [ "privateKey:''${wireguard/wg-intra/privateKey.cred}" ];
  98         ```
  99
 100         ```console
 101         $ nix run .#nixosConfigurations.''${hostName}.config.security.systemd-creds.script
 102         $ git add wireguard/wg-intra/privateKey.cred
 103         ```
 104       '';
 105     };
 106   };
 107   config = {
 108     security.systemd-creds.script = ''
 109       shopt -s extglob globstar nullglob
 110       set -o pipefail
 111       set -eux
 112     '' + concatMapStringsSep "\n"
 113       (service:
 114         concatMapStringsSep "\n"
 115           (credential:
 116             let
 117               cred = splitString ":" credential;
 118               credID = elemAt cred 0;
 119               credPath = elemAt cred 1;
 120             in
 121             ''
 122               credID=${escapeShellArg credID}
 123               credPath=${escapeShellArg credPath}
 124               credBase=''${credPath#${storeDir}/*/}
 125               if test -f "$credBase"; then
 126                 if test ! -s "$credBase"; then
 127                   { ${cfg.decrypt}; } |
 128                   { ${cfg.shell} -- ${cfg.encrypt} - -; } |
 129                   { ${cfg.install}; }
 130                 fi
 131               elif test -d "$credBase"; then
 132                 for credBase in "$credBase"/**(.); do
 133                   credBase=''${credBase#${storeDir}/*-}
 134                   if test ! -s "$credBase"; then
 135                     { ${cfg.decrypt}; } |
 136                     { ${cfg.shell} -- ${cfg.encrypt} - -; } |
 137                     { ${cfg.install}; }
 138                   fi
 139                 done
 140               fi
 141             ''
 142           )
 143           service.serviceConfig.LoadCredentialEncrypted)
 144       (attrValues
 145         (filterAttrs
 146           (_serviceName: service:
 147             service.enable &&
 148               hasAttr "LoadCredentialEncrypted" service.serviceConfig
 149           )
 150           config.systemd.services
 151         )
 152       );
 153   };
 154 }