fail2ban: update whitelist

[sourcephile-nix.git] / shell / modules / tools / security / gnupg.nix

diff --git a/shell/modules/tools/security/gnupg.nix b/shell/modules/tools/security/gnupg.nix
index 4c2f3b1921efc476fb3d04cdd66044d03e4fae71..f096017e142f1afaf30628d511a476b9809992c5 100644 (file)
--- a/shell/modules/tools/security/gnupg.nix
+++ b/shell/modules/tools/security/gnupg.nix
@@ -14,13 +14,14 @@ let
    , expire ? "-"
    , passPath
    , subKeys ? {}
+   , postRun ? ""
    , ...
    }@primary:
     ''
     info "generateKey uid=\"${uid}\""
     if ! ${gpg-with-home}/bin/gpg-with-home --list-secret-keys -- "=${uid}" >/dev/null 2>/dev/null
      then
-      ${pkgs.pass}/bin/pass "${passPath}" |
+      ${if passPath != "" then "${pkgs.pass}/bin/pass '${passPath}'" else "cat /dev/null"} |
       ${gpg-with-home}/bin/gpg-with-home \
         --batch --pinentry-mode loopback --passphrase-fd 0 \
         --quick-generate-key "${uid}" "${algo}" "${unwords usage}" "${expire}"
@@ -35,6 +36,7 @@ let
     ''
     + unlines (map (generateSubKey primary) subKeys)
     + generateBackupKey "$fpr" primary
+    + postRun
     ;
   generateSubKey =
    primary:
@@ -47,7 +49,7 @@ let
     info "  generateSubKey usage=[${unwords usage}]"
     if ! printf '%s\n' "$caps" | ${pkgs.gnugrep}/bin/grep -Fqx "${lettersKeyUsage usage}"
      then
-      ${pkgs.pass}/bin/pass "${primary.passPath}" |
+      ${if primary.passPath != "" then "${pkgs.pass}/bin/pass '${primary.passPath}'" else "cat /dev/null"} |
       ${gpg-with-home}/bin/gpg-with-home \
         --batch --pinentry-mode loopback --passphrase-fd 0 \
         --quick-add-key "$fpr" "${algo}" "${unwords usage}" "${expire}"
@@ -74,9 +76,10 @@ let
      fi
     '' + (if backupRecipients == [""] then
     ''
-    if ! test -s "${gnupg.gnupgHome}/backup/${uid}/${fpr}.revoke.asc"
+    if ! test -s "${gnupg.gnupgHome}/backup/${uid}/${fpr}.revoke.asc" &&
+     ${gpg-with-home}/bin/gpg-with-home --list-secret-keys "${fpr}" | grep -q "sec "
      then
-      ${pkgs.pass}/bin/pass "${passPath}" |
+      ${if passPath != "" then "${pkgs.pass}/bin/pass '${passPath}'" else "cat /dev/null"} |
       ${gpg-with-home}/bin/gpg-with-home \
         --pinentry-mode loopback --passphrase-fd 0 \
         --armor --yes --output "${gnupg.gnupgHome}/backup/${uid}/${fpr}.revoke.asc" \
@@ -84,7 +87,7 @@ let
      fi
     if ! test -s "${gnupg.gnupgHome}/backup/${uid}/${fpr}.privkey.sec"
      then
-      ${pkgs.pass}/bin/pass "${passPath}" |
+      ${if passPath != "" then "${pkgs.pass}/bin/pass '${passPath}'" else "cat /dev/null"} |
       ${gpg-with-home}/bin/gpg-with-home \
         --batch --pinentry-mode loopback --passphrase-fd 0 \
         --armor --yes --output "${gnupg.gnupgHome}/backup/${uid}/${fpr}.privkey.sec" \
@@ -93,7 +96,7 @@ let
      fi
     if ! test -s "${gnupg.gnupgHome}/backup/${uid}/${fpr}.subkeys.sec"
      then
-      ${pkgs.pass}/bin/pass "${passPath}" |
+      ${if passPath != "" then "${pkgs.pass}/bin/pass '${passPath}'" else "cat /dev/null"} |
       ${gpg-with-home}/bin/gpg-with-home \
         --batch --pinentry-mode loopback --passphrase-fd 0 \
         --armor --yes --output "${gnupg.gnupgHome}/backup/${uid}/${fpr}.subkeys.sec" \
@@ -103,7 +106,7 @@ let
     '' else ''
     if ! test -s "${gnupg.gnupgHome}/backup/${uid}/${fpr}.revoke.asc.gpg"
      then
-      ${pkgs.pass}/bin/pass "${passPath}" |
+      ${if passPath != "" then "${pkgs.pass}/bin/pass '${passPath}'" else "cat /dev/null"} |
       ${gpg-with-home}/bin/gpg-with-home \
         --pinentry-mode loopback --passphrase-fd 0 \
         --armor --gen-revoke "${fpr}" |
@@ -112,7 +115,7 @@ let
      fi
     if ! test -s "${gnupg.gnupgHome}/backup/${uid}/${fpr}.privkey.sec.gpg"
      then
-      ${pkgs.pass}/bin/pass "${passPath}" |
+      ${if passPath != "" then "${pkgs.pass}/bin/pass '${passPath}'" else "cat /dev/null"} |
       ${gpg-with-home}/bin/gpg-with-home \
         --batch --pinentry-mode loopback --passphrase-fd 0 \
         --armor --export-options export-backup \
@@ -122,7 +125,7 @@ let
      fi
     if ! test -s "${gnupg.gnupgHome}/backup/${uid}/${fpr}.subkeys.sec.gpg"
      then
-      ${pkgs.pass}/bin/pass "${passPath}" |
+      ${if passPath != "" then "${pkgs.pass}/bin/pass '${passPath}'" else "cat /dev/null"} |
       ${gpg-with-home}/bin/gpg-with-home \
         --batch --pinentry-mode loopback --passphrase-fd 0 \
         --armor --export-options export-backup \
@@ -298,13 +301,12 @@ options.gnupg = {
           backupRecipients = ["@john@doe.pro"];
         };
       };
-    type = types.attrsOf (types.submodule ({uid, ...}: {
-      #config.uid = lib.mkDefault uid;
+    type = types.attrsOf (types.submodule ({name, ...}: {
       options = {
         uid = lib.mkOption {
           type        = types.str;
           example     = "John Doe <john.doe@example.coop>";
-          default     = uid;
+          default     = name;
           description = ''
             User ID.
           '';
@@ -319,7 +321,7 @@ options.gnupg = {
         };
         expire = lib.mkOption {
           type        = types.str;
-          default     = "1y";
+          default     = "0";
           example     = "1y";
           description = ''
             Expiration timeout.
@@ -353,7 +355,7 @@ options.gnupg = {
               };
               expire = lib.mkOption {
                 type        = types.str;
-                default     = "1y";
+                default     = "0";
                 example     = "1y";
                 description = ''
                   Expiration timeout.
@@ -378,6 +380,13 @@ options.gnupg = {
             Backup keys used to encrypt the a backup copy of the secret keys.
           '';
         };
+        postRun = lib.mkOption {
+          type = types.lines;
+          default = "";
+          description = ''
+            Shell code to run after the key has been generated or tested to exist.
+          '';
+        };
       };
     }));
   };