Merge remote-tracking branch 'ni/master'

This commit is contained in:
lassulus 2020-08-06 23:24:29 +02:00
commit e0e91cfd74
17 changed files with 155 additions and 55 deletions

View File

@ -5,7 +5,7 @@
, MPlayerPlugin, ffmpeg, xorg, libpulseaudio, libcanberra-gtk2 , MPlayerPlugin, ffmpeg, xorg, libpulseaudio, libcanberra-gtk2
, jrePlugin, icedtea_web , jrePlugin, icedtea_web
, bluejeans, djview4, adobe-reader , bluejeans, djview4, adobe-reader
, google_talk_plugin, fribid, gnome3/*.gnome-shell*/ , fribid, gnome3/*.gnome-shell*/
, esteidfirefoxplugin ? "" , esteidfirefoxplugin ? ""
, browserpass, chrome-gnome-shell, uget-integrator, plasma-browser-integration, bukubrow , browserpass, chrome-gnome-shell, uget-integrator, plasma-browser-integration, bukubrow
, udev , udev
@ -82,7 +82,6 @@ let
++ lib.optional (cfg.enableMPlayer or false) (MPlayerPlugin browser) ++ lib.optional (cfg.enableMPlayer or false) (MPlayerPlugin browser)
++ lib.optional (supportsJDK && jre && jrePlugin ? mozillaPlugin) jrePlugin ++ lib.optional (supportsJDK && jre && jrePlugin ? mozillaPlugin) jrePlugin
++ lib.optional icedtea icedtea_web ++ lib.optional icedtea icedtea_web
++ lib.optional (cfg.enableGoogleTalkPlugin or false) google_talk_plugin
++ lib.optional (cfg.enableFriBIDPlugin or false) fribid ++ lib.optional (cfg.enableFriBIDPlugin or false) fribid
++ lib.optional (cfg.enableGnomeExtensions or false) gnome3.gnome-shell ++ lib.optional (cfg.enableGnomeExtensions or false) gnome3.gnome-shell
++ lib.optional (cfg.enableBluejeans or false) bluejeans ++ lib.optional (cfg.enableBluejeans or false) bluejeans

View File

@ -26,6 +26,7 @@ let
private_key = mkOption { private_key = mkOption {
type = types.secret-file; type = types.secret-file;
default = { default = {
name = "exim.dkim_private_key/${config.domain}";
path = "/run/krebs.secret/${config.domain}.dkim_private_key"; path = "/run/krebs.secret/${config.domain}.dkim_private_key";
owner.name = "exim"; owner.name = "exim";
source-path = toString <secrets> + "/${config.domain}.dkim.priv"; source-path = toString <secrets> + "/${config.domain}.dkim.priv";
@ -115,8 +116,12 @@ let
})); }));
systemd.services = mkIf (cfg.dkim != []) { systemd.services = mkIf (cfg.dkim != []) {
exim = { exim = {
after = [ "secret.service" ]; after = flip map cfg.dkim (dkim:
requires = [ "secret.service" ]; config.krebs.secret.files."exim.dkim_private_key/${dkim.domain}".service
);
partOf = flip map cfg.dkim (dkim:
config.krebs.secret.files."exim.dkim_private_key/${dkim.domain}".service
);
}; };
}; };
krebs.exim = { krebs.exim = {

View File

@ -56,7 +56,7 @@ let
systemd.services = mapAttrs' (name: repo: systemd.services = mapAttrs' (name: repo:
nameValuePair "konsens-${name}" { nameValuePair "konsens-${name}" {
after = [ "network.target" "secret.service" ]; after = [ "network.target" ];
path = [ pkgs.git ]; path = [ pkgs.git ];
restartIfChanged = false; restartIfChanged = false;
serviceConfig = { serviceConfig = {

View File

@ -124,6 +124,7 @@ let
privateKeyFile = mkOption { privateKeyFile = mkOption {
type = types.secret-file; type = types.secret-file;
default = { default = {
name = "repo-sync-key";
path = "${cfg.stateDir}/ssh.priv"; path = "${cfg.stateDir}/ssh.priv";
owner = cfg.user; owner = cfg.user;
source-path = toString <secrets> + "/repo-sync.ssh.key"; source-path = toString <secrets> + "/repo-sync.ssh.key";
@ -166,7 +167,13 @@ let
}); });
in nameValuePair "repo-sync-${name}" { in nameValuePair "repo-sync-${name}" {
description = "repo-sync"; description = "repo-sync";
after = [ "network.target" "secret.service" ]; after = [
config.krebs.secret.files.repo-sync-key.service
"network.target"
];
partOf = [
config.krebs.secret.files.repo-sync-key.service
];
environment = { environment = {
GIT_SSH_COMMAND = "${pkgs.openssh}/bin/ssh -i ${cfg.stateDir}/ssh.priv"; GIT_SSH_COMMAND = "${pkgs.openssh}/bin/ssh -i ${cfg.stateDir}/ssh.priv";

View File

@ -1,4 +1,5 @@
{ config, lib, pkgs, ... }@args: with import <stockholm/lib>; let with import <stockholm/lib>;
{ config, lib, pkgs, ... }: let
cfg = config.krebs.secret; cfg = config.krebs.secret;
in { in {
options.krebs.secret = { options.krebs.secret = {
@ -8,32 +9,43 @@ in {
}; };
}; };
config = lib.mkIf (cfg.files != {}) { config = lib.mkIf (cfg.files != {}) {
systemd.services.secret = let systemd.paths =
# TODO fail if two files have the same path but differ otherwise mapAttrs'
files = unique (map (flip removeAttrs ["_module"]) (name: file: nameValuePair "secret-trigger-${systemd.encodeName name}" {
(attrValues cfg.files)); wantedBy = ["multi-user.target"];
in { pathConfig.PathChanged = file.source-path;
})
cfg.files;
systemd.services =
mapAttrs'
(name: file: nameValuePair "secret-trigger-${systemd.encodeName name}" {
wantedBy = ["multi-user.target"];
serviceConfig = {
Type = "oneshot";
ExecStart = "${pkgs.systemd}/bin/systemctl restart ${file.service}";
};
})
cfg.files
//
mapAttrs'
(name: file: nameValuePair "secret-${systemd.encodeName name}" {
wantedBy = ["multi-user.target"];
serviceConfig = { serviceConfig = {
Type = "oneshot"; Type = "oneshot";
RemainAfterExit = "yes"; RemainAfterExit = "yes";
SyslogIdentifier = "secret"; ExecStart = toString [
ExecStart = pkgs.writeDash "install-secret-files" '' "${pkgs.coreutils}/bin/install"
exit_code=0 "-D"
${concatMapStringsSep "\n" (file: '' "--compare"
${pkgs.coreutils}/bin/install \ "--verbose"
-D \ "--mode=${file.mode}"
--compare \ "--owner=${file.owner.name}"
--verbose \ "--group=${file.group-name}"
--mode=${shell.escape file.mode} \ file.source-path
--owner=${shell.escape file.owner.name} \ file.path
--group=${shell.escape file.group-name} \ ];
${shell.escape file.source-path} \
${shell.escape file.path} \
|| exit_code=1
'') files}
exit $exit_code
'';
};
}; };
})
cfg.files;
}; };
} }

View File

@ -158,6 +158,7 @@ let
privkey = mkOption { privkey = mkOption {
type = types.secret-file; type = types.secret-file;
default = { default = {
name = "${tinc.config.netname}.rsa_key.priv";
path = "${tinc.config.user.home}/tinc.rsa_key.priv"; path = "${tinc.config.user.home}/tinc.rsa_key.priv";
owner = tinc.config.user; owner = tinc.config.user;
source-path = toString <secrets> + "/${tinc.config.netname}.rsa_key.priv"; source-path = toString <secrets> + "/${tinc.config.netname}.rsa_key.priv";
@ -219,9 +220,14 @@ let
iproute = cfg.iproutePackage; iproute = cfg.iproutePackage;
in { in {
description = "Tinc daemon for ${netname}"; description = "Tinc daemon for ${netname}";
after = [ "network.target" ]; after = [
config.krebs.secret.files."${netname}.rsa_key.priv".service
"network.target"
];
partOf = [
config.krebs.secret.files."${netname}.rsa_key.priv".service
];
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
requires = [ "secret.service" ];
path = [ tinc iproute ]; path = [ tinc iproute ];
serviceConfig = rec { serviceConfig = rec {
Restart = "always"; Restart = "always";

View File

@ -9,8 +9,12 @@
}; };
systemd.services.nix-serve = { systemd.services.nix-serve = {
requires = ["secret.service"]; after = [
after = ["secret.service"]; config.krebs.secret.files.nix-serve-key.service
];
partOf = [
config.krebs.secret.files.nix-serve-key.service
];
}; };
krebs.secret.files.nix-serve-key = { krebs.secret.files.nix-serve-key = {
path = "/run/secret/nix-serve.key"; path = "/run/secret/nix-serve.key";

View File

@ -14,8 +14,12 @@
}; };
systemd.services.mysql = { systemd.services.mysql = {
requires = [ "secret.service" ]; after = [
after = [ "secret.service" ]; config.krebs.secret.files.mysql_rootPassword.service
];
partOf = [
config.krebs.secret.files.mysql_rootPassword.service
];
}; };
lass.mysqlBackup = { lass.mysqlBackup = {

View File

@ -17,6 +17,7 @@ in {
certfile = mkOption { certfile = mkOption {
type = types.secret-file; type = types.secret-file;
default = { default = {
name = "ejabberd-certfile";
path = "${cfg.user.home}/ejabberd.pem"; path = "${cfg.user.home}/ejabberd.pem";
owner = cfg.user; owner = cfg.user;
source-path = "/var/lib/acme/lassul.us/full.pem"; source-path = "/var/lib/acme/lassul.us/full.pem";
@ -25,6 +26,7 @@ in {
dhfile = mkOption { dhfile = mkOption {
type = types.secret-file; type = types.secret-file;
default = { default = {
name = "ejabberd-dhfile";
path = "${cfg.user.home}/dhparams.pem"; path = "${cfg.user.home}/dhparams.pem";
owner = cfg.user; owner = cfg.user;
source-path = "/dev/null"; source-path = "/dev/null";
@ -74,8 +76,15 @@ in {
systemd.services.ejabberd = { systemd.services.ejabberd = {
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
requires = [ "secret.service" ]; after = [
after = [ "network.target" "secret.service" ]; config.krebs.secret.files.ejabberd-certfile.service
config.krebs.secret.files.ejabberd-s2s_certfile.service
"network.target"
];
partOf = [
config.krebs.secret.files.ejabberd-certfile.service
config.krebs.secret.files.ejabberd-s2s_certfile.service
];
serviceConfig = { serviceConfig = {
ExecStartPre = "${gen-dhparam} ${cfg.dhfile.path}"; ExecStartPre = "${gen-dhparam} ${cfg.dhfile.path}";
ExecStart = "${cfg.pkgs.ejabberdctl}/bin/ejabberdctl foreground"; ExecStart = "${cfg.pkgs.ejabberdctl}/bin/ejabberdctl foreground";

View File

@ -8,6 +8,9 @@ let
krebs = import ./krebs lib; krebs = import ./krebs lib;
krops = import ../submodules/krops/lib; krops = import ../submodules/krops/lib;
shell = import ./shell.nix { inherit lib; }; shell = import ./shell.nix { inherit lib; };
systemd = {
encodeName = replaceChars ["/"] ["\\x2f"];
};
types = nixpkgs-lib.types // import ./types.nix { inherit lib; }; types = nixpkgs-lib.types // import ./types.nix { inherit lib; };
xml = import ./xml.nix { inherit lib; }; xml = import ./xml.nix { inherit lib; };

View File

@ -238,7 +238,7 @@ rec {
secret-file = submodule ({ config, ... }: { secret-file = submodule ({ config, ... }: {
options = { options = {
name = mkOption { name = mkOption {
type = filename; type = pathname;
default = config._module.args.name; default = config._module.args.name;
}; };
path = mkOption { path = mkOption {
@ -256,6 +256,10 @@ rec {
type = str; type = str;
default = "root"; default = "root";
}; };
service = mkOption {
type = systemd.unit-name;
default = "secret-${lib.systemd.encodeName config.name}.service";
};
source-path = mkOption { source-path = mkOption {
type = str; type = str;
default = toString <secrets> + "/${config.name}"; default = toString <secrets> + "/${config.name}";
@ -526,6 +530,14 @@ rec {
merge = mergeOneOption; merge = mergeOneOption;
}; };
systemd.unit-name = mkOptionType {
name = "systemd unit name";
check = x:
test "^[0-9A-Za-z:_.\\-]+@?\\.(service|socket|device|mount|automount|swap|target|path|timer|slice|scope)$" x &&
stringLength x <= 256;
merge = mergeOneOption;
};
# RFC952, B. Lexical grammar, <hname> # RFC952, B. Lexical grammar, <hname>
hostname = mkOptionType { hostname = mkOptionType {
name = "hostname"; name = "hostname";

View File

@ -9,8 +9,12 @@
}; };
systemd.services.nix-serve = { systemd.services.nix-serve = {
requires = ["secret.service"]; after = [
after = ["secret.service"]; config.krebs.secret.files.nix-serve-key.service
];
partOf = [
config.krebs.secret.files.nix-serve-key.service
];
}; };
krebs.secret.files.nix-serve-key = { krebs.secret.files.nix-serve-key = {
path = "/run/secret/nix-serve.key"; path = "/run/secret/nix-serve.key";

View File

@ -71,8 +71,12 @@ in
}; };
config = mkIf cfg.enable { config = mkIf cfg.enable {
systemd.services.netdata = { systemd.services.netdata = {
requires = [ "secret.service" ]; after = [
after = [ "secret.service" ]; config.krebs.secret.files.netdata-stream.service
];
partOf = [
config.krebs.secret.files.netdata-stream.service
];
}; };
krebs.secret.files.netdata-stream = { krebs.secret.files.netdata-stream = {
path = "/run/secret/netdata-stream.conf"; path = "/run/secret/netdata-stream.conf";

View File

@ -9,8 +9,12 @@
}; };
systemd.services.nix-serve = { systemd.services.nix-serve = {
requires = ["secret.service"]; after = [
after = ["secret.service"]; config.krebs.secret.files.binary-cache-seckey.service
];
partOf = [
config.krebs.secret.files.binary-cache-seckey.service
];
}; };
krebs.secret.files.binary-cache-seckey = { krebs.secret.files.binary-cache-seckey = {

View File

@ -17,6 +17,7 @@ in {
ssl_dh_params = mkOption { ssl_dh_params = mkOption {
type = types.secret-file; type = types.secret-file;
default = { default = {
name = "charybdis-ssl_dh_params";
path = "${cfg.user.home}/dh.pem"; path = "${cfg.user.home}/dh.pem";
owner = cfg.user; owner = cfg.user;
source-path = toString <secrets> + "/charybdis.dh.pem"; source-path = toString <secrets> + "/charybdis.dh.pem";
@ -25,6 +26,7 @@ in {
ssl_private_key = mkOption { ssl_private_key = mkOption {
type = types.secret-file; type = types.secret-file;
default = { default = {
name = "charybdis-ssl_private_key";
path = "${cfg.user.home}/ssl.key.pem"; path = "${cfg.user.home}/ssl.key.pem";
owner = cfg.user; owner = cfg.user;
source-path = toString <secrets> + "/charybdis.key.pem"; source-path = toString <secrets> + "/charybdis.key.pem";
@ -51,8 +53,15 @@ in {
systemd.services.charybdis = { systemd.services.charybdis = {
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
requires = [ "secret.service" ]; after = [
after = [ "network-online.target" "secret.service" ]; config.krebs.secret.files.charybdis-ssl_dh_params.service
config.krebs.secret.files.charybdis-ssl_private_key.service
"network-online.target"
];
partOf = [
config.krebs.secret.files.charybdis-ssl_dh_params.service
config.krebs.secret.files.charybdis-ssl_private_key.service
];
environment = { environment = {
BANDB_DBPATH = "${cfg.user.home}/ban.db"; BANDB_DBPATH = "${cfg.user.home}/ban.db";
}; };

View File

@ -18,6 +18,7 @@ in {
certfile = mkOption { certfile = mkOption {
type = types.secret-file; type = types.secret-file;
default = { default = {
name = "ejabberd-certfile";
path = "${cfg.user.home}/ejabberd.pem"; path = "${cfg.user.home}/ejabberd.pem";
owner = cfg.user; owner = cfg.user;
source-path = toString <secrets> + "/ejabberd.pem"; source-path = toString <secrets> + "/ejabberd.pem";
@ -26,6 +27,7 @@ in {
dhfile = mkOption { dhfile = mkOption {
type = types.secret-file; type = types.secret-file;
default = { default = {
name = "ejabberd-dhfile";
path = "${cfg.user.home}/dhparams.pem"; path = "${cfg.user.home}/dhparams.pem";
owner = cfg.user; owner = cfg.user;
source-path = "/dev/null"; source-path = "/dev/null";
@ -95,8 +97,15 @@ in {
systemd.services.ejabberd = { systemd.services.ejabberd = {
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
requires = [ "secret.service" ]; after = [
after = [ "network.target" "secret.service" ]; config.krebs.secret.files.ejabberd-certfile.service
config.krebs.secret.files.ejabberd-s2s_certfile.service
"network.target"
];
partOf = [
config.krebs.secret.files.ejabberd-certfile.service
config.krebs.secret.files.ejabberd-s2s_certfile.service
];
serviceConfig = { serviceConfig = {
ExecStartPre = "${gen-dhparam} ${cfg.dhfile.path}"; ExecStartPre = "${gen-dhparam} ${cfg.dhfile.path}";
ExecStart = "${cfg.pkgs.ejabberd}/bin/ejabberdctl foreground"; ExecStart = "${cfg.pkgs.ejabberd}/bin/ejabberdctl foreground";

View File

@ -12,6 +12,7 @@ in {
enable = mkEnableOption "tv.x0vncserver"; enable = mkEnableOption "tv.x0vncserver";
pwfile = mkOption { pwfile = mkOption {
default = { default = {
name = "x0vncserver-pwfile";
owner = cfg.user; owner = cfg.user;
path = "${cfg.user.home}/.vncpasswd"; path = "${cfg.user.home}/.vncpasswd";
source-path = toString <secrets> + "/vncpasswd"; source-path = toString <secrets> + "/vncpasswd";
@ -36,8 +37,16 @@ in {
x0vncserver-pwfile = cfg.pwfile; x0vncserver-pwfile = cfg.pwfile;
}; };
systemd.services.x0vncserver = { systemd.services.x0vncserver = {
after = [ "graphical.target" "secret.service" ]; after = [
requires = [ "graphical.target" "secret.service" ]; config.krebs.secret.files.x0vncserver-pwfile.service
"graphical.target"
];
partOf = [
config.krebs.secret.files.x0vncserver-pwfile.service
];
requires = [
"graphical.target"
];
serviceConfig = { serviceConfig = {
ExecStart = "${pkgs.tigervnc}/bin/x0vncserver ${toString [ ExecStart = "${pkgs.tigervnc}/bin/x0vncserver ${toString [
"-display ${cfg.display}" "-display ${cfg.display}"