Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Do not render templates when decrypting neededForUsers secrets #664

Merged
merged 2 commits into from
Nov 17, 2024
Merged

Do not render templates when decrypting neededForUsers secrets #664

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4a81322
Do not render templates when decrypting `neededForUsers` secrets
jfly Nov 11, 2024
b359b09
Merge branch 'master' into issue-659-fix
mergify[bot] Nov 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 6 additions & 5 deletions modules/home-manager/sops.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
let
cfg = config.sops;
sops-install-secrets = (pkgs.callPackage ../.. {}).sops-install-secrets;
secretType = lib.types.submodule ({ config, name, ... }: {
secretType = lib.types.submodule ({ name, ... }: {
options = {
name = lib.mkOption {
type = lib.types.str;
Expand Down Expand Up @@ -71,10 +71,11 @@ let
merge = lib.mergeEqualOption;
};

manifestFor = suffix: secrets: pkgs.writeTextFile {
manifestFor = suffix: secrets: templates: pkgs.writeTextFile {
name = "manifest${suffix}.json";
text = builtins.toJSON {
secrets = builtins.attrValues secrets;
templates = builtins.attrValues templates;
secretsMountPoint = cfg.defaultSecretsMountPoint;
symlinkPath = cfg.defaultSymlinkPath;
keepGenerations = cfg.keepGenerations;
Expand All @@ -93,11 +94,11 @@ let
'';
};

manifest = manifestFor "" cfg.secrets;
manifest = manifestFor "" cfg.secrets cfg.templates;

escapedAgeKeyFile = lib.escapeShellArg cfg.age.keyFile;

script = toString (pkgs.writeShellScript "sops-nix-user" ((lib.optionalString cfg.age.generateKey ''
script = toString (pkgs.writeShellScript "sops-nix-user" (lib.optionalString cfg.age.generateKey ''
if [[ ! -f ${escapedAgeKeyFile} ]]; then
echo generating machine-specific age key...
${pkgs.coreutils}/bin/mkdir -p $(${pkgs.coreutils}/bin/dirname ${escapedAgeKeyFile})
Expand All @@ -106,7 +107,7 @@ let
fi
'' + ''
${sops-install-secrets}/bin/sops-install-secrets -ignore-passwd ${manifest}
'')));
''));
in {
options.sops = {
secrets = lib.mkOption {
Expand Down
7 changes: 5 additions & 2 deletions modules/sops/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ let
inherit cfg;
inherit (pkgs) writeTextFile;
};
manifest = manifestFor "" regularSecrets {};
manifest = manifestFor "" regularSecrets regularTemplates {};

pathNotInStore = lib.mkOptionType {
name = "pathNotInStore";
Expand All @@ -20,6 +20,9 @@ let

regularSecrets = lib.filterAttrs (_: v: !v.neededForUsers) cfg.secrets;

# Currently, all templates are "regular" (there's no support for `neededForUsers` for templates.)
regularTemplates = cfg.templates;

useSystemdActivation = (options.systemd ? sysusers && config.systemd.sysusers.enable) ||
(options.services ? userborn && config.services.userborn.enable);

Expand Down Expand Up @@ -354,7 +357,7 @@ in {

sops.environment.SOPS_GPG_EXEC = lib.mkIf (cfg.gnupg.home != null || cfg.gnupg.sshKeyPaths != []) (lib.mkDefault "${pkgs.gnupg}/bin/gpg");

# When using sysusers we no longer be started as an activation script because those are started in initrd while sysusers is started later.
# When using sysusers we no longer are started as an activation script because those are started in initrd while sysusers is started later.
systemd.services.sops-install-secrets = lib.mkIf (regularSecrets != { } && useSystemdActivation) {
wantedBy = [ "sysinit.target" ];
after = [ "systemd-sysusers.service" ];
Expand Down
4 changes: 2 additions & 2 deletions modules/sops/manifest-for.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,12 @@
{ writeTextFile, cfg }:

suffix: secrets: extraJson:
suffix: secrets: templates: extraJson:

writeTextFile {
name = "manifest${suffix}.json";
text = builtins.toJSON ({
secrets = builtins.attrValues secrets;
templates = builtins.attrValues templates;
# Does this need to be configurable?
secretsMountPoint = "/run/secrets.d";
symlinkPath = "/run/secrets";
Expand All @@ -15,7 +16,6 @@ writeTextFile {
ageKeyFile = cfg.age.keyFile;
ageSshKeyPaths = cfg.age.sshKeyPaths;
useTmpfs = cfg.useTmpfs;
templates = cfg.templates;
placeholderBySecretName = cfg.placeholder;
userMode = false;
logging = {
Expand Down
3 changes: 2 additions & 1 deletion modules/sops/secrets-for-users/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,14 +2,15 @@
let
cfg = config.sops;
secretsForUsers = lib.filterAttrs (_: v: v.neededForUsers) cfg.secrets;
templatesForUsers = {}; # We do not currently support `neededForUsers` for templates.
manifestFor = pkgs.callPackage ../manifest-for.nix {
inherit cfg;
inherit (pkgs) writeTextFile;
};
withEnvironment = import ../with-environment.nix {
inherit cfg lib;
};
manifestForUsers = manifestFor "-for-users" secretsForUsers {
manifestForUsers = manifestFor "-for-users" secretsForUsers templatesForUsers {
secretsMountPoint = "/run/secrets-for-users.d";
symlinkPath = "/run/secrets-for-users";
};
Expand Down
24 changes: 13 additions & 11 deletions pkgs/sops-install-secrets/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@ type template struct {

type manifest struct {
Secrets []secret `json:"secrets"`
Templates map[string]*template `json:"templates"`
Templates []template `json:"templates"`
PlaceholderBySecretName map[string]string `json:"placeholderBySecretName"`
SecretsMountPoint string `json:"secretsMountPoint"`
SymlinkPath string `json:"symlinkPath"`
Expand Down Expand Up @@ -185,7 +185,7 @@ func linksAreEqual(linkTarget, targetFile string, info os.FileInfo, owner int, g
return linkTarget == targetFile && validUG
}

func symlinkSecret(targetFile string, path string, owner int, group int, userMode bool) error {
func createSymlink(targetFile string, path string, owner int, group int, userMode bool) error {
for {
stat, err := os.Lstat(path)
if os.IsNotExist(err) {
Expand Down Expand Up @@ -217,7 +217,7 @@ func symlinkSecret(targetFile string, path string, owner int, group int, userMod
}
}

func symlinkSecrets(targetDir string, secrets []secret, templates map[string]*template, userMode bool) error {
func symlinkSecretsAndTemplates(targetDir string, secrets []secret, templates []template, userMode bool) error {
for _, secret := range secrets {
targetFile := filepath.Join(targetDir, secret.Name)
if targetFile == secret.Path {
Expand All @@ -227,7 +227,7 @@ func symlinkSecrets(targetDir string, secrets []secret, templates map[string]*te
if err := os.MkdirAll(parent, os.ModePerm); err != nil {
return fmt.Errorf("cannot create parent directory of '%s': %w", secret.Path, err)
}
if err := symlinkSecret(targetFile, secret.Path, secret.owner, secret.group, userMode); err != nil {
if err := createSymlink(targetFile, secret.Path, secret.owner, secret.group, userMode); err != nil {
return fmt.Errorf("failed to symlink secret '%s': %w", secret.Path, err)
}
}
Expand All @@ -241,7 +241,7 @@ func symlinkSecrets(targetDir string, secrets []secret, templates map[string]*te
if err := os.MkdirAll(parent, os.ModePerm); err != nil {
return fmt.Errorf("cannot create parent directory of '%s': %w", template.Path, err)
}
if err := symlinkSecret(targetFile, template.Path, template.owner, template.group, userMode); err != nil {
if err := createSymlink(targetFile, template.Path, template.owner, template.group, userMode); err != nil {
return fmt.Errorf("failed to symlink template '%s': %w", template.Path, err)
}
}
Expand Down Expand Up @@ -610,8 +610,9 @@ func (app *appContext) validateSecret(secret *secret) error {
return app.validateSopsFile(secret, &file)
}

func renderTemplates(templates map[string]*template, secretByPlaceholder map[string]*secret) {
for _, template := range templates {
func renderTemplates(templates []template, secretByPlaceholder map[string]*secret) {
for i := range templates {
template := &templates[i]
rendered := renderTemplate(&template.content, secretByPlaceholder)
template.value = []byte(rendered)
}
Expand Down Expand Up @@ -702,7 +703,8 @@ func (app *appContext) validateManifest() error {
}
}

for _, template := range m.Templates {
for i := range m.Templates {
template := &m.Templates[i]
if err := app.validateTemplate(template); err != nil {
return err
}
Expand Down Expand Up @@ -893,7 +895,7 @@ func symlinkWalk(filename string, linkDirname string, walkFn filepath.WalkFunc)
return filepath.Walk(filename, symWalkFunc)
}

func handleModifications(isDry bool, logcfg loggingConfig, symlinkPath string, secretDir string, secrets []secret, templates map[string]*template) error {
func handleModifications(isDry bool, logcfg loggingConfig, symlinkPath string, secretDir string, secrets []secret, templates []template) error {
var restart []string
var reload []string

Expand Down Expand Up @@ -1148,7 +1150,7 @@ func replaceRuntimeDir(path, rundir string) (ret string) {
return
}

func writeTemplates(targetDir string, templates map[string]*template, keysGID int, userMode bool) error {
func writeTemplates(targetDir string, templates []template, keysGID int, userMode bool) error {
for _, template := range templates {
fp := filepath.Join(targetDir, template.Name)

Expand Down Expand Up @@ -1302,7 +1304,7 @@ func installSecrets(args []string) error {
if isDry {
return nil
}
if err := symlinkSecrets(manifest.SymlinkPath, manifest.Secrets, manifest.Templates, manifest.UserMode); err != nil {
if err := symlinkSecretsAndTemplates(manifest.SymlinkPath, manifest.Secrets, manifest.Templates, manifest.UserMode); err != nil {
return fmt.Errorf("failed to prepare symlinks to secret store: %w", err)
}
if err := atomicSymlink(*secretDir, manifest.SymlinkPath); err != nil {
Expand Down
4 changes: 4 additions & 0 deletions pkgs/sops-install-secrets/nixos-test.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -266,6 +266,10 @@ in {
age.keyFile = "/run/age-keys.txt";
defaultSopsFile = ./test-assets/secrets.yaml;
secrets.test_key = { };

# Verify that things work even with `neededForUsers` secrets. See
# <https://github.com/Mic92/sops-nix/issues/659>.
secrets."nested/test/file".neededForUsers = true;
};

# must run before sops sets up keys
Expand Down