new secrets-management system

2 files changed, 49 insertions, 0 deletions

diff --git a/modules/secrets/nixos/default.nix b/modules/secrets/nixos/default.nix
new file mode 100644
index 0000000..e5e6662
--- /dev/null
+++ b/modules/secrets/nixos/default.nix
@@ -0,0 +1,17 @@
+{
+  inputs,
+  config,
+  ...
+}: let
+  cfg = config.collinux.secrets;
+in {
+  imports = [
+    inputs.agenix.nixosModules.default
+  ];
+
+  age = {
+    identityPaths = ["/etc/ssh/ssh_host_ed25519_key"];
+    secretsDir = "/run/secrets.d";
+    secrets = cfg;
+  };
+}
diff --git a/modules/secrets/options.nix b/modules/secrets/options.nix
new file mode 100644
index 0000000..de15f50
--- /dev/null
+++ b/modules/secrets/options.nix
@@ -0,0 +1,32 @@
+{lib, ...}: let
+  inherit (lib) mkOption;
+in {
+  options = {
+    collinux.secrets = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.submodule ({config, ...}: {
+          options = {
+            name = mkOption {
+              type = lib.types.str;
+              default = config._module.args.name;
+            };
+            file = mkOption {type = lib.types.path;};
+            mode = mkOption {
+              type = lib.types.str;
+              default = "0400";
+            };
+            owner = mkOption {
+              type = lib.types.str;
+              default = "0";
+            };
+            path = mkOption {
+              type = lib.types.str;
+              default = "/run/secrets.d/${config.name}";
+            };
+          };
+        })
+      );
+      default = {};
+    };
+  };
+}