mirror of https://cgit.krebsco.de/krops
Compare commits
4 Commits
Author | SHA1 | Date |
---|---|---|
tv | a6c7ecd8ba | |
lassulus | cbc475bdf4 | |
Lassulus | 1c524b6727 | |
fuu0 | 9c0d53cf44 |
26
README.md
26
README.md
|
@ -6,6 +6,7 @@ krops is a lightweight toolkit to deploy NixOS systems, remotely or locally.
|
|||
## Some Features
|
||||
|
||||
- store your secrets in [password store](https://www.passwordstore.org/)
|
||||
or [passage](https://github.com/FiloSottile/passage)
|
||||
- build your systems remotely
|
||||
- minimal overhead (it's basically just `nixos-rebuild switch`!)
|
||||
- run from custom nixpkgs branch/checkout/fork
|
||||
|
@ -96,7 +97,7 @@ pkgs.krops.writeDeploy "deploy" {
|
|||
}
|
||||
```
|
||||
For more details about the `target` attribute, please check the `mkTarget`
|
||||
function in [lib/default.nix](lib/defaults.nix).
|
||||
function in [lib/default.nix](lib/default.nix).
|
||||
|
||||
### `backup` (optional, defaults to false)
|
||||
|
||||
|
@ -298,6 +299,29 @@ Supported attributes:
|
|||
sub-directory in the password store.
|
||||
|
||||
|
||||
### `passage`
|
||||
|
||||
The passage source type decrypts files from a local
|
||||
[passage store](https://github.com/FiloSottile/passage)
|
||||
and transfers them to the target using
|
||||
[`rsync`](https://rsync.samba.org/).
|
||||
|
||||
Supported attributes:
|
||||
|
||||
* `dir` -
|
||||
Path to the passage store.
|
||||
For a partial transfer, this may point to a subdirectory.
|
||||
Example: `~/.passage/store/hosts/MYHOSTNAME`
|
||||
|
||||
* `identities_file` (optional) -
|
||||
Path to the identities file.
|
||||
Defaults to `~/.passage/identities`.
|
||||
|
||||
* `age` (optional) -
|
||||
Path of the age binary.
|
||||
Defaults to `age` (absolute path gets resolved using `passage`'s search path.)
|
||||
|
||||
|
||||
### `pipe`
|
||||
|
||||
Executes a local command, capture its stdout, and send that as a file to the
|
||||
|
|
|
@ -0,0 +1,27 @@
|
|||
{
|
||||
"nodes": {
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1689940971,
|
||||
"narHash": "sha256-397xShPnFqPC59Bmpo3lS+/Aw0yoDRMACGo1+h2VJMo=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "9ca785644d067445a4aa749902b29ccef61f7476",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"nixpkgs": "nixpkgs"
|
||||
}
|
||||
}
|
||||
},
|
||||
"root": "root",
|
||||
"version": 7
|
||||
}
|
|
@ -0,0 +1,29 @@
|
|||
{
|
||||
description = "krops - krebs operations";
|
||||
|
||||
inputs = {
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
|
||||
};
|
||||
|
||||
outputs = { self, nixpkgs, ... }:
|
||||
let
|
||||
supportedSystems = [
|
||||
"x86_64-linux"
|
||||
"i686-linux"
|
||||
"aarch64-linux"
|
||||
"riscv64-linux"
|
||||
];
|
||||
forAllSystems = nixpkgs.lib.genAttrs supportedSystems;
|
||||
in
|
||||
{
|
||||
lib = forAllSystems (system:
|
||||
let
|
||||
pkgs = nixpkgs.legacyPackages.${system};
|
||||
krops = pkgs.callPackage ./pkgs/krops {};
|
||||
populate = pkgs.callPackage ./pkgs/populate {};
|
||||
in {
|
||||
inherit populate;
|
||||
inherit (krops) rebuild runShell withNixOutputMonitor writeCommand writeDeploy writeTest;
|
||||
});
|
||||
};
|
||||
}
|
|
@ -39,6 +39,17 @@
|
|||
default = null;
|
||||
type = lib.types.nullOr source-types.pass;
|
||||
};
|
||||
passage = lib.mkOption {
|
||||
apply = x:
|
||||
if lib.types.pathname.check x
|
||||
then { dir = x; }
|
||||
else x;
|
||||
default = null;
|
||||
type = lib.types.nullOr (lib.types.oneOf [
|
||||
lib.types.pathname
|
||||
source-types.passage
|
||||
]);
|
||||
};
|
||||
pipe = lib.mkOption {
|
||||
apply = x:
|
||||
if lib.types.absolute-pathname.check x
|
||||
|
@ -160,6 +171,21 @@
|
|||
};
|
||||
};
|
||||
};
|
||||
passage = lib.types.submodule {
|
||||
options = {
|
||||
age = lib.mkOption {
|
||||
default = "age";
|
||||
type = lib.types.pathname;
|
||||
};
|
||||
dir = lib.mkOption {
|
||||
type = lib.types.pathname;
|
||||
};
|
||||
identities_file = lib.mkOption {
|
||||
default = toString ~/.passage/identities;
|
||||
type = lib.types.pathname;
|
||||
};
|
||||
};
|
||||
};
|
||||
pipe = lib.types.submodule {
|
||||
options = {
|
||||
command = lib.mkOption {
|
||||
|
|
|
@ -1,7 +1,7 @@
|
|||
with import ../../lib;
|
||||
with shell;
|
||||
|
||||
{ coreutils, dash, findutils, git, jq, openssh, pass, rsync, writers }:
|
||||
{ coreutils, dash, findutils, git, jq, openssh, pass, passage, rsync, writers }:
|
||||
|
||||
let
|
||||
check = { force, target }: let
|
||||
|
@ -171,6 +171,37 @@ let
|
|||
${rsync' target rsyncDefaultConfig /* sh */ "$tmp_dir"}
|
||||
'';
|
||||
|
||||
pop.passage = target: source: /* sh */ ''
|
||||
set -efu
|
||||
|
||||
export PASSAGE_AGE=${quote source.age}
|
||||
export PASSAGE_DIR=${quote source.dir}
|
||||
export PASSAGE_IDENTITIES_FILE=${quote source.identities_file}
|
||||
|
||||
umask 0077
|
||||
|
||||
tmp_dir=$(${coreutils}/bin/mktemp -dt populate-passage.XXXXXXXX)
|
||||
trap cleanup EXIT
|
||||
cleanup() {
|
||||
rm -fR "$tmp_dir"
|
||||
}
|
||||
|
||||
${findutils}/bin/find "$PASSAGE_DIR" -type f -name \*.age -follow |
|
||||
while read -r age_path; do
|
||||
|
||||
rel_name=''${age_path#$PASSAGE_DIR}
|
||||
rel_name=''${rel_name%.age}
|
||||
|
||||
tmp_path=$tmp_dir/$rel_name
|
||||
|
||||
${coreutils}/bin/mkdir -p "$(${coreutils}/bin/dirname "$tmp_path")"
|
||||
${passage}/bin/passage show "$rel_name" > "$tmp_path"
|
||||
${coreutils}/bin/touch -r "$age_path" "$tmp_path"
|
||||
done
|
||||
|
||||
${rsync' target rsyncDefaultConfig /* sh */ "$tmp_dir"}
|
||||
'';
|
||||
|
||||
pop.pipe = target: source: /* sh */ ''
|
||||
${quote source.command} | {
|
||||
${runShell target /* sh */ "cat > ${quote target.path}"}
|
||||
|
|
Loading…
Reference in New Issue