ab5aebb161
Extracted modules: - Matrix homeserver (matrix-continuwuity.nix) - mautrix bridges (slack, whatsapp, gmessages) - Security modules (fail2ban, ssh-hardening) - Development services module - Matrix secrets module All modules sanitized to remove personal information: - Domains: example.com, matrix.example.org - IPs: 10.0.0.x, 203.0.113.10 - Paths: /home/user, /path/to/ops-base - Emails: admin@example.com Configuration: - Updated flake.nix with sops-nix and nixpkgs-unstable - Updated hosts/ops-jrz1.nix to import all extracted modules - Added example files (secrets, minimal config) - Generated flake.lock Generated with Claude Code - https://claude.com/claude-code
63 lines
1.8 KiB
Nix
63 lines
1.8 KiB
Nix
{ lib, config, ... }:
|
|
|
|
{
|
|
options.matrix.secrets = lib.mkOption {
|
|
type = lib.types.attrsOf (lib.types.submodule (
|
|
{ name, ... }:
|
|
{ options = {
|
|
enable = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = true;
|
|
description = "Enable this Matrix secret.";
|
|
};
|
|
key = lib.mkOption {
|
|
type = lib.types.str;
|
|
description = "Key inside secrets/secrets.yaml.";
|
|
};
|
|
path = lib.mkOption {
|
|
type = lib.types.str;
|
|
description = "Path where decrypted secret should be written.";
|
|
};
|
|
user = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = name;
|
|
description = "Owner user for the secret file.";
|
|
};
|
|
group = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = name;
|
|
description = "Owner group for the secret file.";
|
|
};
|
|
mode = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "0400";
|
|
description = "File permission mode.";
|
|
};
|
|
};
|
|
}
|
|
));
|
|
default = {};
|
|
description = "Declarative mapping of Matrix service secrets to sops entries.";
|
|
};
|
|
|
|
config = let
|
|
secrets = config.matrix.secrets;
|
|
in {
|
|
assertions = [
|
|
{
|
|
assertion = lib.all (secret: lib.hasAttr "key" secret && lib.hasAttr "path" secret) (lib.attrValues secrets);
|
|
message = "Each matrix secret must define both `key` and `path`.";
|
|
}
|
|
];
|
|
|
|
sops.secrets = lib.mapAttrs' (_: secret:
|
|
lib.nameValuePair secret.key {
|
|
inherit (secret) path;
|
|
owner = secret.user;
|
|
group = secret.group;
|
|
mode = secret.mode;
|
|
}
|
|
) secrets;
|
|
};
|
|
}
|