fix(secrets): Default secret permissions to 0440
The default age permissions for secrets block the "group" from accessing
the secret, making that option useless without additionally specifying a
mode
This fixes that issue
Change-Id: I10a49b4c82bab32696d5508c02e31b8782021238
Reviewed-on: https://git.clicks.codes/c/Infra/NixFiles/+/807
Tested-by: Skyler Grey <minion@clicks.codes>
Reviewed-by: Skyler Grey <minion@clicks.codes>
diff --git a/modules/nixos/clicks/security/secrets/groupPerms/default.nix b/modules/nixos/clicks/security/secrets/groupPerms/default.nix
new file mode 100644
index 0000000..1f176ac
--- /dev/null
+++ b/modules/nixos/clicks/security/secrets/groupPerms/default.nix
@@ -0,0 +1,27 @@
+{ config, lib, ... }: {
+ options.clicks.security.secrets.groupPerms.enable = lib.mkOption {
+ description = ''
+ Enable setting permissions for age secrets to 0440 rather than 0400 by
+ default, allowing group access
+
+ The default age permissions for secrets block the "group" from accessing
+ the secret, making that option useless without additionally specifying a
+ mode
+ '';
+ type = lib.types.bool;
+ default = config.clicks.security.secrets.enable;
+ };
+
+ options.age = {
+ secrets = lib.mkOption {
+ type = lib.types.attrsOf (lib.types.submodule (submodule: {
+ config = {
+ mode = lib.pipe "0440" [
+ (lib.mkOverride 999)
+ (lib.mkIf config.clicks.security.secrets.groupPerms.enable)
+ ];
+ };
+ }));
+ };
+ };
+}