fix(secrets): Default secret permissions to 0440
The default age permissions for secrets block the "group" from accessing
the secret, making that option useless without additionally specifying a
mode
This fixes that issue
Change-Id: I10a49b4c82bab32696d5508c02e31b8782021238
Reviewed-on: https://git.clicks.codes/c/Infra/NixFiles/+/807
Tested-by: Skyler Grey <minion@clicks.codes>
Reviewed-by: Skyler Grey <minion@clicks.codes>
diff --git a/modules/nixos/clicks/security/secrets/groupPerms/default.nix b/modules/nixos/clicks/security/secrets/groupPerms/default.nix
new file mode 100644
index 0000000..1f176ac
--- /dev/null
+++ b/modules/nixos/clicks/security/secrets/groupPerms/default.nix
@@ -0,0 +1,27 @@
+{ config, lib, ... }: {
+ options.clicks.security.secrets.groupPerms.enable = lib.mkOption {
+ description = ''
+ Enable setting permissions for age secrets to 0440 rather than 0400 by
+ default, allowing group access
+
+ The default age permissions for secrets block the "group" from accessing
+ the secret, making that option useless without additionally specifying a
+ mode
+ '';
+ type = lib.types.bool;
+ default = config.clicks.security.secrets.enable;
+ };
+
+ options.age = {
+ secrets = lib.mkOption {
+ type = lib.types.attrsOf (lib.types.submodule (submodule: {
+ config = {
+ mode = lib.pipe "0440" [
+ (lib.mkOverride 999)
+ (lib.mkIf config.clicks.security.secrets.groupPerms.enable)
+ ];
+ };
+ }));
+ };
+ };
+}
diff --git a/systems/x86_64-linux/teal/default.nix b/systems/x86_64-linux/teal/default.nix
index 0bd7bd4..4cceeca 100644
--- a/systems/x86_64-linux/teal/default.nix
+++ b/systems/x86_64-linux/teal/default.nix
@@ -294,21 +294,17 @@
age.secrets."clicks.services.headscale.oidc.client_secret_path" = {
rekeyFile = ./clicks.services.headscale.oidc.client_secret_path.age;
group = "headscale";
- mode = "440";
};
age.secrets."clicks.services.headscale.database_password_path" = {
rekeyFile = ./clicks.services.headscale.database_password_path.age;
group = "headscale";
- mode = "440";
};
age.secrets."clicks.services.headscale.noise_private_key_path" = {
rekeyFile = ./clicks.services.headscale.noise_private_key_path.age;
group = "headscale";
- mode = "440";
};
age.secrets."clicks.services.headscale.private_key_path" = {
rekeyFile = ./clicks.services.headscale.private_key_path.age;
group = "headscale";
- mode = "440";
};
}