feat(modules): Add host-info and secrets as nixosModules

flake.nix

@@ -240,6 +240,9 @@
           machinesDir ? null,
           usersDir ? null,
         }:
+        let
+          utils = import ./lib { inherit usersDir rootDir machinesDir; };
+        in
         {
           dirs = {
             lib = self + "/lib";
@@ -256,7 +259,11 @@
                 usersDir
                 ;
             };
-            utils = import ./lib { inherit usersDir rootDir machinesDir; };
+            inherit utils;
+          };
+
+          modules = {
+            users = import ./modules/users.nix utils;
           };
         };
     };

modules/default.nix

@@ -6,5 +6,7 @@
     ./folder-size-metrics
     ./shard-split
     ./random-alerts
+    ./host-info.nix
+    ./secrets.nix
   ];
 }

modules/host-info.nix

@@ -1,56 +1,71 @@
+{ withSystem, ... }:
 {
-  config,
-  lib,
-  ...
-}:
-{
-  options.mcl.host-info = with lib; {
-    type = mkOption {
-      type = types.nullOr (
-        types.enum [
-          "desktop"
-          "server"
-        ]
-      );
-      default = null;
-      example = [ "desktop" ];
-      description = ''
-        Whether this host is a desktop or a server.
-      '';
-    };
+  flake.modules.nixos.mcl-host-info =
+    {
+      config,
+      lib,
+      ...
+    }:
+    {
+      options.mcl.host-info = with lib; {
+        type = mkOption {
+          type = types.nullOr (
+            types.enum [
+              "desktop"
+              "server"
+              "container"
+            ]
+          );
+          default = null;
+          example = [ "desktop" ];
+          description = ''
+            Whether this host is a desktop or a server.
+          '';
+        };
 
-    isVM = mkOption {
-      type = types.nullOr types.bool;
-      default = null;
-      example = [ "false" ];
-      description = ''
-        Whether this configuration is a VM variant.
-      '';
-    };
+        isDebugVM = mkOption {
+          type = types.nullOr types.bool;
+          default = null;
+          example = [ "false" ];
+          description = ''
+            Whether this configuration is a VM variant with extra debug
+            functionality.
+          '';
+        };
+
+        configPath = mkOption {
+          type = types.nullOr types.path;
+          default = null;
+          example = [ "machines/server/solunska-server" ];
+          description = ''
+            The configuration path for this host relative to the repo root.
+          '';
+        };
 
-    configPath = mkOption {
-      type = types.nullOr types.string;
-      default = null;
-      example = [ "machines/server/solunska-server" ];
-      description = ''
-        The configuration path for this host relative to the repo root.
-      '';
+        sshKey = mkOption {
+          type = types.nullOr types.str;
+          default = "";
+          example = "ssh-ed25519 AAAAC3Nza";
+          description = ''
+            The public ssh key for this host.
+          '';
+        };
+      };
+      config = {
+        assertions = [
+          {
+            assertion = config.mcl.host-info.type != null;
+            message = "mcl.host-info.type must be defined for every host";
+          }
+          {
+            assertion = config.mcl.host-info.isDebugVM != null;
+            message = "mcl.host-info.isDebugVM must be defined for every host";
+          }
+          {
+            assertion = config.mcl.host-info.configPath != null;
+            message = "mcl.host-info.configPath must be defined for every host";
+          }
+        ];
+      };
     };
-  };
-  config = {
-    assertions = [
-      {
-        assertion = config.mcl.host-info.type != null;
-        message = "mcl.host-info.type must be defined for every host";
-      }
-      {
-        assertion = config.mcl.host-info.isVM != null;
-        message = "mcl.host-info.isVM must be defined for every host";
-      }
-      {
-        assertion = config.mcl.host-info.configPath != null;
-        message = "mcl.host-info.configPath must be defined for every host";
-      }
-    ];
-  };
 }

modules/secrets.nix

@@ -0,0 +1,126 @@
+{ withSystem, inputs, ... }:
+{
+  flake.modules.nixos.mcl-secrets =
+    {
+      config,
+      options,
+      lib,
+      dirs,
+      ...
+    }:
+    let
+      eachServiceCfg = config.mcl.secrets.services;
+      isDebugVM = config.mcl.host-info.isDebugVM;
+
+      sshKey =
+        if isDebugVM then
+          config.virtualisation.vmVariant.mcl.host-info.sshKey
+        else
+          config.mcl.host-info.sshKey;
+
+      ageSecretOpts = builtins.head (builtins.head options.age.secrets.type.nestedTypes.elemType.getSubModules)
+      .imports;
+
+      secretDir =
+        let
+          machineConfigPath = config.mcl.host-info.configPath;
+          machineSecretDir = machineConfigPath + "/secrets";
+          vmConfig = dirs.modules + "/default-vm-config";
+          vmSecretDir = vmConfig + "/secrets";
+        in
+        if isDebugVM then vmSecretDir else machineSecretDir;
+    in
+    {
+      imports = [
+        inputs.agenix.nixosModules.default
+      ];
+
+      options.mcl.secrets = with lib; {
+        services = mkOption {
+          type = types.attrsOf (
+            types.submodule (
+              { config, ... }:
+              let
+                serviceName = config._module.args.name;
+              in
+              {
+                options = {
+                  encryptedSecretDir = mkOption {
+                    type = types.path;
+                    default = secretDir;
+                  };
+                  secrets = mkOption {
+                    default = { };
+                    type = types.attrsOf (
+                      types.submoduleWith {
+                        modules = [
+                          ageSecretOpts
+                          (
+                            { name, ... }:
+                            let
+                              secretName = name;
+                            in
+                            {
+                              config = {
+                                name = "${serviceName}/${secretName}";
+                                file = lib.mkDefault (config.encryptedSecretDir + "/${serviceName}/${secretName}.age");
+                              };
+                            }
+                          )
+                        ];
+                      }
+                    );
+                  };
+                  extraKeys = mkOption {
+                    type = types.listOf types.str;
+                    default = [ ];
+                    example = [
+                      "ssh-ed25519 AAAAC3Nza"
+                      "ssh-ed25519 AAAACSNss"
+                    ];
+                    description = "Extra keys which can decrypt the secrets.";
+                  };
+                  nix-file = mkOption {
+                    default = builtins.toFile "${serviceName}-secrets.nix" ''
+                      let
+                        hostKey = ["${sshKey}"];
+                        extraKeys = ["${concatStringsSep "\"\"" config.extraKeys}"];
+                      in {
+                        ${concatMapStringsSep "\n" (n: "\"${n}.age\".publicKeys = hostKey ++ extraKeys;") (
+                          builtins.attrNames config.secrets
+                        )}
+                      }
+                    '';
+                    type = types.path;
+                  };
+                };
+              }
+            )
+          );
+          default = { };
+          example = {
+            service1.secrets.secretA = { };
+            service1.secrets.secretB = { };
+            service2.secrets.secretC = { };
+            cachix-deploy.secrets.token = {
+              path = "/etc/cachix-agent.token";
+            };
+          };
+          description = mdDoc "Per-service attrset of encryptedSecretDir and secrets";
+        };
+      };
+
+      config = lib.mkIf (eachServiceCfg != { }) {
+        age.secrets = lib.pipe eachServiceCfg [
+          (lib.mapAttrsToList (
+            serviceName: service:
+            lib.mapAttrsToList (
+              secretName: config: lib.nameValuePair "${serviceName}/${secretName}" config
+            ) service.secrets
+          ))
+          lib.concatLists
+          lib.listToAttrs
+        ];
+      };
+    };
+}

modules/users.nix

@@ -1,8 +1,4 @@
-{
-  usersDir,
-  rootDir,
-  machinesDir,
-}:
+utils:
 {
   config,
   lib,
@@ -12,7 +8,6 @@ let
   cfg = config.users;
   enabled = cfg.includedUsers != [ ] || cfg.includedGroups != [ ];
 
-  utils = import ../lib { inherit usersDir rootDir machinesDir; };
   allUsers = utils.usersInfo;
   allGroups =
     let

packages/default.nix

@@ -61,6 +61,7 @@
         }
         // optionalAttrs (system == "x86_64-linux" || system == "aarch64-darwin") {
           grafana-agent = import ./grafana-agent { inherit inputs'; };
+          secret = import ./secret { inherit inputs' pkgs; };
         }
         // optionalAttrs isLinux {
           folder-size-metrics = pkgs.callPackage ./folder-size-metrics { };