NixOS modules for using systemd credentials as versatile, local only secrets management. Generate and Template credential files at runtime, Reload services on change
- Rust 58.1%
- Nix 41.9%
nixos-credentials
NixOS modules for using systemd credentials as versatile, local only secrets management. Generate and Template credential files at runtime, Reload services on change.
Examples
{
nixos-credentials.generate.foo = {
path = "/path/to/credential";
length = 64; # Default
characterSet = "base64"; # Default
};
nixos-credentials.generate.bar = {
reload = [ "bar.service" ]; # Runs systemctl try-reload-or-restart bar.service
path = "/path/to/other/credential";
length = 4;
};
nixos-credentials.template.foobar = {
reload = [ "foobar.service" ]; # Runs systemctl try-reload-or-restart foobar.service
# Uses systemd.path(5) to regenerate the template when any input changes
inputs = {
foo = "/path/to/credential";
bar = "/path/to/other/credential";
manual-credential = "/path/to/manually/written/credential";
};
# Use `contentFile` to read the template string from a nix store path
contents = ''
foo: {{ foo }}
${builtins.toJSON {
# Use url_encode_user_info, url_encode_path and url_encode_component to template
# inputs into urls
bar = "https://this/is/url/safe/{{ url_encode_user_info bar }}";
# Use json_encode_string to template inputs into json strings
manual = "{{ json_encode_string manual-credential }}";
}} '';
};
systemd.services.foo.serviceConfig.LoadCredential = [ "credential:/path/to/credential" ];
systemd.services.bar.serviceConfig.LoadCredential = [
"credential:/path/to/other/credential"
# Same as "credential:${config.nixos-credentials.generate.bar.path}"
];
systemd.services.foobar.serviceConfig.LoadCredential = [
# systemd automatically finds the template output file in /run/credstore/
"credential-template-foobar"
# Same as "${config.nixos-credentials.template.foobar.passthru.credentialName}"
# systemd's behavior differs for credentials with a path, if the template didn't exist
# only this variant would fail the service.
"also-the-template:/run/credstore/credential-template-foobar"
# Same as "also-the-template:${config.nixos-credentials.template.foobar.passthru.outputPath}"
];
}
results in
$ cat /path/to/credential
0GKmSxk7Hx8oSzxelUlhCERis1v18eD7x=DO8v6GJq+RO6i=XuhOFmArWebIBblA
$ cat /path/to/other/credential
3PK=
$ cat /path/to/manually/written/credential
"json fun"
$ cat /run/credstore/credential-template-foobar
foo: 0GKmSxk7Hx8oSzxelUlhCERis1v18eD7x=DO8v6GJq+RO6i=XuhOFmArWebIBblA
{"bar":"https://this/is/url/safe/3PK%3D","manual":"\"json fun!\""}
Installing
The recommended way to install nixos-credentials is using flakes:
{
inputs.nixos-credentials.url = "git+https://codeberg.org/networkException/nixos-credentials";
}
{ inputs, ... }: {
imports = [
nixos-credentials.nixosModules.default
];
nixos-credentials.generate # ...
}
If you prefer a different options attribute over nixos-credentials, use the following:
{ inputs, ... }: {
imports = [
(nixos-credentials.nixosModules.withAttribute [ "infra" "credentials" ])
];
infra.credentials.generate # ...
}
History
This project is the combination of two smaller projects:
LICENSE
This project is licensed under the BSD 2-Clause "Simplified" License.
The license texts and file annotations get maintained using the REUSE SOFTWARE tool. See REUSE.toml.
Contributors are encouraged to add their own name to the copyright annotations of files they contribute to! Please use the following command for that purpose:
# Optional: Get the reuse tool from nix
$ nix develop
$ reuse annotate --license BSD-2-Clause --copyright-prefix spdx-string --merge-copyrights --copyright "Your Name" path/to/file