depot/ops/nixos/lib/vault-agent-acme.nix

# SPDX-FileCopyrightText: 2020 Luke Granger-Brown <depot@lukegb.com>
#
# SPDX-License-Identifier: Apache-2.0

{ pkgs, config, depot, lib, ... }:
let
  inherit (lib) mkOption types mkBefore optionalAttrs;

  # Work out where we're being asked to write things, and which groups, so we can correctly get permissions.
  certPath = c: pathFor c.certificate c "cert.pem";
  keyPath = c: pathFor c.certificate c "privkey.pem";
  pathFor = p: c: suffix: if isNull p.path then "/var/lib/acme/${c.name}/${suffix}" else p.path;

  acmeCertificatesGroups = lib.unique (lib.filter (x: x != "") (builtins.concatMap (c: [ c.certificate.group c.key.group ]) config.my.vault.acmeCertificates));

  acmeCertificatesTemplate = builtins.concatMap (c: let
    secretStanza = ''
      secret "acme/certs/${c.role}" "common_name=${c.name}" "alternative_names=${builtins.concatStringsSep "," (builtins.sort builtins.lessThan c.extraNames)}"
    '';
  in [
    {
      # Certificate
      contents = ''
        {{with ${secretStanza}}}
        {{ .Data.cert }}{{ end }}
      '';
      destination = certPath c;
      perms = c.certificate.mode;
      command = pkgs.writeShellScript "post-${c.name}-crt" ''
        ${lib.optionalString (c.certificate.group != "") ''
          chgrp "${c.certificate.group}" "${certPath c}"
        ''}
        ${lib.concatMapStringsSep "\n" (x: ''
          /run/current-system/sw/bin/systemctl reload-or-restart ${x}
        '') c.reloadOrRestartUnits}
        ${lib.concatMapStringsSep "\n" (x: ''
          /run/current-system/sw/bin/systemctl restart ${x}
        '') c.restartUnits}
        ${lib.optionalString (c.command != "") c.command}
      '';
    } {
      # Key
      contents = ''
        {{with ${secretStanza}}}
        {{ .Data.private_key }}{{ end }}
      '';
      destination = keyPath c;
      perms = c.key.mode;
      command = pkgs.writeShellScript "post-${c.name}-key" ''
        ${lib.optionalString (c.key.group != "") ''
          chgrp "${c.key.group}" "${keyPath c}"
        ''}
      '';
    }
  ]) config.my.vault.acmeCertificates;

  acmeCertificatesTmpdirs = lib.unique (builtins.concatMap (c:
    let
      certDir = dirOf (certPath c);
      keyDir  = dirOf (keyPath c);

      dirGroup = if certDir == keyDir && c.certificate.makeDir && c.key.makeDir then if c.certificate.group == c.key.group then c.certificate.group else "-" else null;

      certDirGroup = if isNull dirGroup then c.certificate.group else dirGroup;
      keyDirGroup  = if isNull dirGroup then c.certificate.group else dirGroup;
    in lib.optional c.certificate.makeDir "d ${certDir} 0750 vault-agent ${certDirGroup} - -"
    ++ lib.optional c.key.makeDir         "d ${keyDir}  0750 vault-agent ${keyDirGroup}  - -"
  ) config.my.vault.acmeCertificates);

  allRestartableUnits = lib.unique (builtins.concatMap (c: c.reloadOrRestartUnits ++ c.restartUnits) config.my.vault.acmeCertificates);
in
{
  options.my.vault.acmeCertificates = mkOption {
    type = with types; listOf (submodule {
      options = let
        fileType = what: defaultMode: submodule {
          options = {
            path = mkOption {
              type = nullOr path;
              default = null;
              description = "Path to put the ${what}.";
            };
            mode = mkOption {
              type = str;
              default = defaultMode;
              description = "Mode to set for the ${what}.";
            };

            group = mkOption {
              type = str;
              default = "acme";
              description = "Owner group to set for the ${what}.";
            };

            makeDir = mkOption {
              type = bool;
              default = true;
              description = "If true, creates the parent directory.";
            };
          };
        };
      in {
        role = mkOption { 
          type = str;
          default = "letsencrypt-prod-cloudflare";
          description = "Which role to use for certificate issuance.";
        };
        name = mkOption {
          type = str;
          description = "First hostname for the certificate.";
        };
        extraNames = mkOption {
          type = listOf str;
          default = [];
          description = "Non-empty list of hostnames to include.";
        };

        command = mkOption {
          type = lines;
          default = "";
          description = "Command to run after generating the certificate.";
        };
        reloadOrRestartUnits = mkOption {
          type = listOf str;
          default = [];
          description = "List of systemd units to reload/restart after obtaining a new certificate.";
        };
        restartUnits = mkOption {
          type = listOf str;
          default = [];
          description = "List of systemd units to restart after obtaining a new certificate.";
        };

        certificate = mkOption {
          type = fileType "certificate" "0644";
          default = {};
        };
        key = mkOption {
          type = fileType "certificate's key" "0640";
          default = {};
        };
      };
    });
    default = [];
  };

  config = {
    my.vault.settings = {
      template = mkBefore acmeCertificatesTemplate;
    };

    systemd = optionalAttrs config.my.vault.enable {
      services.vault-agent = {
        serviceConfig = {
          SupplementaryGroups = mkBefore acmeCertificatesGroups;
        };
      };

      tmpfiles.rules = acmeCertificatesTmpdirs;
    };

    security.polkit.extraConfig = lib.mkAfter ''
      // NixOS module: depot/lib/vault-agent-acme.nix
      polkit.addRule(function(action, subject) {
        if (action.id !== "org.freedesktop.systemd1.manage-units" ||
            subject.user !== "vault-agent") {
          return polkit.Result.NOT_HANDLED;
        }

        var verb = action.lookup("verb");
        if (verb !== "restart" && verb !== "reload-or-restart") {
          return polkit.Result.NOT_HANDLED;
        }

        var allowedUnits = ${builtins.toJSON allRestartableUnits};
        var unit = action.lookup("unit");
        for (var i = 0; i < allowedUnits.length; i++) {
          if (allowedUnits[i] === unit) {
            return polkit.Result.YES;
          }
        }
        return polkit.Result.NOT_HANDLED;
      });
    '';
  };
}