Luke Granger-Brown
7592e76a31
tokend is responsible for issuing service-scoped tokens based on the token held and generated by the Vault Agent. It can also generate "server-user" scoped tokens, which exist for convenience's sake: they are not a strong attestation of the user on the machine, and have limited privileges compared to a Vault token issued using e.g. `vault login -method=oidc`.
40 lines
883 B
Nix
40 lines
883 B
Nix
{ lib, config, ... }:
|
|
|
|
let
|
|
inherit (lib) mkOption types mkMerge mapAttrsToList mkBefore;
|
|
in {
|
|
options.my.apps = mkOption {
|
|
type = types.attrsOf (types.submodule ({ name, ... }: {
|
|
options = {
|
|
resourceName = mkOption {
|
|
type = types.str;
|
|
default = "app_${name}";
|
|
internal = true;
|
|
};
|
|
|
|
policy = mkOption {
|
|
type = types.lines;
|
|
};
|
|
};
|
|
|
|
config = {
|
|
policy = mkBefore ''
|
|
path "kv/data/apps/${name}" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "kv/metadata/apps/${name}" {
|
|
capabilities = ["read"]
|
|
}
|
|
'';
|
|
};
|
|
}));
|
|
};
|
|
|
|
config.resource = mkMerge (mapAttrsToList (appName: appCfg: {
|
|
vault_policy.${appCfg.resourceName} = {
|
|
name = "app/${appName}";
|
|
policy = appCfg.policy;
|
|
};
|
|
}) config.my.apps);
|
|
}
|