From 194aa78bd74ef2c37ac004a469a414a0cb299046 Mon Sep 17 00:00:00 2001 From: lilly Date: Tue, 29 Oct 2024 21:12:24 +0100 Subject: [PATCH 1/3] maintainers: add lilioid --- maintainers/maintainer-list.nix | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix index bfacf3aae0c3..f441dee3b9fb 100644 --- a/maintainers/maintainer-list.nix +++ b/maintainers/maintainer-list.nix @@ -12338,6 +12338,13 @@ githubId = 101508537; name = "Yuchen He"; }; + lilioid = { + name = "Lilly"; + email = "li@lly.sh"; + matrix = "@17sell:mafiasi.de"; + github = "lilioid"; + githubId = 12398140; + }; LilleAila = { name = "Olai"; email = "olai@olai.dev"; From 904ffed79eccc1adb4d6ba3176a7ff08d2d86555 Mon Sep 17 00:00:00 2001 From: lilly Date: Wed, 30 Oct 2024 21:27:47 +0100 Subject: [PATCH 2/3] nm-file-secret-agent: init at v1.0.0 A small program that can provide secrets based on configured files contents to NetworkManager. This allows protected values to be stored outside of the profile definitions while still configuring the connection itself declaratively. For more information and use-case description see https://git.lly.sh/lilly/nm-file-secret-agent --- .../nm/nm-file-secret-agent/package.nix | 34 +++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 pkgs/by-name/nm/nm-file-secret-agent/package.nix diff --git a/pkgs/by-name/nm/nm-file-secret-agent/package.nix b/pkgs/by-name/nm/nm-file-secret-agent/package.nix new file mode 100644 index 000000000000..beef2962e903 --- /dev/null +++ b/pkgs/by-name/nm/nm-file-secret-agent/package.nix @@ -0,0 +1,34 @@ +{ + lib, + fetchFromGitHub, + rustPlatform, + dbus, + networkmanager, + pkg-config, + nix-update-script, +}: +rustPlatform.buildRustPackage rec { + name = "nm-file-secret-agent"; + version = "1.0.0"; + + src = fetchFromGitHub { + owner = "lilioid"; + repo = "nm-file-secret-agent"; + rev = "v${version}"; + hash = "sha256-5L4bhf6nsINZD+oINC1f71P2cebPG7bzDYtlsU8UMMk="; + }; + cargoHash = "sha256-SlYz55hc9HEueN7AYVpqadxQjI0hERcdQSJ7rEPnbVE="; + buildInputs = [ dbus ]; + nativeBuildInputs = [ pkg-config ]; + + passthru.updateScript = nix-update-script { }; + + meta = { + description = "NetworkManager secret agent that responds with the content of preconfigured files"; + mainProgram = "nm-file-secret-agent"; + homepage = "https://github.com/lilioid/nm-file-secret-agent/"; + license = lib.licenses.mit; + maintainers = with lib.maintainers; [ lilioid ]; + platforms = lib.lists.intersectLists dbus.meta.platforms networkmanager.meta.platforms; + }; +} From 24e0db1ba99d906ca7351031eed248082f2e6e8d Mon Sep 17 00:00:00 2001 From: lilly Date: Fri, 1 Nov 2024 19:12:59 +0100 Subject: [PATCH 3/3] nixos/networkmanager: add nm-file-secret-agent options nm-file-secret agent is a small agent that can supply secrets of connection profiles to NetworkManager by reading the contents of preconfigured files. These files could be supplied e.g. by nixos-sops or any other mechanism. --- nixos/modules/module-list.nix | 1 + .../networking/nm-file-secret-agent.nix | 131 ++++++++++++++++++ 2 files changed, 132 insertions(+) create mode 100644 nixos/modules/services/networking/nm-file-secret-agent.nix diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index a014c93afede..514e006111ee 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -1146,6 +1146,7 @@ ./services/networking/nixops-dns.nix ./services/networking/nncp.nix ./services/networking/nntp-proxy.nix + ./services/networking/nm-file-secret-agent.nix ./services/networking/nomad.nix ./services/networking/nsd.nix ./services/networking/ntopng.nix diff --git a/nixos/modules/services/networking/nm-file-secret-agent.nix b/nixos/modules/services/networking/nm-file-secret-agent.nix new file mode 100644 index 000000000000..8d9b8fee3c54 --- /dev/null +++ b/nixos/modules/services/networking/nm-file-secret-agent.nix @@ -0,0 +1,131 @@ +{ + config, + lib, + pkgs, + ... +}: +let + cfg = config.networking.networkmanager; + toml = pkgs.formats.toml { }; + + enabled = (lib.length cfg.ensureProfiles.secrets.entries) > 0; + + nmFileSecretAgentConfig = { + entry = builtins.map ( + i: + { + key = i.key; + file = i.file; + } + // lib.optionalAttrs (i.matchId != null) { match_id = i.matchId; } + // lib.optionalAttrs (i.matchUuid != null) { match_uuid = i.matchUuid; } + // lib.optionalAttrs (i.matchType != null) { match_type = i.matchType; } + // lib.optionalAttrs (i.matchIface != null) { match_iface = i.matchIface; } + // lib.optionalAttrs (i.matchSetting != null) { + match_setting = i.matchSetting; + } + ) cfg.ensureProfiles.secrets.entries; + }; + nmFileSecretAgentConfigFile = toml.generate "config.toml" nmFileSecretAgentConfig; +in +{ + meta = { + maintainers = [ lib.maintainers.lilioid ]; + }; + + ####### interface + options = { + networking.networkmanager.ensureProfiles.secrets = { + package = lib.mkPackageOption pkgs "nm-file-secret-agent" { }; + entries = lib.mkOption { + description = '' + A list of secrets to provide to NetworkManager by reading their values from configured files. + + Note that NetworkManager should be configured to read secrets from a secret agent. + This can be done for example through the `networking.networkmanager.ensureProfiles.profiles` options. + ''; + default = [ ]; + example = [ + { + matchId = "My WireGuard VPN"; + matchType = "wireguard"; + matchSetting = "wireguard"; + key = "private-key"; + file = "/root/wireguard_key"; + } + ]; + type = lib.types.listOf ( + lib.types.submodule { + options = { + matchId = lib.mkOption { + description = '' + connection id used by NetworkManager. Often displayed as name in GUIs. + + NetworkManager describes this as a human readable unique identifier for the connection, like "Work Wi-Fi" or "T-Mobile 3G". + ''; + type = lib.types.nullOr lib.types.str; + default = null; + example = "wifi1"; + }; + matchUuid = lib.mkOption { + description = '' + UUID of the connection profile + + UUIDs are assigned once on connection creation and should never change as long as the connection still applies to the same network. + ''; + type = lib.types.nullOr lib.types.str; + default = null; + example = "669ea4c9-4cb3-4901-ab52-f9606590976e"; + }; + matchType = lib.mkOption { + description = '' + NetworkManager connection type + + The NetworkManager configuration settings reference roughly corresponds to connection types. + More might be available on your system depending on the installed plugins. + + https://networkmanager.dev/docs/api/latest/ch01.html + ''; + type = lib.types.nullOr lib.types.str; + default = null; + example = "wireguard"; + }; + matchIface = lib.mkOption { + description = "interface name of the NetworkManager connection"; + type = lib.types.nullOr lib.types.str; + default = null; + }; + matchSetting = lib.mkOption { + description = "name of the setting section for which secrets are requested"; + type = lib.types.nullOr lib.types.str; + default = null; + }; + key = lib.mkOption { + description = "key in the setting section for which this entry provides a value"; + type = lib.types.str; + }; + file = lib.mkOption { + description = "file from which the secret value is read"; + type = lib.types.str; + }; + }; + } + ); + }; + }; + }; + + ####### implementation + config = lib.mkIf enabled { + # start nm-file-secret-agent if required + systemd.services."nm-file-secret-agent" = { + description = "NetworkManager secret agent that responds with the content of preconfigured files"; + documentation = [ "https://github.com/lilioid/nm-file-secret-agent/" ]; + requires = [ "NetworkManager.service" ]; + after = [ "NetworkManager.service" ]; + wantedBy = [ "multi-user.target" ]; + restartTriggers = [ nmFileSecretAgentConfigFile ]; + script = "${lib.getExe cfg.ensureProfiles.secrets.package} --conf ${nmFileSecretAgentConfigFile}"; + }; + }; +}