WIP

hosts/bekkalokk/services/gitea/web-secret-provider/default.nix

@@ -1,51 +1,41 @@
 { config, pkgs, lib, ... }:
 let
-  organizations = [
+  sops.secrets = {
-     "Drift"
+    "gitea/web-secret-provider/Drift" = {
-     "Projects"
+      owner = "gitea";
-     "Kurs"
+      group = "gitea";
-  ];
+      restartUnits = [ "gitea-web-secret-provider@Drift" ];
+    };
+    "gitea/web-secret-provider/Projects" = {
+      owner = "gitea";
+      group = "gitea";
+      restartUnits = [ "gitea-web-secret-provider@Projects" ];
+    };
+    "gitea/web-secret-provider/Kurs" = {
+      owner = "gitea";
+      group = "gitea";
+      restartUnits = [ "gitea-web-secret-provider@Kurs" ];
+  };
 
   cfg = config.services.gitea;
 
   program = pkgs.writers.writePython3 "gitea-web-secret-provider" {
     libraries = with pkgs.python3Packages; [ requests ];
-    flakeIgnore = [
-      "E501" # Line over 80 chars lol
-      "E201" # "whitespace after {" < this looks better bruh
-      "E202" # "whitespace after }" < brot
-      "E251" # unexpected spaces around keyword / parameter equals < megabrot
-      "W391" # Newline at end of file < nei vil ikke
-    ];
     makeWrapperArgs = [
       "--prefix PATH : ${(lib.makeBinPath [ pkgs.openssh ])}"
     ];
-  } (lib.pipe ./gitea-web-secret-provider.py [
+  } (builtins.readFile ./gitea-web-secret-provider.py);
-    builtins.readFile
-    (lib.splitString "\n")
-    (lib.drop 2)
-    lib.concatLines
-  ]);
 in
 {
-  sops.secrets."gitea/web-secret-provider/token" = {
-    owner = "gitea";
-    group = "gitea";
-    restartUnits = [
-      "gitea-web-secret-provider@.service"
-      "gitea-web-secret-provider@.timer"
-    ]
-    ++ (map (org: "gitea-web-secret-provider@${org}.service") organizations)
-    ++ (map (org: "gitea-web-secret-provider@${org}.timer") organizations);
-  };
 
   # https://www.freedesktop.org/software/systemd/man/latest/systemd.unit.html#Specifiers
   # %i - instance name (after the @)
   # %d - secrets directory
-  # %S - /var/lib
+  # %s - /var/lib
   systemd.services = {
     "gitea-web-secret-provider@" = {
       description = "Gitea web secret provider";
+      wantedBy = [ "multi-user.target" ];
       requires = [ "gitea.service" "network.target" ];
       serviceConfig = {
         Type = "oneshot";
@@ -54,18 +44,18 @@ in
             org = "%i";
             token-path = "%d/token";
             api-url = "${cfg.settings.server.ROOT_URL}api/v1";
-            key-dir = "%S/%i/keys";
+            key-dir = "%s/%i/keys";
-            authorized-keys-path = "%S/gitea-web/authorized_keys.d/%i";
+            authorized-keys-path = "%s/gitea-web/authorized_keys.d/%i";
             rrsync-path = "${pkgs.rrsync}/bin/rrsync";
-            web-dir = "%S/gitea-web/web";
+            web-dir = "%s/gitea-web/web";
           };
         in "${program} ${args}";
         User = "gitea";
         Group = "gitea";
-        StateDirectory = "%i";
+        Restart = "always";
-        LoadCredential = [
+
-          "token:${config.sops.secrets."gitea/web-secret-provider/token".path}"
+        StateDir = "%i";
-        ];
+        WorkingDirectory = "%s/%i";
 
         # Hardening
         NoNewPrivileges = true;
@@ -83,30 +73,28 @@ in
         LockPersonality = true;
       };
     };
-  };
+  }
+  //
+  builtins.listToAttrs (map (org: lib.nameValuePair "gitea-web-secret-provider@${org}" {
+      serviceConfig.LoadCredential = [
+        "token:${config.sops.secrets."gitea/web-secret-provider/${org}".path}"
+      ];
+  }));
 
   systemd.timers = {
     "gitea-web-secret-provider@" = {
       description = "Run the Gitea web secret provider";
       wantedBy = [ "timers.target" ];
       timerConfig = {
+        OnCalendar = "daily";
         RandomizedDelaySec = "1h";
         Persistent = true;
         Unit = "gitea-web-secret-provider@%i.service";
-        OnCalendar = "daily";
       };
     };
-  };
+  }
-
+  //
-  systemd.targets.timers.wants = map (org: "gitea-web-secret-provider@${org}.timer") organizations;
+  builtins.listToAttrs (map (org: lib.nameValuePair "gitea-web-secret-provider@${org}" { }));
-
-  systemd.tmpfiles.settings."10-gitea-web-secret-provider"."/var/lib/gitea-web/authorized_keys.d".d = {
-    user = "gitea";
-    group = "gitea";
-    mode = "700";
-  };
-
-  services.openssh.authorizedKeysFiles = map (org: "/var/lib/gitea-web/authorized_keys.d/${org}") organizations;
 
   # services.nginx.virtualHosts.
 }

hosts/bekkalokk/services/gitea/web-secret-provider/gitea-web-secret-provider.py

@@ -102,4 +102,4 @@ def main():
 
 
 if __name__ == "__main__":
-    main()
+    main()

secrets/bekkalokk/bekkalokk.yaml

@@ -1,6 +1,4 @@
 gitea:
-    web-secret-provider:
-        token: ENC[AES256_GCM,data:pHmBKxrNcLifl4sjR44AGEElfdachja35Tl/InsqvBWturaeTv4R0w==,iv:emBWfXQs2VNqtpDp5iA5swNC+24AWDYYXo6nvN+Fwx4=,tag:lkhSVSs6IqhHpfDPOX0wQA==,type:str]
     password: ENC[AES256_GCM,data:hlNzdU1ope0t50/3aztyLeXjMHd2vFPpwURX+Iu8f49DOqgSnEMtV+KtLA==,iv:qljRnSnchL5cFmaUAfCH9GQYQxcy5cyWejgk1x6bFgI=,tag:tIhboFU5kZsj5oAQR3hLbw==,type:str]
     database: ENC[AES256_GCM,data:UlS33IdCEyeSvT6ngpmnkBWHuSEqsB//DT+3b7C+UwbD8UXWJlsLf1X8/w==,iv:mPRW5ldyZaHP+y/0vC2JGSLZmlkhgmkvXPk4LazkSDs=,tag:gGk6Z/nbPvzE1zG+tJC8Sw==,type:str]
     email-password: ENC[AES256_GCM,data:KRwC+aL1aPvJuXt91Oq1ttATMnFTnuUy,iv:ats8TygB/2pORkaTZzPOLufZ9UmvVAKoRcWNvYF1z6w=,tag:Do0fA+4cZ3+l7JJyu8hjBg==,type:str]
@@ -92,8 +90,8 @@ sops:
             UHpLRkdQTnhkeGlWVG9VS1hkWktyckEKAdwnA9URLYZ50lMtXrU9Q09d0L3Zfsyr
             4UsvjjdnFtsXwEZ9ZzOQrpiN0Oz24s3csw5KckDni6kslaloJZsLGg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-08-13T19:49:24Z"
+    lastmodified: "2024-05-26T02:07:41Z"
-    mac: ENC[AES256_GCM,data:AeJ53D+8A8mHYRmVHdqhcS1ZTbqVe5gQqJsJjMk4T/ZlNX8/V4M9mqAW2FB9m/JSdj234gDu+PBHcW70ZrCqeVsoUW/ETVgUX3W2gBmBgYJiRETp8I7/eks/5YEV6vIIxQsZNP/9dZTNX4T2wD74ELl23NSTXA/6k2tyzBlTMYo=,iv:DABafHvw+5w0PHCKqLgpwmQnv0uHOTyj+s8gdnHFTZ4=,tag:SNZ7W+6zdyuuv2AB9ir8eg==,type:str]
+    mac: ENC[AES256_GCM,data:CRaJefV1zcJc6eyzyjTLgd0+Wv46VT8o4iz2YAGU+c2b/Cr97Tj290LoEO6UXTI3uFwVfzii2yZ2l+4FK3nVVriD4Cx1O/9qWcnLa5gfK30U0zof6AsJx8qtGu1t6oiPlGUCF7sT0BW9Wp8cPumrY6cZp9QbhmIDV0o0aJNUNN4=,iv:8OSYV1eG6kYlJD4ovZZhcD1GaYnmy7vHPa/+7egM1nE=,tag:OPI13rpDh2l1ViFj8TBFWg==,type:str]
     pgp:
         - created_at: "2024-08-04T00:03:28Z"
           enc: |-
@@ -116,4 +114,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: F7D37890228A907440E1FD4846B9228E814A2AAC
     unencrypted_suffix: _unencrypted
-    version: 3.9.0
+    version: 3.8.1