yadunut/clan-core
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

clan-cli secrets: generate secrets inside bubblewrap

Browse Source
This commit is contained in:
lassulus
2024-01-24 19:19:02 +01:00
parent a91504f0b2
commit 1b9445b71f
1 changed files with 17 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
pkgs/clan-cli/clan_cli/secrets/generate.py
View File

@@ -42,11 +42,25 @@ def generate_secrets(machine: Machine) -> None:
secrets_dir = tmpdir / "secrets" secrets_dir = tmpdir / "secrets"
secrets_dir.mkdir(parents=True) secrets_dir.mkdir(parents=True)
env["secrets"] = str(secrets_dir) env["secrets"] = str(secrets_dir)
# TODO use bubblewrap here # fmt: off
cmd = nix_shell( cmd = nix_shell(
["nixpkgs#bash"], [
["bash", "-c", machine.secrets_data[service]["generator"]], "nixpkgs#bash",
"nixpkgs#bubblewrap",
],
[
"bwrap",
"--ro-bind", "/nix/store", "/nix/store",
"--tmpfs", "/usr/lib/systemd",
"--dev", "/dev",
"--bind", str(facts_dir), str(facts_dir),
"--bind", str(secrets_dir), str(secrets_dir),
"--unshare-all",
"--",
"bash", "-c", machine.secrets_data[service]["generator"]
],
) )
# fmt: on
run( run(
cmd, cmd,
env=env, env=env,