Fleet Secrets Management System[src]

{ config, fleetLib, ... }:
{
  # Shared - top-level, with expectedOwners
  secrets."wg-psk" = {
    expectedOwners = [ "alpha" "beta" ];
    generator = fleetLib.mkBase64Bytes { count = 32; };
    # Optional: rotate when ownership changes
    regenerateOnOwnerAdded = true;
    regenerateOnOwnerRemoved = true;
  };

  hosts.alpha.nixos = { ... }: {
    # Per-host - lives only on alpha
    secrets."alpha-api-token".generator = fleetLib.mkPassword { };

    # Claim of the shared secret declared above
    secrets."wg-psk".generator = "shared";
  };

  hosts.beta.nixos = { ... }: {
    secrets."wg-psk".generator = "shared";
  };
}

{ config, lib, fleetLib, ... }:
{
  secrets = {
    # Random 32-char ASCII password (single encrypted `secret` part)
    db-password = {
      expectedOwners = [ "db" ];
      generator = fleetLib.mkPassword { };
    };

    # 64-char password
    long-password = {
      expectedOwners = [ "db" ];
      generator = fleetLib.mkPassword { size = 64; };
    };

    # 32 random bytes, raw/hex/base64 encoded
    api-token = {
      expectedOwners = [ "api" ];
      generator = fleetLib.mkBytes { count = 32; encoding = "base64"; };
    };
    session-key = {
      expectedOwners = [ "api" ];
      generator = fleetLib.mkHexBytes { count = 32; };
    };
    wg-psk = {
      expectedOwners = [ "alpha" "beta" ];
      generator = fleetLib.mkBase64Bytes { count = 32; };
    };

    # Ed25519 keypair, two parts: plaintext `public`, encrypted `secret`
    # `noEmbedPublic` strips the embedded public half, leaving only the 32-byte private scalar
    garage-rpc = {
      expectedOwners = [ "storage" ];
      generator = fleetLib.mkEd25519 { encoding = "base64"; };
    };

    # X25519 keypair (e.g. WireGuard peer keys) - usually per-host, shown shared here for brevity
    wg-key = {
      expectedOwners = [ "alpha" ];
      generator = fleetLib.mkX25519 { encoding = "base64"; };
    };

    # RSA keypair, PEM-encoded; default size is 4096
    tls-key = {
      expectedOwners = [ "edge" ];
      generator = fleetLib.mkRsa { size = 2048; };
    };
  };
}

{
  secrets = {
    "my-secret" = {
      # Shared secret will be encrypted for those two hosts
      expectedOwners = [ "host1" "host2" ];
      # We can force secret to be regenerated when the owner was added
      regenerateOnOwnerAdded = true;

      # generator is a function from pkgs extended with helpers, so if you need something special, you can just get
      # it from arguments, fleet will do callPackage for you, and provide you with the packages for the machine
      # that will be generating this secret
      generator = {
        mkImpureSecretGenerator,
        openssl,
      }:
        mkImpureSecretGenerator {
          # Impure secret generator executes arbitrary code on arbitrary host over SSH
          impureOn = "host3";

          # Secret may produce multiple parts, for example, for RSA keypair it would be secret and public part,
          # where only secret part should be encrypted. Non-encrypted parts are available as nix store path and as
          # an expression, encrypted parts will be only available on owning machines after the deployment.
          parts.secret.encrypted = true;

          # In impure secret generator, script is a code that thould prepare the target directory structure
          # Target directory should contain one file for every declared part (parts argument in this attrset),
          # and may contain expires_at/created_at files if you want to use it with PKI.
          #
          # Secret parts should be encoded/encrypted to be consumed by fleet, you can use `gh` alias for that,
          # it will be prepared implicitly, and for arguments - look at the `fleet-generator-helper` section of the docs.
          script = ''
            mkdir $out
            ${getExe openssl} rand -base64 16 | gh private -o $out/secret
          '';
        };
    };
  }
}

Usage: fleet-generator-helper <COMMAND>

Commands:
  public    Encode public part from stdin
  private   Encrypt private part from stdin
  help      Print this message or the help of the given subcommand(s)

Options:
  -h, --help  Print help

Encode public part from stdin

Usage: fleet-generator-helper public [OPTIONS] --output <OUTPUT>

Options:
  -o, --output <OUTPUT>

  -e, --encoding <ENCODING>
          Possible values:
          - raw:    Do not encode data, store as is
          - base64: Encode as base64 (with padding)
          - hex:    Encode as hex (without leading 0x)

          [default: raw]

  -h, --help
          Print help (see a summary with '-h')

Encrypt private part from stdin

Usage: fleet-generator-helper private [OPTIONS] --output <OUTPUT>

Options:
  -o, --output <OUTPUT>

  -e, --encoding <ENCODING>
          Possible values:
          - raw:    Do not encode data, store as is
          - base64: Encode as base64 (with padding)
          - hex:    Encode as hex (without leading 0x)

          [default: raw]

  -h, --help
          Print help (see a summary with '-h')