From 1eabc4cff1bc5e3d7ce536e266ddd6223352965d Mon Sep 17 00:00:00 2001 From: Robert Hensing Date: Fri, 18 Dec 2020 21:59:51 +0100 Subject: [PATCH 1/4] nixosTests.vault: increase memorySize to 512 --- nixos/tests/vault.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/tests/vault.nix b/nixos/tests/vault.nix index ac8cf0703da..20cc8f4c692 100644 --- a/nixos/tests/vault.nix +++ b/nixos/tests/vault.nix @@ -8,6 +8,7 @@ import ./make-test-python.nix ({ pkgs, ... }: environment.systemPackages = [ pkgs.vault ]; environment.variables.VAULT_ADDR = "http://127.0.0.1:8200"; services.vault.enable = true; + virtualisation.memorySize = 512; }; testScript = From b413e7fd2a4ece5d23b78cc04ec19378ee11ceba Mon Sep 17 00:00:00 2001 From: Robert Hensing Date: Mon, 4 Jan 2021 16:28:16 +0100 Subject: [PATCH 2/4] nixos/vault: Allow multiple config files --- nixos/modules/services/security/vault.nix | 46 ++++++++++++++++++++++- 1 file changed, 44 insertions(+), 2 deletions(-) diff --git a/nixos/modules/services/security/vault.nix b/nixos/modules/services/security/vault.nix index 64622454b9d..c2b714d7c26 100644 --- a/nixos/modules/services/security/vault.nix +++ b/nixos/modules/services/security/vault.nix @@ -27,6 +27,11 @@ let ''} ${cfg.extraConfig} ''; + + allConfigPaths = [configFile] ++ cfg.extraConfigPaths; + + configOptions = escapeShellArgs (concatMap (p: ["-config" p]) allConfigPaths); + in { @@ -84,7 +89,14 @@ in storageConfig = mkOption { type = types.nullOr types.lines; default = null; - description = "Storage configuration"; + description = '' + HCL configuration to insert in the storageBackend section. + + Confidential values should not be specified here because this option's + value is written to the Nix store, which is publicly readable. + Provide credentials and such in a separate file using + . + ''; }; telemetryConfig = mkOption { @@ -98,6 +110,36 @@ in default = ""; description = "Extra text appended to vault.hcl."; }; + + extraConfigPaths = mkOption { + type = types.listOf types.path; + default = []; + description = '' + Configuration files to load besides the immutable one defined by the NixOS module. + This can be used to avoid putting credentials in the Nix store, which can be read by any user. + + Each path can point to a JSON- or HCL-formatted file, or a directory + to be scanned for files with .hcl or + .json extensions. + + To upload the confidential file with NixOps, use for example: + + + ''; + }; }; }; @@ -136,7 +178,7 @@ in serviceConfig = { User = "vault"; Group = "vault"; - ExecStart = "${cfg.package}/bin/vault server -config ${configFile}"; + ExecStart = "${cfg.package}/bin/vault server ${configOptions}"; ExecReload = "${pkgs.coreutils}/bin/kill -SIGHUP $MAINPID"; PrivateDevices = true; PrivateTmp = true; From 653f18b48fa6bd6b3e51a05c8ca0d93042c19785 Mon Sep 17 00:00:00 2001 From: Robert Hensing Date: Mon, 4 Jan 2021 17:54:03 +0100 Subject: [PATCH 3/4] nixosTests.vault-postgresql: init --- nixos/tests/all-tests.nix | 1 + nixos/tests/vault-postgresql.nix | 70 ++++++++++++++++++++++++++++++++ 2 files changed, 71 insertions(+) create mode 100644 nixos/tests/vault-postgresql.nix diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index c491b559213..871b800a74b 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -401,6 +401,7 @@ in uwsgi = handleTest ./uwsgi.nix {}; v2ray = handleTest ./v2ray.nix {}; vault = handleTest ./vault.nix {}; + vault-postgresql = handleTest ./vault-postgresql.nix {}; vector = handleTest ./vector.nix {}; victoriametrics = handleTest ./victoriametrics.nix {}; virtualbox = handleTestOn ["x86_64-linux"] ./virtualbox.nix {}; diff --git a/nixos/tests/vault-postgresql.nix b/nixos/tests/vault-postgresql.nix new file mode 100644 index 00000000000..185a9515d61 --- /dev/null +++ b/nixos/tests/vault-postgresql.nix @@ -0,0 +1,70 @@ +/* This test checks that + - multiple config files can be loaded + - the storage backend can be in a file outside the nix store + as is required for security (required because while confidentiality is + always covered, availability isn't) + - the postgres integration works + */ +import ./make-test-python.nix ({ pkgs, ... }: +{ + name = "vault-postgresql"; + meta = with pkgs.stdenv.lib.maintainers; { + maintainers = [ lnl7 roberth ]; + }; + machine = { lib, pkgs, ... }: { + virtualisation.memorySize = 512; + environment.systemPackages = [ pkgs.vault ]; + environment.variables.VAULT_ADDR = "http://127.0.0.1:8200"; + services.vault.enable = true; + services.vault.extraConfigPaths = [ "/run/vault.hcl" ]; + + systemd.services.vault = { + after = [ + "postgresql.service" + ]; + # Try for about 10 minutes rather than the default of 5 attempts. + serviceConfig.RestartSec = 1; + serviceConfig.StartLimitBurst = 600; + }; + # systemd.services.vault.unitConfig.RequiresMountsFor = "/run/keys/"; + + services.postgresql.enable = true; + services.postgresql.initialScript = pkgs.writeText "init.psql" '' + CREATE USER vaultuser WITH ENCRYPTED PASSWORD 'thisisthepass'; + GRANT CONNECT ON DATABASE postgres TO vaultuser; + + -- https://www.vaultproject.io/docs/configuration/storage/postgresql + CREATE TABLE vault_kv_store ( + parent_path TEXT COLLATE "C" NOT NULL, + path TEXT COLLATE "C", + key TEXT COLLATE "C", + value BYTEA, + CONSTRAINT pkey PRIMARY KEY (path, key) + ); + CREATE INDEX parent_path_idx ON vault_kv_store (parent_path); + + GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO vaultuser; + ''; + }; + + testScript = + '' + secretConfig = """ + storage "postgresql" { + connection_url = "postgres://vaultuser:thisisthepass@localhost/postgres?sslmode=disable" + } + """ + + start_all() + + machine.wait_for_unit("multi-user.target") + machine.succeed("cat >/root/vault.hcl < Date: Tue, 19 Jan 2021 18:14:29 +0100 Subject: [PATCH 4/4] nixos/vault: extraConfigPaths -> extraSettingsPaths Align with RFC42 language, even if in advance of the actual settings attribute. --- nixos/modules/services/security/vault.nix | 8 ++++---- nixos/tests/vault-postgresql.nix | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/nixos/modules/services/security/vault.nix b/nixos/modules/services/security/vault.nix index c2b714d7c26..5a20f6413b1 100644 --- a/nixos/modules/services/security/vault.nix +++ b/nixos/modules/services/security/vault.nix @@ -28,7 +28,7 @@ let ${cfg.extraConfig} ''; - allConfigPaths = [configFile] ++ cfg.extraConfigPaths; + allConfigPaths = [configFile] ++ cfg.extraSettingsPaths; configOptions = escapeShellArgs (concatMap (p: ["-config" p]) allConfigPaths); @@ -95,7 +95,7 @@ in Confidential values should not be specified here because this option's value is written to the Nix store, which is publicly readable. Provide credentials and such in a separate file using - . + . ''; }; @@ -111,7 +111,7 @@ in description = "Extra text appended to vault.hcl."; }; - extraConfigPaths = mkOption { + extraSettingsPaths = mkOption { type = types.listOf types.path; default = []; description = '' @@ -134,7 +134,7 @@ in ${"''"}; user = "vault"; }; - services.vault.extraConfigPaths = ["/run/keys/vault.hcl"]; + services.vault.extraSettingsPaths = ["/run/keys/vault.hcl"]; services.vault.storageBackend = "postgresql"; users.users.vault.extraGroups = ["keys"]; ]]> diff --git a/nixos/tests/vault-postgresql.nix b/nixos/tests/vault-postgresql.nix index 185a9515d61..daa71976338 100644 --- a/nixos/tests/vault-postgresql.nix +++ b/nixos/tests/vault-postgresql.nix @@ -16,7 +16,7 @@ import ./make-test-python.nix ({ pkgs, ... }: environment.systemPackages = [ pkgs.vault ]; environment.variables.VAULT_ADDR = "http://127.0.0.1:8200"; services.vault.enable = true; - services.vault.extraConfigPaths = [ "/run/vault.hcl" ]; + services.vault.extraSettingsPaths = [ "/run/vault.hcl" ]; systemd.services.vault = { after = [