Nix secret daemon demo

secret-demo.nix

let
  pkgs = import <nixpkgs> { };

  inherit (pkgs) lib;

  dummyIdentity = pkgs.runCommand "dummyIdentity" { } ''
    ${pkgs.age}/bin/age-keygen -o $out
  '';

  secretValue = "super-secret-token";

  encryptedSecret = pkgs.runCommand "encryptedSecret" { } ''
    echo ${secretValue} | ${pkgs.age}/bin/age -r $(grep -o 'age1.*' ${dummyIdentity}) > $out
  '';

  secretName = builtins.baseNameOf encryptedSecret;

in pkgs.testers.nixosTest {
  name = "credential-socket-test";

  nodes.machine = { pkgs, ... }: {
    systemd.sockets.secretProvider = {
      description = "Secret provider";

      socketConfig = {
        ListenStream = "/run/secret.sock";
        SocketMode = "0600";
      };
    };

    systemd.services.secretProvider = {
      description = "Secret provider";

      serviceConfig = {
        ExecStart = pkgs.writeScript "secret-provider" ''
          #!${pkgs.python3.interpreter}

          import os, socket, subprocess

          sock = socket.socket(fileno=3)
          sock.listen(128)
          while True:
              conn, _ = sock.accept()
              with conn:
                  cred_id = conn.getpeername()[1:].decode().rsplit("/", 1)[1]
                  subprocess.run(
                      [
                          "${pkgs.age}/bin/age",
                          "--decrypt",
                          "--identity=${dummyIdentity}",
                          f"/nix/store/{cred_id}",
                      ],
                      stdout=conn.fileno(),
                  )
        '';
      };
    };

    systemd.services.consumer = {
      description = "Secret consumer";
      after = [ "secretProvider.socket" ];
      requires = [ "secretProvider.socket" ];
      wantedBy = [ "multi-user.target" ];

      environment.cred_path = "%d/${secretName}";
      serviceConfig = {
        LoadCredential = [
          "${secretName}:/run/secret.sock"
        ];

        ExecStart = pkgs.writeShellScript "consumer" ''
          set -euo pipefail

          if [ ! -f "$cred_path" ]; then
            echo "Credential not found"
            exit 1
          fi

          read -r value < "$cred_path"

          echo "Got credential: $value"

          if [ "$value" != "${secretValue}" ]; then
            echo "Wrong secret"
            exit 1
          fi

          # Make sure we stay active for wait_for_unit
          sleep 1h
        '';
      };
    };
  };

  testScript = ''
    start_all()
    machine.wait_for_unit("consumer.service")
    machine.systemctl("restart consumer.service")
    machine.wait_for_unit("consumer.service")
  '';
}