Skip to content

Commit 88c55b7

Browse files
vstvst
authored
Merge pull request #1 from vst/vst/init
Initialize Codebase
2 parents 0e89e5e + 553f993 commit 88c55b7

File tree

13 files changed

+1166
-272
lines changed

13 files changed

+1166
-272
lines changed

‎.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,4 @@
55
/dist-newstyle
66
/result
77
/tmp
8+
spec.yaml

‎.hlint.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,9 @@
3030
- default: false # All extension are banned by default.
3131
- name:
3232
- OverloadedStrings
33+
- QuasiQuotes
34+
- RecordWildCards
35+
- TupleSections
3336

3437
################
3538
# CUSTOM RULES #

‎README.md

Lines changed: 293 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,309 @@
1-
# Haskell Project Template
1+
# opsops: SOPS(-Nix) Goodies
22

3-
This is an opinionated template for creating Haskell projects. It uses
4-
[Nix], [hpack] and [cabal].
3+
![GitHub Release](https://img.shields.io/github/v/release/vst/opsops)
4+
![GitHub issues](https://img.shields.io/github/issues/vst/opsops)
5+
![GitHub last commit (branch)](https://img.shields.io/github/last-commit/vst/opsops/main)
6+
![GitHub License](https://img.shields.io/github/license/vst/opsops)
57

6-
> **TODO** Provide minimum viable documentation.
8+
`opsops` is a command-line application to generate clear [SOPS]
9+
secrets from a given specification and generate [sops-nix] snippets
10+
for it.
711

8-
## Quickstart
12+
The specification is a YAML/JSON file representing a tree-like
13+
structure where terminal nodes represent how the clear secrets will be
14+
generated, and internal nodes represent the "path" to the clear
15+
secret.
916

10-
Create your repository from this template, clone it on your computer
11-
and enter its directory.
17+
Currently, system processes, scripts and 1password field reference
18+
URIs are supported:
1219

13-
Then, run following to configure your project:
20+
```yaml
21+
secrets:
22+
zamazingo:
23+
secret:
24+
type: "process"
25+
value:
26+
command: "zamazingo"
27+
arguments: ["--hip", "hop"]
28+
github:
29+
token:
30+
type: "script"
31+
value:
32+
content: "printf \"%s\" \"$(gh auth token)\""
33+
example.com:
34+
password:
35+
type: "script"
36+
value:
37+
interpreter: "python3"
38+
content: |
39+
import netrc
40+
import sys
41+
42+
_login, _account, password = netrc.netrc().authenticators("example.com")
43+
44+
sys.stdout.write("password")
45+
dockerhub:
46+
password:
47+
type: "op"
48+
value:
49+
account: "PAIT5BAHSH7DAPEING3EEDIE2E"
50+
vault: "Cloud Accounts"
51+
item: "yies1Ahl4ahqu1afao4nahshoo"
52+
field: "password"
53+
influxdb:
54+
token:
55+
type: "op-read"
56+
value:
57+
account: "IPAEPH0JI3REE8FICHOOVU4CHA"
58+
uri: "op://Devops/OokahCuZ4fo8ahphie1aiFa0ei/API Tokens/write-only"
59+
```
60+
61+
<!--toc:start-->
62+
- [opsops: SOPS(-Nix) Goodies](#opsops-sops-nix-goodies)
63+
- [Installation](#installation)
64+
- [Using `nix-env`](#using-nix-env)
65+
- [Using `nix-profile`](#using-nix-profile)
66+
- [Using `niv`](#using-niv)
67+
- [Usage](#usage)
68+
- [Specification](#specification)
69+
- [See Canonical Specification](#see-canonical-specification)
70+
- [Render Clear Secrets](#render-clear-secrets)
71+
- [Create Snippet for `sops-nix`](#create-snippet-for-sops-nix)
72+
- [Development](#development)
73+
- [License](#license)
74+
<!--toc:end-->
75+
76+
## Installation
77+
78+
> [!WARNING]
79+
>
80+
> If 1Password is used, 1Password CLI application (`op`) must be on
81+
> `PATH` when running `opsops`.
82+
83+
### Using `nix-env`
1484

1585
```sh
16-
bash ./run-template.sh
86+
nix-env --install --file https://github.com/vst/opsops/archive/main.tar.gz --attr app
1787
```
1888

19-
It will prompt some questions and configure your project according to
20-
your answers.
89+
### Using `nix-profile`
2190

22-
Once it is configured, provision `direnv`:
91+
```sh
92+
nix profile install --file https://github.com/vst/opsops/archive/main.tar.gz app
93+
```
94+
95+
### Using `niv`
2396

2497
```sh
25-
direnv allow
98+
niv add vst/opsops -n opsops
99+
```
100+
101+
... and then:
102+
103+
```sh
104+
sources = import ./nix/sources.nix;
105+
opsops = (import sources.opsops { }).app;
106+
```
107+
108+
... and finally add `opsops` to your system packages, home packages or
109+
Nix shell build inputs.
110+
111+
## Usage
112+
113+
### Specification
114+
115+
A specification is a YAML (or JSON) file. Here is an example:
116+
117+
<details>
118+
<summary>See Example</summary>
119+
120+
```yaml
121+
## File: opsops.yaml
122+
secrets:
123+
zamazingo:
124+
secret:
125+
type: "process"
126+
value:
127+
command: "zamazingo"
128+
arguments: ["--hip", "hop"]
129+
github:
130+
token:
131+
type: "script"
132+
value:
133+
content: "printf \"%s\" \"$(gh auth token)\""
134+
example.com:
135+
password:
136+
type: "script"
137+
value:
138+
interpreter: "python3"
139+
content: |
140+
import netrc
141+
import sys
142+
143+
_login, _account, password = netrc.netrc().authenticators("example.com")
144+
145+
sys.stdout.write("password")
146+
dockerhub:
147+
password:
148+
type: "op"
149+
value:
150+
account: "PAIT5BAHSH7DAPEING3EEDIE2E"
151+
vault: "Cloud Accounts"
152+
item: "yies1Ahl4ahqu1afao4nahshoo"
153+
field: "password"
154+
influxdb:
155+
token:
156+
type: "op-read"
157+
value:
158+
account: "IPAEPH0JI3REE8FICHOOVU4CHA"
159+
uri: "op://Devops/OokahCuZ4fo8ahphie1aiFa0ei/API Tokens/write-only"
160+
```
161+
</details>
162+
163+
### See Canonical Specification
164+
165+
To see canonical/normalized specification:
166+
167+
```sh
168+
opsops normalize --input opsops.yaml
169+
```
170+
171+
<details>
172+
<summary>See Output</summary>
173+
174+
```yaml
175+
secrets:
176+
dockerhub:
177+
password:
178+
type: op
179+
value:
180+
account: PAIT5BAHSH7DAPEING3EEDIE2E
181+
field: password
182+
item: yies1Ahl4ahqu1afao4nahshoo
183+
newline: false
184+
section: null
185+
vault: Cloud Accounts
186+
example.com:
187+
password:
188+
type: script
189+
value:
190+
arguments: []
191+
content: |
192+
import netrc
193+
import sys
194+
195+
_login, _account, password = netrc.netrc().authenticators("example.com")
196+
197+
sys.stdout.write("password")
198+
interpreter: python3
199+
github:
200+
token:
201+
type: script
202+
value:
203+
arguments: []
204+
content: |
205+
printf "%s" "$(gh auth token)"
206+
interpreter: bash
207+
influxdb:
208+
token:
209+
type: op-read
210+
value:
211+
account: IPAEPH0JI3REE8FICHOOVU4CHA
212+
newline: false
213+
uri: op://Devops/OokahCuZ4fo8ahphie1aiFa0ei/API Tokens/write-only
214+
zamazingo:
215+
secret:
216+
type: process
217+
value:
218+
arguments:
219+
- --hip
220+
- hop
221+
command: zamazingo
222+
environment: {}
223+
```
224+
</details>
225+
226+
### Render Clear Secrets
227+
228+
> [!WARNING]
229+
>
230+
> If 1Password is used, 1Password CLI application (`op`) should be
231+
> authenticated first:
232+
>
233+
> ```sh
234+
> eval $(op signin -f [--account <ACCOUNT>])
235+
> ```
236+
237+
To render clear secrets:
238+
239+
```sh
240+
opsops render --input opsops.yaml
241+
```
242+
243+
<details>
244+
<summary>See Output</summary>
245+
246+
```yaml
247+
example.com:
248+
password: password
249+
github:
250+
token: gho_meecubier5dinohSh3tohphaekuo5Phahpei
251+
zamazingo:
252+
secret: hebelehubele
253+
dockerhub:
254+
password: ohbauy5eing8pheSh6iigooweeZee6ch
255+
influxdb:
256+
token: mu9aephabeadi7zi8goo9peYo8yae7ge
257+
```
258+
</details>
259+
260+
### Create Snippet for `sops-nix`
261+
262+
To create snippet for `sops-nix` that can be copied/pasted inside the
263+
`sops-nix` module configuration:
264+
265+
```sh
266+
opsops snippet sops-nix --input opsops.yaml
26267
```
27268

28-
And run the big, long build command as given in the next section.
269+
<details>
270+
<summary>See Output</summary>
271+
272+
```nix
273+
"dockerhub/password" = {};
274+
"example.com/password" = {};
275+
"github/token" = {};
276+
"influxdb/token" = {};
277+
"zamazingo/secret" = {};
278+
```
279+
</details
29280

30-
Finally, you can remove the `run-template.sh` script:
281+
... or with some prefix:
31282

32283
```sh
33-
rm run-template.sh
284+
opsops snippet sops-nix --input opsops.yaml --prefix my_namespace
285+
```
286+
287+
<details>
288+
<summary>See Output</summary>
289+
290+
```nix
291+
"my_namespace/dockerhub/password" = { key = "dockerhub/password"; };
292+
"my_namespace/example.com/password" = { key = "example.com/password"; };
293+
"my_namespace/github/token" = { key = "github/token"; };
294+
"my_namespace/influxdb/token" = { key = "influxdb/token"; };
295+
"my_namespace/zamazingo/secret" = { key = "zamazingo/secret"; };
34296
```
297+
</details>
35298

36299
## Development
37300

301+
Provision `direnv`:
302+
303+
```sh
304+
direnv allow
305+
```
306+
38307
Big, long build command for the impatient:
39308

40309
```sh
@@ -45,13 +314,17 @@ hpack &&
45314
find . -iname "*.nix" -not -path "*/nix/sources.nix" -print0 | xargs --null nixpkgs-fmt &&
46315
hlint app/ src/ test/ &&
47316
cabal build -O0 &&
48-
cabal run -O0 haskell-template-hebele -- --version &&
317+
cabal run -O0 opsops -- --version &&
49318
cabal v1-test &&
50319
cabal haddock -O0
51320
```
52321

322+
## License
323+
324+
See [LICENSE].
325+
53326
<!-- REFERENCES -->
54327

55-
[Nix]: https://nixos.org
56-
[hpack]: https://github.com/sol/hpack
57-
[cabal]: https://www.haskell.org/cabal
328+
[LICENSE]: ./LICENSE.md
329+
[SOPS]: https://github.com/getsops/sops
330+
[sops-nix]: https://github.com/Mic92/sops-nix

‎app/Main.hs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module Main where
22

3-
import qualified Hebele.Cli as Cli
3+
import qualified Opsops.Cli as Cli
44
import System.Exit (exitWith)
55

66

0 commit comments

Comments
 (0)