Stop storing keys in the nix store for storeKeysOnMachine.

nix/keys.nix

@@ -115,41 +115,21 @@ in
 
  config = {
 
- warnings = mkIf config.deployment.storeKeysOnMachine [(
- "The use of `deployment.storeKeysOnMachine' imposes a security risk " +
- "because all keys will be put in the Nix store and thus are world-" +
- "readable. Also, this will have an impact on services like OpenSSH, " +
- "which require strict permissions to be set on key files, so expect " +
- "things to break."
- )];
-
- system.activationScripts.nixops-keys = stringAfter [ "users" "groups" ]
+ system.activationScripts.nixops-keys = stringAfter [ "users" "groups" ] (
  ''
  mkdir -p /run/keys -m 0750
  chown root:keys /run/keys
 
- ${optionalString config.deployment.storeKeysOnMachine
- (concatStrings (mapAttrsToList (name: value:
- let
- # FIXME: The key file should be marked as private once
- # https://github.com/NixOS/nix/issues/8 is fixed.
- keyFile = pkgs.writeText name value.text;
- in "ln -sfn ${keyFile} /run/keys/${name}\n")
- config.deployment.keys)
- + ''
- # FIXME: delete obsolete keys?
- touch /run/keys/done
- '')
- }
-
- ${concatStringsSep "\n" (flip mapAttrsToList config.deployment.keys (name: value:
- # Make sure each key has correct ownership, since the configured owning
- # user or group may not have existed when first uploaded.
- ''
+ ${concatStrings (flip mapAttrsToList config.deployment.keys (name: value:
+ optionalString config.deployment.storeKeysOnMachine ''
+ ln -snf "/var/keys/${name}" "/run/keys/${name}"
+ '' + ''
  [[ -f "/run/keys/${name}" ]] && chown '${value.user}:${value.group}' "/run/keys/${name}"
  ''
  ))}
- '';
+ '' + lib.optionalString config.deployment.storeKeysOnMachine ''
+ ln -snf /var/keys/done /run/keys/done
+ '');
 
  systemd.services = (
  { nixops-keys =

nixops/backends/__init__.py

@@ -199,21 +199,24 @@ def reboot_rescue(self, hard=False):
  self.warn("machine ‘{0}’ doesn't have a rescue"
  " system.".format(self.name))
 
+ @property
+ def key_dir(self):
+ return "/var/keys" if self.store_keys_on_machine else "/run/keys"
+
  def send_keys(self):
  if self.state == self.RESCUE:
  # Don't send keys when in RESCUE state, because we're most likely
  # bootstrapping plus we probably don't have /run mounted properly
  # so keys will probably end up being written to DISK instead of
  # into memory.
  return
- if self.store_keys_on_machine: return
- self.run_command("mkdir -m 0750 -p /run/keys"
- " && chown root:keys /run/keys")
+ key_dir = self.key_dir
+ self.run_command("mkdir -pm 0750 {0} && chown root:keys {0}".format(key_dir))
  for k, opts in self.get_keys().items():
  self.log("uploading key ‘{0}’...".format(k))
  tmp = self.depl.tempdir + "/key-" + self.name
  f = open(tmp, "w+"); f.write(opts['text']); f.close()
- outfile = "/run/keys/" + k
+ outfile = os.path.join(key_dir, k)
  outfile_esc = "'" + outfile.replace("'", r"'\''") + "'"
  self.run_command("rm -f " + outfile_esc)
  self.upload_file(tmp, outfile)
@@ -237,7 +240,7 @@ def send_keys(self):
  )
  )
  os.remove(tmp)
- self.run_command("touch /run/keys/done")
+ self.run_command("touch {}/done".format(key_dir))
 
  def get_keys(self):
  return self.keys

tests/functional/single_machine_secret_key_ram.nix

@@ -0,0 +1,7 @@
+{
+ machine.deployment = {
+ storeKeysOnMachine = false;
+
+ keys."secret.key" = "12345";
+ };
+}

tests/functional/test_send_keys_sends_keys.py

@@ -5,16 +5,27 @@
 
 parent_dir = path.dirname(__file__)
 
-secret_key_spec = '%s/single_machine_secret_key.nix' % (parent_dir)
+secret_key_ram_spec = '%s/single_machine_secret_key_ram.nix' % (parent_dir)
+secret_key_disk_spec = '%s/single_machine_secret_key_disk.nix' % (parent_dir)
 
 class TestSendKeysSendsKeys(single_machine_test.SingleMachineTest):
  _multiprocess_can_split_ = True
 
  def setup(self):
  super(TestSendKeysSendsKeys,self).setup()
- self.depl.nix_exprs = self.depl.nix_exprs + [ secret_key_spec ]
 
  def run_check(self):
+ self.depl.nix_exprs = self.depl.nix_exprs + [ secret_key_ram_spec ]
+
+ self.depl.deploy()
+ self.check_command("test -f /run/keys/secret.key")
+ self.check_command("rm -f /run/keys/secret.key")
+ self.depl.send_keys()
+ self.check_command("test -f /run/keys/secret.key")
+
+ def run_check(self):
+ self.depl.nix_exprs = self.depl.nix_exprs + [ secret_key_disk_spec ]
+
  self.depl.deploy()
  self.check_command("test -f /run/keys/secret.key")
  self.check_command("rm -f /run/keys/secret.key")