nixpkgs/nixos/modules/services/security/vault-agent.nix

{
  config,
  lib,
  pkgs,
  ...
}:

with lib;

let
  format = pkgs.formats.json { };
  commonOptions =
    {
      pkgName,
      flavour ? pkgName,
    }:
    mkOption {
      default = { };
      description = ''
        Attribute set of ${flavour} instances.
        Creates independent `${flavour}-''${name}.service` systemd units for each instance defined here.
      '';
      type =
        with types;
        attrsOf (
          submodule (
            { name, ... }:
            {
              options = {
                enable = mkEnableOption "this ${flavour} instance" // {
                  default = true;
                };

                package = mkPackageOption pkgs pkgName { };

                user = mkOption {
                  type = types.str;
                  default = "root";
                  description = ''
                    User under which this instance runs.
                  '';
                };

                group = mkOption {
                  type = types.str;
                  default = "root";
                  description = ''
                    Group under which this instance runs.
                  '';
                };

                settings = mkOption {
                  type = types.submodule {
                    freeformType = format.type;

                    options = {
                      pid_file = mkOption {
                        default = "/run/${flavour}/${name}.pid";
                        type = types.str;
                        description = ''
                          Path to use for the pid file.
                        '';
                      };

                      template = mkOption {
                        default = [ ];
                        type = with types; listOf (attrsOf anything);
                        description =
                          let
                            upstreamDocs =
                              if flavour == "vault-agent" then
                                "https://developer.hashicorp.com/vault/docs/agent/template"
                              else
                                "https://github.com/hashicorp/consul-template/blob/main/docs/configuration.md#templates";
                          in
                          ''
                            Template section of ${flavour}.
                            Refer to <${upstreamDocs}> for supported values.
                          '';
                      };
                    };
                  };

                  default = { };

                  description =
                    let
                      upstreamDocs =
                        if flavour == "vault-agent" then
                          "https://developer.hashicorp.com/vault/docs/agent#configuration-file-options"
                        else
                          "https://github.com/hashicorp/consul-template/blob/main/docs/configuration.md#configuration-file";
                    in
                    ''
                      Free-form settings written directly to the `config.json` file.
                      Refer to <${upstreamDocs}> for supported values.

                      ::: {.note}
                      Resulting format is JSON not HCL.
                      Refer to <https://www.hcl2json.com/> if you are unsure how to convert HCL options to JSON.
                      :::
                    '';
                };
              };
            }
          )
        );
    };

  createAgentInstance =
    {
      instance,
      name,
      flavour,
    }:
    let
      configFile = format.generate "${name}.json" instance.settings;
    in
    mkIf (instance.enable) {
      description = "${flavour} daemon - ${name}";
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
      path = [ pkgs.getent ];
      startLimitIntervalSec = 60;
      startLimitBurst = 3;
      serviceConfig = {
        User = instance.user;
        Group = instance.group;
        RuntimeDirectory = flavour;
        ExecStart = "${getExe instance.package} ${
          optionalString ((getName instance.package) == "vault") "agent"
        } -config ${configFile}";
        ExecReload = "${pkgs.coreutils}/bin/kill -SIGHUP $MAINPID";
        KillSignal = "SIGINT";
        TimeoutStopSec = "30s";
        Restart = "on-failure";
      };
    };
in
{
  options = {
    services.consul-template.instances = commonOptions { pkgName = "consul-template"; };
    services.vault-agent.instances = commonOptions {
      pkgName = "vault";
      flavour = "vault-agent";
    };
  };

  config = mkMerge (
    map
      (
        flavour:
        let
          cfg = config.services.${flavour};
        in
        mkIf (cfg.instances != { }) {
          systemd.services = mapAttrs' (
            name: instance:
            nameValuePair "${flavour}-${name}" (createAgentInstance {
              inherit name instance flavour;
            })
          ) cfg.instances;
        }
      )
      [
        "consul-template"
        "vault-agent"
      ]
  );

  meta.maintainers = with maintainers; [
    emilylange
    tcheronneau
  ];
}