ship sane-private-unlock-remote as a cron job to lappy/desko

hosts/by-name/desko/default.nix

@@ -33,6 +33,9 @@
 
   sane.nixcache.remote-builders.desko = false;
 
+  sane.programs.sane-private-unlock-remote.enableFor.user.colin = true;
+  sane.programs.sane-private-unlock-remote.config.hosts = [ "servo" ];
+
   sane.programs.sway.enableFor.user.colin = true;
   sane.programs.iphoneUtils.enableFor.user.colin = true;
   sane.programs.steam.enableFor.user.colin = true;

hosts/by-name/lappy/default.nix

@@ -15,6 +15,9 @@
   # sane.guest.enable = true;
   sane.image.extraBootFiles = [ pkgs.bootpart-uefi-x86_64 ];
 
+  sane.programs.sane-private-unlock-remote.enableFor.user.colin = true;
+  sane.programs.sane-private-unlock-remote.config.hosts = [ "servo" ];
+
   sane.programs.stepmania.enableFor.user.colin = true;
   sane.programs.sway.enableFor.user.colin = true;
 

hosts/common/programs/default.nix

@@ -130,6 +130,7 @@
     ./s6-rc.nix
     ./sane-input-handler
     ./sane-open.nix
+    ./sane-private-unlock-remote.nix
     ./sane-screenshot.nix
     ./sane-scripts.nix
     ./sane-sysload.nix

hosts/common/programs/sane-private-unlock-remote.nix

@@ -0,0 +1,56 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.sane.programs.sane-private-unlock-remote;
+in
+{
+  sane.programs."sane-private-unlock-remote" = {
+    packageUnwrapped = pkgs.sane-scripts.private-unlock-remote;
+    sandbox.method = "bwrap";
+    sandbox.net = "all";
+    sandbox.extraHomePaths = [
+      ".config/sops"
+      ".ssh/id_ed25519"
+      ".ssh/id_ed25519.pub"
+      "knowledge/secrets"
+    ];
+    suggestedPrograms = [
+      "sane-scripts.secrets-dump"
+    ];
+
+    configOption = with lib; mkOption {
+      default = {};
+      type = types.submodule {
+        options.interval = mkOption {
+          type = types.int;
+          default = 60;
+          description = ''
+            how frequently to check in on the remote hosts (in seconds)
+          '';
+        };
+        options.hosts = mkOption {
+          type = types.listOf types.str;
+          default = [];
+          description = ''
+            list of hosts which should be remotely unlocked automatically
+          '';
+        };
+      };
+    };
+
+    services.sane-private-unlock-remote = {
+      description = "private-unlock-remote: unlock the 'private' store of trusted remote machines";
+      partOf = lib.mkIf (cfg.config.hosts != []) [ "default" ];
+      command = pkgs.writeShellScript "private-unlock-remote-loop" ''
+        hosts=(${lib.escapeShellArgs cfg.config.hosts})
+        interval=${builtins.toString cfg.config.interval}
+        while true; do
+          for host in "''${hosts[@]}"; do
+            echo "attempting to unlock $host"
+            sane-private-unlock-remote "$host"
+          done
+          sleep "$interval"
+        done
+      '';
+    };
+  };
+}

hosts/common/programs/sane-scripts.nix

@@ -186,9 +186,11 @@ in
       sessionCommands+=('maybeUnlockSecrets')
     '';
 
-    # sane-secrets-dump is a thin wrapper around sops + some utilities.
-    # really i should sandbox just the utilities
-    "sane-scripts.secrets-dump".sandbox.enable = false;
+    "sane-scripts.secrets-dump".sandbox.method = "bwrap";
+    "sane-scripts.secrets-dump".sandbox.extraHomePaths = [
+      ".config/sops"
+      "knowledge/secrets"
+    ];
     "sane-scripts.secrets-dump".suggestedPrograms = [
       "gnugrep"
       "oath-toolkit"