secrets: add option 'generateSecrets'

Move this feature from a module preset to a regular option, so that it's
easily discoverable and accessible.

Simplify the implementation of `generateSecrets` by adding it to the
existing `setup-secrets` service script.

Also rename option setup-secrets -> setupSecrets.

modules/obsolete-options.nix

@@ -22,6 +22,8 @@ in {
     (mkRenamedOptionModule [ "services" "liquidd" "bind" ] [ "services" "liquidd" "address" ])
     (mkRenamedOptionModule [ "services" "liquidd" "rpcbind" ] [ "services" "liquidd" "rpc" "address" ])
 
+    (mkRenamedOptionModule [ "nix-bitcoin" "setup-secrets" ] [ "nix-bitcoin" "setupSecrets" ])
+
     (mkRenamedAnnounceTorOption "clightning")
     (mkRenamedAnnounceTorOption "lnd")
   ];

modules/secrets/generate-secrets.nix

@@ -1,26 +1,4 @@
-{ config, pkgs, lib, ... }:
-
-# This is mainly for testing.
-# When using this for regular deployments, make sure to create a backup of the
-# generated secrets.
-
-with lib;
-{
-  nix-bitcoin.setup-secrets = true;
-
-  systemd.services.generate-secrets = {
-    requiredBy = [ "setup-secrets.service" ];
-    before = [ "setup-secrets.service" ];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-    };
-    script = ''
-      mkdir -p "${config.nix-bitcoin.secretsDir}"
-      cd "${config.nix-bitcoin.secretsDir}"
-      chown root: .
-      chmod 0700 .
-      ${config.nix-bitcoin.pkgs.generate-secrets}
-    '';
-  };
-}
+throw ''
+  The module `generate-secrets.nix` has been removed.
+  Set option `nix-bitcoin.generateSecrets = true;` instead.
+''

modules/secrets/secrets.nix

@@ -3,9 +3,6 @@
 with lib;
 let
   cfg = config.nix-bitcoin;
-  setupSecrets = concatStrings (mapAttrsToList (n: v: ''
-    setupSecret ${n} ${v.user} ${v.group} ${v.permissions} }
-  '') cfg.secrets);
 in
 {
   options.nix-bitcoin = {
@@ -15,6 +12,24 @@ in
       description = "Directory to store secrets";
     };
 
+    setupSecrets = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Set permissions for existing secrets in `nix-bitcoin.secretsDir`.
+      '';
+    };
+
+    generateSecrets = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Automatically generate all required secrets.
+        Make sure to create a backup of the generated secrets.
+      '';
+    };
+
+    # Currently, this is used only by ../deployment/nixops.nix
     deployment.secretsDir = mkOption {
       type = types.path;
       description = ''
@@ -43,27 +58,34 @@ in
         }
       ));
     };
-
-    setup-secrets = mkEnableOption "Set permissions for secrets generated by 'generate-secrets.sh'";
   };
 
-  config = mkIf cfg.setup-secrets {
-    systemd.targets.nix-bitcoin-secrets = {
-      requires = [ "setup-secrets.service" ];
-      after = [ "setup-secrets.service" ];
-    };
+  config =  {
+    systemd.targets.nix-bitcoin-secrets = {};
+
+    nix-bitcoin.setupSecrets = mkIf cfg.generateSecrets true;
 
     # Operation of this service:
     #  - Set owner and permissions for all used secrets
     #  - Make all other secrets accessible to root only
     # For all steps make sure that no secrets are copied to the nix store.
     #
-    systemd.services.setup-secrets = {
+    systemd.services.setup-secrets = mkIf cfg.setupSecrets {
+      requiredBy = [ "nix-bitcoin-secrets.target" ];
+      before = [ "nix-bitcoin-secrets.target" ];
       serviceConfig = {
          Type = "oneshot";
          RemainAfterExit = true;
       };
       script = ''
+        ${optionalString cfg.generateSecrets ''
+          mkdir -p "${cfg.secretsDir}"
+          cd "${cfg.secretsDir}"
+          chown root: .
+          chmod 0700 .
+          ${cfg.pkgs.generate-secrets}
+        ''}
+
         setupSecret() {
             file="$1"
             user="$2"
@@ -87,7 +109,11 @@ in
         cd "$dir"
 
         processedFiles=()
-        ${setupSecrets}
+        ${
+          concatStrings (mapAttrsToList (n: v: ''
+            setupSecret ${n} ${v.user} ${v.group} ${v.permissions} }
+          '') cfg.secrets)
+        }
 
         # Make all other files accessible to root only
         unprocessedFiles=$(comm -23 <(printf '%s\n' *) <(printf '%s\n' "''${processedFiles[@]}" | sort))