Allow users in group "keys" to access /run/keys.

This makes it at least possible to access the keys directory if a
particular service is in the keys group, which has been introduced by
NixOS/nixpkgs@4ab5646417e3cc606281f71027c12ddced8b65b4.

However, to let specific users access a particular key, you still need
to work around it by adding an additional systemd service that sets the
right permissions. But at least with this we should have some
consistency with what is actually done in <nixpkgs>.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Turn "keys" option into an attrset of attrsets.

This now provides options for each key and also converts old style
string-only keys into the new format while emitting a warning.

At the moment only the "text" option is actually supported.

For applying the keys for string-values the permissions attribute is set
to "0600" instead of the default value "0640" in keyOptionsType in order
to correctly replicate the old behaviour even when we implement
permissions and ownership.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
MachineState: Implement permissions for keys.

This however only implements setting permissions if "storeKeysOnMachine" is
set to false right now, because if the value is set to true the keys are
symlinked from the store and we actually have to find a way to control
permisions on it, which for the store is only possible if NixOS/nix#8 is
implemented.

Also, this ensures that the key filename is properly escaped.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
nix/keys: Fix keyOptionsType submodule type.

First, forgot about specifying options.* and even if it would be there,
the option values wouldn't be merged because keyType was not properly
inheriting the merge function from keyOptionsType.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
nix/keys: Use 0600 as the default permissions.

Only using this for legacy options could introduce unexpected behaviour
when switching to the new configuration if the user just appends a .text
to its configuration values and could possibly lead to services that
refuse to work, especially when it comes to OpenSSH.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
nix/keys: Fix eval if storeKeysOnMachine is true.

This currently only fixes evaluation but actually doesn't apply the
correct permissions on the key files because they're just links to world
readable files in the Nix store.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
nix/keys: Fix description of storeKeysOnMachine.

As storeKeysOnMachine no longer is true by default (7ae4b27), we
shouldn't say so in the description. Especially because the default
value is already shown in the generated manual along with the
description.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
nix/keys: Add a warning for storeKeysOnMachine.

This warning should be annoying enough so people will eventually set it
to false in case they ever used it. Especially if we want to set key
permissions, setting this option is pointless anyway because keys in
/run/keys are just symlinks to the world-readably store paths.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
nix/keys: Correctly merge/convert deployment.keys.

So far we only used the apply function in order to convert keys as
string values into the new format. But if you have several keys defined,
mixing old and new format, the evaluation will fail because the apply
function is only evaluated once everything is merged.

So, we now use the same function we're using for apply to merge the
consecutive option values.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Merge pull request #206 from aszlig/keys-permissions

Improve setting permissions on /run/keys.