set rights on templateFromFile

flesh out toml

move function

restore translations for ini

source escaping rules

tests pass

.gitignore

@@ -0,0 +1,2 @@
+result
+result-*

flake.nix

@@ -1,6 +1,6 @@
 {
   inputs.nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
-  outputs = { nixpkgs, ... }@self: let
+  outputs = { nixpkgs, ... }: let
     supportedArchitectures = [
       "aarch64-darwin"
       "aarch64-linux"
@@ -11,12 +11,17 @@
     packages = nixpkgs.lib.genAttrs supportedArchitectures (system: {
       nix_templater = nixpkgs.legacyPackages.${system}.callPackage ./pkgs/nix_templater {};
     });
-    legacyPackages = nixpkgs.lib.genAttrs supportedArchitectures (system: import ./lib.nix {
+    legacyPackages = nixpkgs.lib.genAttrs supportedArchitectures (system: let
       pkgs = nixpkgs.legacyPackages.${system};
+    in import ./lib.nix {
+      inherit pkgs;
+      inherit (pkgs) lib;
       nix_templater = packages.${system}.nix_templater;
     });
     checks = nixpkgs.lib.genAttrs supportedArchitectures (system: {
       template = import ./tests/template.nix { inherit legacyPackages system nixpkgs; };
+      json = import ./tests/json.nix { inherit legacyPackages system nixpkgs; };
+      toml = import ./tests/toml.nix { inherit legacyPackages system nixpkgs; };
     });
   };
 }

lib.nix

@@ -1,18 +1,38 @@
-{ pkgs, nix_templater }:
 {
+  pkgs,
+  lib ? pkgs.lib,
+  nix_templater ? pkgs.callPackage ./pkgs/nix_templater { },
+}:
+let
+  escapeJson = {
+    "\"" = ''\"'';
+    "\\" = ''\\'';
+  };
+in
+rec {
   # placeholder to be substituted with the content of a secret file
   fileContents = file: {
    outPath = "<${builtins.placeholder "nix_template"}${toString file}${builtins.placeholder "nix_template"}>";
    file = file;
   };
 
-  # make a template with placeholders
-  template_text = { name, text, outPath }:
+  # make a template with placeholders from a text
+  templateText = {
+    name,
+    text,
+    outPath,
+    owner ? "root",
+    group ? owner,
+    mode ? "0400",
+    translations ? {},
+  }:
     pkgs.runCommand name {
       textBeforeTemplate = text;
       script = ''
         #!/bin/sh
-        ${nix_templater}/bin/nix_templater ${builtins.placeholder "out"}/template ${builtins.placeholder "nix_template"} "${outPath}"
+        ${nix_templater}/bin/nix_templater ${builtins.placeholder "out"}/template ${builtins.placeholder "nix_template"} "${outPath}" '${lib.strings.toJSON translations}'
+        chown ${owner}:${group} "${outPath}"
+        chmod ${mode} "${outPath}"
       '';
       passAsFile = [ "script" "textBeforeTemplate" ];
     } ''
@@ -21,4 +41,52 @@
       cp $scriptPath $out/bin/${name}
       chmod +x $out/bin/${name}
     '';
+
+  # make a template with placeholders from a file
+  templateFromFile = {
+    name,
+    templateFile,
+    outPath,
+    owner ? "root",
+    group ? owner,
+    mode ? "0400",
+    translations ? {},
+  }:
+    pkgs.runCommand name {
+      inherit templateFile;
+      script = ''
+        #!/bin/sh
+        ${nix_templater}/bin/nix_templater ${builtins.placeholder "out"}/template ${builtins.placeholder "nix_template"} "${outPath}" '${lib.strings.toJSON translations}'
+        chown ${owner}:${group} "${outPath}"
+        chmod ${mode} "${outPath}"
+      '';
+      passAsFile = [ "script" ];
+    } ''
+      mkdir -p $out/bin
+      cp $templateFile $out/template
+      cp $scriptPath $out/bin/${name}
+      chmod +x $out/bin/${name}
+    '';
+
+  translateFile = translations: generator: { name, value, outPath }: templateFromFile {
+    inherit name outPath translations;
+    templateFile = generator value;
+  };
+
+  translateText = translations: generator: { name, value, outPath }: templateText {
+    inherit name outPath translations;
+    text = generator value;
+  };
+
+  # escaping: https://www.json.org/json-en.html
+  templateJson = translateFile escapeJson (pkgs.writers.writeJSON "template.json");
+  # just json
+  templateYaml = translateFile escapeJson (pkgs.writers.writeYAML "template.yaml");
+  # escaping: technically also control characters (U+0000 to U+001F): https://toml.io/en/v0.3.0#string
+  templateToml = translateFile escapeJson (pkgs.writers.writeTOML "template.toml");
+
+  # escaping: https://git.kernel.org/pub/scm/git/git.git/tree/Documentation/config.txt?id=a54a84b333adbecf7bc4483c0e36ed5878cac17b#n47
+  templateIniWith = options: translateText escapeJson (lib.generators.toINI options);
+
+  templateIni = templateIniWith { };
 }

pkgs/nix_templater/replace.py

@@ -1,10 +1,12 @@
 # replace occurrences of a magic string in a template file
+from json import loads
 import sys
 from pathlib import Path
 
 template_file = sys.argv[1]
 magic_string = sys.argv[2]
 outfile = sys.argv[3]
+translations = loads(sys.argv[4]) if len(sys.argv) >= 5 else {}
 
 if Path(outfile).exists():
     print(f"{outfile} already exists, aborting")
@@ -26,7 +28,7 @@ while True:
     ]
     output += template_bytes[loc : loc + magic_start]
     # TODO handle errors better here
-    output += Path(magic_file.decode()).read_bytes()
+    output += Path(magic_file.decode()).read_bytes().decode().translate(str.maketrans(translations)).encode()
     loc = loc + magic_start + magic_end + len(magic_string) + 1
 
 Path(outfile).write_bytes(output)

tests/json.nix

@@ -0,0 +1,41 @@
+# test injecting a secret into a json template
+{ legacyPackages, system, nixpkgs }:
+let
+  hostPkgs = nixpkgs.legacyPackages.${system};
+  secret_file = hostPkgs.writeText "secret" "secret\\needing\"escaping";
+in (nixpkgs.lib.nixos.runTest {
+    inherit hostPkgs;
+    name = "nix_templates";
+
+    nodes.machine = {pkgs, ...}: {
+      config = {
+        systemd.services.testservice = {
+          wantedBy = [ "multi-user.target" ];
+          serviceConfig = {
+            Type = "oneshot";
+            ExecStartPre = "${legacyPackages.${system}.templateJson {
+              name = "test";
+              value = {
+                foo = "text";
+                bar = legacyPackages.${system}.fileContents secret_file;
+              };
+              outPath = "./test";
+            }}/bin/test";
+            ExecStart = pkgs.writeScript "test_file_got_templates" ''
+              #!/bin/sh
+              cat ./test | grep -q 'secret'
+            '';
+          };
+        };
+      };
+    };
+
+    testScript = ''
+      start_all()
+      print(machine.execute("uname -a"))
+      machine.wait_for_unit("multi-user.target")
+      print(machine.succeed("cat /test"))
+      print(machine.succeed("cat /test | grep -q secret"))
+      print(machine.succeed("cat /test | ${hostPkgs.jq}/bin/jq"))
+    '';
+  })

tests/template.nix

@@ -1,4 +1,4 @@
-# test injecting a secret into a template
+# test injecting a secret into a text template
 { legacyPackages, system, nixpkgs }:
 let
   # this file would usually be outside of the store
@@ -14,7 +14,7 @@ in (nixpkgs.lib.nixos.runTest {
           wantedBy = [ "multi-user.target" ];
           serviceConfig = {
             Type = "oneshot";
-            ExecStartPre = "${legacyPackages.${system}.template_text {
+            ExecStartPre = "${legacyPackages.${system}.templateText {
               name = "test";
               text = ''
               public text

tests/toml.nix

@@ -0,0 +1,41 @@
+# test injecting a secret into a toml template
+{ legacyPackages, system, nixpkgs }:
+let
+  hostPkgs = nixpkgs.legacyPackages.${system};
+  secret_file = hostPkgs.writeText "secret" "secret\\needing\"escaping";
+in (nixpkgs.lib.nixos.runTest {
+    inherit hostPkgs;
+    name = "nix_templates";
+
+    nodes.machine = {pkgs, ...}: {
+      config = {
+        systemd.services.testservice = {
+          wantedBy = [ "multi-user.target" ];
+          serviceConfig = {
+            Type = "oneshot";
+            ExecStartPre = "${legacyPackages.${system}.templateToml {
+              name = "test";
+              value = {
+                foo = "text";
+                bar = legacyPackages.${system}.fileContents secret_file;
+              };
+              outPath = "./test";
+            }}/bin/test";
+            ExecStart = pkgs.writeScript "test_file_got_templates" ''
+              #!/bin/sh
+              cat ./test | grep -q 'secret'
+            '';
+          };
+        };
+      };
+    };
+
+    testScript = ''
+      start_all()
+      print(machine.execute("uname -a"))
+      machine.wait_for_unit("multi-user.target")
+      print(machine.succeed("cat /test"))
+      print(machine.succeed("cat /test | grep -q secret"))
+      # print(machine.succeed("cat /test | ${hostPkgs.jq}/bin/jq"))
+    '';
+  })