git.delta.rocks / fleet / refs/commits / 2438e2b594b6

23use remowt_ui_prompt::{PrependSourcePrompter, Source};23use remowt_ui_prompt::{PrependSourcePrompter, Source};
24use tempfile::NamedTempFile;24use tempfile::NamedTempFile;
25use tokio::{sync::OnceCell, task::spawn_blocking};25use tokio::{sync::OnceCell, task::spawn_blocking};
26use tracing::{info, warn};26use tracing::{info, instrument, warn};
2727
28use crate::fleetdata::{28use crate::fleetdata::{
29	FleetData, FleetSecretData, FleetSecretDistribution, FleetSecretPart, SecretOwner,29	FleetData, FleetSecretData, FleetSecretDistribution, FleetSecretPart, SecretOwner,
111111
112	// TODO: Move command helpers away with connectivity refactor112	// TODO: Move command helpers away with connectivity refactor
113	pub local: bool,113	pub local: bool,
114	pub remowt: OnceLock<Remowt>,114	pub remowt: OnceCell<Remowt>,
115	nix_store: OnceLock<Arc<Store>>,115	nix_store: OnceCell<Arc<Store>>,
116	nix_plugin: OnceCell<()>,116	nix_plugin: OnceCell<()>,
117}117}
118118
132}132}
133133
134enum RemoteDerivationMode {134enum RemoteDerivationMode {
135	/// Closure is (pre)signed, remote host is expected to trust our signatures.
135	CopySigned,136	CopySigned,
137	/// Closure is not signed, using escalated nix daemon to bypass signature verification.
136	Copy,138	CopyPrivileged,
139	/// Closure is uploaded to attic, remote host is expected to trust its signature.
137	Attic,140	Attic { name: String },
138	Cachix,
139}141}
140142
141impl ConfigHost {143impl ConfigHost {
181			Ok(DeployKind::Fleet)183			Ok(DeployKind::Fleet)
182		}).await.copied()184		}).await.copied()
183	}185	}
184	async fn connection(&self) -> Result<Remowt> {186	async fn new_remowt(&self) -> Result<Remowt> {
185		if let Some(conn) = self.remowt.get() {
186			return Ok(conn.clone());
187		}
188		let bundle = agent_bundle()?;187		let bundle = agent_bundle()?;
189		let conn = if self.local {188		let conn = if self.local {
190			Remowt::connect_local(&bundle, "remowt-fleet".to_owned())189			Remowt::connect_local(&bundle, "remowt-fleet".to_owned())
213			description: "".to_owned(),212			description: "".to_owned(),
214		})213		})
215		.register_endpoints(&mut conn.rpc());214		.register_endpoints(&mut conn.rpc());
216		let _ = self.remowt.set(conn);215		Ok(conn)
217		Ok(self.remowt.get().expect("just set").clone())
218	}216	}
219217
220	/// Client for this host's unprivileged agent.218	/// Client for this host's unprivileged agent.
221	pub async fn remowt(&self) -> Result<Remowt> {219	pub async fn remowt(&self) -> Result<Remowt> {
222		self.connection().await220		self.remowt
221			.get_or_try_init(|| self.new_remowt())
222			.await
223			.cloned()
223	}224	}
224225
225	pub async fn nix_client(&self) -> Result<NixClient<BifConfig>> {226	pub async fn nix_client(&self) -> Result<NixClient<BifConfig>> {
254		})255		})
255	}256	}
256257
257	async fn nix_store(&self) -> Result<Arc<Store>> {258	async fn new_nix_store(&self) -> Result<Store> {
258		if let Some(store) = self.nix_store.get() {
259			return Ok(store.clone());
260		}
261		let conn = self.connection().await?;259		let conn = self.remowt().await?;
262		let socket = match self.deploy_kind().await? {260		let socket = match self.deploy_kind().await? {
263			DeployKind::NixosInstall => {261			DeployKind::NixosInstall => {
264				remowt_fleet::nix_store_socket(conn, "/mnt?require-sigs=false").await?262				remowt_fleet::nix_store_socket(conn, "/mnt?require-sigs=false").await?
265			}263			}
266			_ => remowt_fleet::nix_store_socket(conn, "auto").await?,264			_ => remowt_fleet::nix_store_socket(conn, "auto").await?,
267		};265		};
266		// TODO: Utf8Path
268		let uri = format!("unix://{}", socket.display());267		let uri = format!("unix://{}", socket.display());
269		let store = Arc::new(Store::open(&uri)?);268		Store::open(&uri)
270		let _ = self.nix_store.set(store);
271		Ok(self.nix_store.get().expect("just set").clone())
272	}269	}
270	async fn nix_store(&self) -> Result<Arc<Store>> {
271		self.nix_store
272			.get_or_try_init(async || Ok(Arc::new(self.new_nix_store().await?)))
273			.await
274			.cloned()
275	}
273276
274	pub async fn decrypt(&self, data: SecretData) -> Result<Vec<u8>> {277	pub async fn decrypt(&self, data: SecretData) -> Result<Vec<u8>> {
275		ensure!(data.encrypted, "secret is not encrypted");278		ensure!(data.encrypted, "secret is not encrypted");
335		Ok(data)338		Ok(data)
336	}339	}
337	/// Returns path for futureproofing, as path might change i.e on conversion to CA340	/// Returns path for futureproofing, as path might change i.e on conversion to CA
341	#[instrument(skip(self))]
338	pub async fn remote_derivation(&self, path: impl AsRef<Utf8Path>) -> Result<Utf8PathBuf> {342	pub async fn remote_derivation(&self, path: &Utf8Path) -> Result<Utf8PathBuf> {
339		let path = path.as_ref().to_owned();343		let path = path.to_owned();
340		if self.local {344		if self.local {
341			// Path is located locally, thus already trusted.345			// Path is located locally, thus already trusted.
342			return Ok(path);346			return Ok(path);
502					pkgs_override: Some(self.default_pkgs.clone()),506					pkgs_override: Some(self.default_pkgs.clone()),
503507
504					local: true,508					local: true,
505					remowt: OnceLock::new(),509					remowt: OnceCell::new(),
506					nix_store: OnceLock::new(),510					nix_store: OnceCell::new(),
507					nix_plugin: OnceCell::new(),511					nix_plugin: OnceCell::new(),
508					deploy_kind: OnceCell::new(),512					deploy_kind: OnceCell::new(),
509					session_destination: OnceLock::new(),513					session_destination: OnceLock::new(),
545549
546			// TODO: Remove with connectivit refactor550			// TODO: Remove with connectivit refactor
547			local: self.localhost == name,551			local: self.localhost == name,
548			remowt: OnceLock::new(),552			remowt: OnceCell::new(),
549			nix_store: OnceLock::new(),553			nix_store: OnceCell::new(),
550			nix_plugin: OnceCell::new(),554			nix_plugin: OnceCell::new(),
551			deploy_kind: OnceCell::new(),555			deploy_kind: OnceCell::new(),
552			session_destination: OnceLock::new(),556			session_destination: OnceLock::new(),

7  remowt-agents-bundle = callPackage ./remowt-agents-bundle.nix { inherit craneLib; };7  remowt-agents-bundle = callPackage ./remowt-agents-bundle.nix { inherit craneLib; };
8in8in
9{9{
10  fleet = callPackage ./fleet.nix { inherit craneLib inputs; };10  fleet = callPackage ./fleet.nix { inherit craneLib inputs remowt-agents-bundle; };
11  fleet-install-secrets = callPackage ./fleet-install-secrets.nix { inherit craneLib; };11  fleet-install-secrets = callPackage ./fleet-install-secrets.nix { inherit craneLib; };
12  fleet-generator-helper = callPackage ./fleet-generator-helper.nix { inherit craneLib; };12  fleet-generator-helper = callPackage ./fleet-generator-helper.nix { inherit craneLib; };
1313