--- a/crates/fleet-base/src/host.rs
+++ b/crates/fleet-base/src/host.rs
@@ -23,7 +23,7 @@
use remowt_ui_prompt::{PrependSourcePrompter, Source};
use tempfile::NamedTempFile;
use tokio::{sync::OnceCell, task::spawn_blocking};
-use tracing::{info, warn};
+use tracing::{info, instrument, warn};
use crate::fleetdata::{
FleetData, FleetSecretData, FleetSecretDistribution, FleetSecretPart, SecretOwner,
@@ -111,8 +111,8 @@
// TODO: Move command helpers away with connectivity refactor
pub local: bool,
- pub remowt: OnceLock<Remowt>,
- nix_store: OnceLock<Arc<Store>>,
+ pub remowt: OnceCell<Remowt>,
+ nix_store: OnceCell<Arc<Store>>,
nix_plugin: OnceCell<()>,
}
@@ -132,10 +132,12 @@
}
enum RemoteDerivationMode {
+ /// Closure is (pre)signed, remote host is expected to trust our signatures.
CopySigned,
- Copy,
- Attic,
- Cachix,
+ /// Closure is not signed, using escalated nix daemon to bypass signature verification.
+ CopyPrivileged,
+ /// Closure is uploaded to attic, remote host is expected to trust its signature.
+ Attic { name: String },
}
impl ConfigHost {
@@ -181,10 +183,7 @@
Ok(DeployKind::Fleet)
}).await.copied()
}
- async fn connection(&self) -> Result<Remowt> {
- if let Some(conn) = self.remowt.get() {
- return Ok(conn.clone());
- }
+ async fn new_remowt(&self) -> Result<Remowt> {
let bundle = agent_bundle()?;
let conn = if self.local {
Remowt::connect_local(&bundle, "remowt-fleet".to_owned())
@@ -213,13 +212,15 @@
description: "".to_owned(),
})
.register_endpoints(&mut conn.rpc());
- let _ = self.remowt.set(conn);
- Ok(self.remowt.get().expect("just set").clone())
+ Ok(conn)
}
/// Client for this host's unprivileged agent.
pub async fn remowt(&self) -> Result<Remowt> {
- self.connection().await
+ self.remowt
+ .get_or_try_init(|| self.new_remowt())
+ .await
+ .cloned()
}
pub async fn nix_client(&self) -> Result<NixClient<BifConfig>> {
@@ -254,22 +255,24 @@
})
}
- async fn nix_store(&self) -> Result<Arc<Store>> {
- if let Some(store) = self.nix_store.get() {
- return Ok(store.clone());
- }
- let conn = self.connection().await?;
+ async fn new_nix_store(&self) -> Result<Store> {
+ let conn = self.remowt().await?;
let socket = match self.deploy_kind().await? {
DeployKind::NixosInstall => {
remowt_fleet::nix_store_socket(conn, "/mnt?require-sigs=false").await?
}
_ => remowt_fleet::nix_store_socket(conn, "auto").await?,
};
+ // TODO: Utf8Path
let uri = format!("unix://{}", socket.display());
- let store = Arc::new(Store::open(&uri)?);
- let _ = self.nix_store.set(store);
- Ok(self.nix_store.get().expect("just set").clone())
+ Store::open(&uri)
}
+ async fn nix_store(&self) -> Result<Arc<Store>> {
+ self.nix_store
+ .get_or_try_init(async || Ok(Arc::new(self.new_nix_store().await?)))
+ .await
+ .cloned()
+ }
pub async fn decrypt(&self, data: SecretData) -> Result<Vec<u8>> {
ensure!(data.encrypted, "secret is not encrypted");
@@ -335,8 +338,9 @@
Ok(data)
}
/// Returns path for futureproofing, as path might change i.e on conversion to CA
- pub async fn remote_derivation(&self, path: impl AsRef<Utf8Path>) -> Result<Utf8PathBuf> {
- let path = path.as_ref().to_owned();
+ #[instrument(skip(self))]
+ pub async fn remote_derivation(&self, path: &Utf8Path) -> Result<Utf8PathBuf> {
+ let path = path.to_owned();
if self.local {
// Path is located locally, thus already trusted.
return Ok(path);
@@ -502,8 +506,8 @@
pkgs_override: Some(self.default_pkgs.clone()),
local: true,
- remowt: OnceLock::new(),
- nix_store: OnceLock::new(),
+ remowt: OnceCell::new(),
+ nix_store: OnceCell::new(),
nix_plugin: OnceCell::new(),
deploy_kind: OnceCell::new(),
session_destination: OnceLock::new(),
@@ -545,8 +549,8 @@
// TODO: Remove with connectivit refactor
local: self.localhost == name,
- remowt: OnceLock::new(),
- nix_store: OnceLock::new(),
+ remowt: OnceCell::new(),
+ nix_store: OnceCell::new(),
nix_plugin: OnceCell::new(),
deploy_kind: OnceCell::new(),
session_destination: OnceLock::new(),