git.delta.rocks / fleet / refs/commits / 48d120aa4aef

722722
723[[package]]723[[package]]
724name = "camino"724name = "camino"
725version = "1.2.2"725version = "1.2.3"
726source = "registry+https://github.com/rust-lang/crates.io-index"726source = "registry+https://github.com/rust-lang/crates.io-index"
727checksum = "e629a66d692cb9ff1a1c664e41771b3dcaf961985a9774c0eb0bd1b51cf60a48"727checksum = "b4ce8d3bd5823c7504d3f579f13e7b2f3da252fcb938c594d5680ee508bf846f"
728dependencies = [728dependencies = [
729 "serde_core",729 "serde_core",
730]730]
1899 "fleet-shared",1899 "fleet-shared",
1900 "hex",1900 "hex",
1901 "hmac 0.13.0",1901 "hmac 0.13.0",
1902 "pbkdf2 0.12.2",1902 "pbkdf2 0.13.0",
1903 "rand 0.10.1",1903 "rand 0.10.1",
1904 "sha2 0.10.9",1904 "sha2 0.11.0",
1905 "x25519-dalek",1905 "x25519-dalek",
1906]1906]
19071907
5011 "nix-eval",5011 "nix-eval",
5012 "remowt-client",5012 "remowt-client",
5013 "remowt-endpoints",5013 "remowt-endpoints",
5014 "remowt-link-shared",
5014 "serde",5015 "serde",
5015 "thiserror 2.0.18",5016 "thiserror 2.0.18",
5016 "tokio",5017 "tokio",
5031 "iroh-base",5032 "iroh-base",
5032 "n0-watcher",5033 "n0-watcher",
5033 "noq-udp",5034 "noq-udp",
5034 "remowt-ui-prompt",
5035 "serde",5035 "serde",
5036 "serde_json",5036 "serde_json",
5037 "thiserror 2.0.18",5037 "thiserror 2.0.18",
5038 "tokio",5038 "tokio",
5039 "tokio-util",5039 "tokio-util",
5040 "tracing",5040 "tracing",
5041 "uuid",
5041]5042]
50425043
5043[[package]]5044[[package]]
5093 "anyhow",5094 "anyhow",
5094 "bifrostlink",5095 "bifrostlink",
5095 "bifrostlink-macros",5096 "bifrostlink-macros",
5097 "remowt-link-shared",
5096 "serde",5098 "serde",
5097 "thiserror 2.0.18",5099 "thiserror 2.0.18",
5098 "tokio",5100 "tokio",
5099 "tracing",5101 "tracing",
5100 "zbus",
5101]5102]
51025103
5103[[package]]5104[[package]]

15remowt-fleet = { path = "./crates/remowt-fleet" }15remowt-fleet = { path = "./crates/remowt-fleet" }
1616
17remowt-client = { version = "0.1.9", path = "remowt/crates/remowt-client" }17remowt-client = { version = "0.1.9", path = "remowt/crates/remowt-client" }
18remowt-polkit-shared = { version = "0.1.9", path = "remowt/crates/polkit-shared" }18remowt-endpoints = { version = "0.1.9", path = "remowt/crates/remowt-endpoints" }
19remowt-link-shared = { version = "0.1.9", path = "remowt/crates/remowt-link-shared" }19remowt-link-shared = { version = "0.1.9", path = "remowt/crates/remowt-link-shared" }
20remowt-plugin = { version = "0.1.9", path = "remowt/crates/remowt-plugin" }20remowt-plugin = { version = "0.1.9", path = "remowt/crates/remowt-plugin" }
21remowt-polkit-shared = { version = "0.1.9", path = "remowt/crates/polkit-shared" }
21remowt-ui-prompt = { version = "0.1.9", path = "remowt/crates/remowt-ui-prompt" }22remowt-ui-prompt = { version = "0.1.9", path = "remowt/crates/remowt-ui-prompt" }
22remowt-endpoints = { version = "0.1.9", path = "remowt/crates/remowt-endpoints" }
2323
24bifrostlink = "0.2.0"24bifrostlink = "0.2.0"
25bifrostlink-macros = "0.2.0"25bifrostlink-macros = "0.2.0"
26bifrostlink-ports = "0.2.0"26bifrostlink-ports = "0.2.0"
2727
28iroh = { version = "1.0.0", features = ["unstable-custom-transports"] }28iroh = { version = "1.0.0", features = ["unstable-custom-transports"] }
29iroh-base = "1.0.0"29iroh-base = "1.0.0"
30noq-udp = { version = "1.0.0", default-features = false }
31n0-watcher = "1.0.0"30n0-watcher = "1.0.0"
32
33uuid = { version = "1", features = ["v4"] }
34russh = { version = "0.61.2", default-features = false, features = [31noq-udp = { version = "1.0.0", default-features = false }
35        "ring",32
36        "flate2",
37        "rsa",
38] }
39russh-config = "0.58.0"
40age = { version = "0.11", features = ["plugin", "ssh"] }33age = { version = "0.11", features = ["plugin", "ssh"] }
41anyhow = "1.0"34anyhow = "1.0"
42base64 = "0.22.1"35base64 = "0.22.1"
64opentelemetry-appender-tracing = "0.32.0"57opentelemetry-appender-tracing = "0.32.0"
65opentelemetry-otlp = { version = "0.32.0", features = ["grpc-tonic", "gzip-tonic", "http-json", "reqwest-rustls"] }58opentelemetry-otlp = { version = "0.32.0", features = ["grpc-tonic", "gzip-tonic", "http-json", "reqwest-rustls"] }
66opentelemetry_sdk = "0.32.0"59opentelemetry_sdk = "0.32.0"
67pbkdf2 = "0.12"60pbkdf2 = "0.13"
68peg = "0.8.5"61peg = "0.8.5"
69pkg-config = "0.3.30"62pkg-config = "0.3.30"
70rand = "0.10.0"63rand = "0.10.0"
64russh = { version = "0.61.2", default-features = false, features = ["flate2", "ring", "rsa"] }
65russh-config = "0.58.0"
71serde = { version = "1.0", features = ["derive"] }66serde = { version = "1.0", features = ["derive"] }
72serde_json = "1.0"67serde_json = "1.0"
73sha2 = "0.10"68sha2 = "0.11"
74shlex = "2.0.1"69shlex = "2.0.1"
75tabled = "0.21.0"70tabled = "0.21.0"
76tempfile = "3.20"71tempfile = "3.20"
81tracing = "0.1"76tracing = "0.1"
82tracing-indicatif = "0.3.13"77tracing-indicatif = "0.3.13"
83tracing-opentelemetry = "0.33.0"78tracing-opentelemetry = "0.33.0"
79uuid = { version = "1", features = ["v4"] }
84# For fixed coloring needs to be updated to https://github.com/tokio-rs/tracing/pull/348480# For fixed coloring needs to be updated to https://github.com/tokio-rs/tracing/pull/3484
81tokio-util = "0.7.11"
85tracing-subscriber = { version = "0.3.19", features = ["env-filter", "fmt"] }82tracing-subscriber = { version = "0.3.19", features = ["env-filter", "fmt"] }
86unicode_categories = "0.1.1"83unicode_categories = "0.1.1"
87vte = { version = "0.15.0", features = ["ansi"] }84vte = { version = "0.15.0", features = ["ansi"] }
88x25519-dalek = { version = "2.0.1", features = ["getrandom"] }85x25519-dalek = { version = "2.0.1", features = ["getrandom"] }
89zbus = "5.16.0"86zbus = "5.16.0"
90zbus_polkit = "5.0.0"87zbus_polkit = "5.0.0"
91tokio-util = "0.7.11"
9288
93[profile.dev]89[profile.dev]
94panic = "abort"90panic = "abort"

5use clap::Parser;5use clap::Parser;
6use fleet_base::{6use fleet_base::{
7	deploy::{DeployAction, deploy_task, upload_task},7	deploy::{DeployAction, deploy_task, upload_task},
8	host::{Config, DeployKind, GenerationStorage},8	host::{Config, DeployKind},
9	opts::FleetOpts,9	opts::FleetOpts,
10	pins::GenerationStorage,
10};11};
11use futures::{StreamExt as _, stream::FuturesUnordered};12use futures::{StreamExt as _, stream::FuturesUnordered};
12use nix_eval::nix_go;13use nix_eval::nix_go;
145					}146					}
146147
147					let remote_path =148					let remote_path =
148						match upload_task(&config, &host, GenerationStorage::Deployer, built).await149						match upload_task(&host, GenerationStorage::Deployer, built).await {
149						{
150							Ok(v) => v,150							Ok(v) => v,
151							Err(e) => {151							Err(e) => {

4use clap::Parser;4use clap::Parser;
5use fleet_base::{5use fleet_base::{
6	deploy::{DeployAction, deploy_task, upload_task},6	deploy::{DeployAction, deploy_task, upload_task},
7	host::{Config, ConfigHost, Generation, GenerationStorage},7	host::{Config, ConfigHost},
8	opts::FleetOpts,8	opts::FleetOpts,
9	pins::{Generation, GenerationStorage},
9};10};
10use tabled::Table;11use tabled::Table;
11use tracing::{info, warn};12use tracing::{info, warn};
104					);105					);
105				};106				};
106				let remote_path = upload_task(107				let remote_path =
107					config,
108					&host,108					upload_task(&host, generation.location, generation.store_path.clone()).await?;
109					generation.location,
110					generation.store_path.clone(),
111				)
112				.await?;
113109

1#![recursion_limit = "512"]1#![recursion_limit = "512"]
22
3pub(crate) mod cmds;3pub(crate) mod cmds;
4// pub(crate) mod command;
5pub(crate) mod extra_args;
64
7use std::{process::ExitCode, sync::Arc};5use std::{process::ExitCode, sync::Arc};
86

14use clap::{Parser, ValueEnum};14use clap::{Parser, ValueEnum};
15use ed25519_dalek::SecretKey;15use ed25519_dalek::SecretKey;
16use fleet_shared::SecretData;16use fleet_shared::SecretData;
17use hmac::Mac as _;17use hmac::{KeyInit as _, Mac as _};
18use rand::{18use rand::{
19	Rng as _,19	Rng as _,
20	distr::{Alphanumeric, Distribution, SampleString, Uniform},20	distr::{Alphanumeric, Distribution, SampleString, Uniform},
338					);338					);
339339
340					type HmacSha256 = hmac::Hmac<sha2::Sha256>;340					type HmacSha256 = hmac::Hmac<sha2::Sha256>;
341					let mut mac = <HmacSha256 as hmac::Mac>::new_from_slice(&salted)341					let mut mac =
342						.expect("HMAC accepts any key length");342						HmacSha256::new_from_slice(&salted).expect("HMAC accepts any key length");
343					mac.update(b"Client Key");343					mac.update(b"Client Key");
344					let client_key = mac.finalize().into_bytes();344					let client_key = mac.finalize().into_bytes();
347					hasher.update(client_key);347					hasher.update(client_key);
348					let stored_key = hasher.finalize();348					let stored_key = hasher.finalize();
349349
350					let mut mac = <HmacSha256 as hmac::Mac>::new_from_slice(&salted)350					let mut mac =
351						.expect("HMAC accepts any key length");351						HmacSha256::new_from_slice(&salted).expect("HMAC accepts any key length");
352					mac.update(b"Server Key");352					mac.update(b"Server Key");
353					let server_key = mac.finalize().into_bytes();353					let server_key = mac.finalize().into_bytes();

2name = "remowt-plugin-fleet"2name = "remowt-plugin-fleet"
3description = "Remowt plugin exposing fleet's Nix endpoint to a running agent"3description = "Remowt plugin exposing fleet's Nix endpoint to a running agent"
4version.workspace = true4version.workspace = true
5edition = "2021"5edition.workspace = true
66
7[dependencies]7[dependencies]
8remowt-fleet.workspace = true8remowt-fleet.workspace = true

11use tokio::time::sleep;11use tokio::time::sleep;
12use tracing::{Instrument as _, error, info, info_span, warn};12use tracing::{Instrument as _, error, info, info_span, warn};
1313
14use crate::host::{Config, ConfigHost, DeployKind, Generation, GenerationStorage};14use crate::host::{ConfigHost, DeployKind};
15use crate::pins::{Generation, GenerationStorage};
1516
16#[derive(ValueEnum, Clone, Copy)]17#[derive(ValueEnum, Clone, Copy)]
17pub enum DeployAction {18pub enum DeployAction {
260			{261			{
261				// It is ok, if there was no reboot - then timer might not be running.262				// It is ok, if there was no reboot - then timer might not be running.
262			}263			}
263			if action.should_schedule_rollback_run() {264			if action.should_schedule_rollback_run()
264				if let Err(e) = elevated_systemd265				&& let Err(e) = elevated_systemd
265					.stop("rollback-watchdog-run.timer".to_owned())266					.stop("rollback-watchdog-run.timer".to_owned())
266					.await267					.await
267				{268			{
268					error!("failed to disarm rollback run: {e}");269				error!("failed to disarm rollback run: {e}");
269				}270			}
270			}
271		} else if let Err(_e) = elevated_fs271		} else if let Err(_e) = elevated_fs
272			.rm_file(Utf8PathBuf::from("/etc/fleet_rollback_marker"))272			.rm_file(Utf8PathBuf::from("/etc/fleet_rollback_marker"))
273			.in_current_span()273			.in_current_span()
280}280}
281281
282pub async fn upload_task(282pub async fn upload_task(
283	config: &Config,
284	host: &ConfigHost,283	host: &ConfigHost,
285	location: GenerationStorage,284	location: GenerationStorage,
286	generation: Utf8PathBuf,285	generation: Utf8PathBuf,

6	},6	},
7	fmt,7	fmt,
8	io::{self, Cursor},8	io::{self, Cursor},
9	str::FromStr,
9	sync::RwLock,10	sync::RwLock,
10};11};
1112
92	#[serde(skip_serializing)]93	#[serde(skip_serializing)]
93	host_secrets: BTreeMap<SecretOwner, BTreeMap<String, FleetSecretDistribution>>,94	host_secrets: BTreeMap<SecretOwner, BTreeMap<String, FleetSecretDistribution>>,
94}95}
95impl FleetData {96impl FromStr for FleetData {
97	type Err = anyhow::Error;
96	pub fn from_str(s: &str) -> anyhow::Result<Self> {98	fn from_str(s: &str) -> anyhow::Result<Self> {
97		let mut data: Self = nixlike::parse_str(s)?;99		let mut data: Self = nixlike::parse_str(s)?;
98		if !data.host_secrets.is_empty() {100		if !data.host_secrets.is_empty() {
99			info!("migrating host secrets into shared secrets structure");101			info!("migrating host secrets into shared secrets structure");
294	/// Drop expired distributions296	/// Drop expired distributions
295	fn prune_expired(&mut self, now: DateTime<Utc>) {297	fn prune_expired(&mut self, now: DateTime<Utc>) {
296		for ele in self.distributions_mut() {298		for ele in self.distributions_mut() {
297			if let Some(expires_at) = ele.secret.expires_at {299			if let Some(expires_at) = ele.secret.expires_at
298				if expires_at < now {300				&& expires_at < now
301			{
299					ele.prune(format!("expired during check at {now}"));302				ele.prune(format!("expired during check at {now}"));
300				}303			}
301			}
302		}304		}
303	}305	}
304	/// Perform all pruning relevant to shared secrets306	/// Perform all pruning relevant to shared secrets
305	/// Also see expected_owner_removed307	/// Also see expected_owner_removed
308	#[allow(clippy::too_many_arguments)]
306	pub fn prune_shared(309	pub fn prune_shared(
307		&mut self,310		&mut self,
308		expected_owners: &BTreeSet<SecretOwner>,311		expected_owners: &BTreeSet<SecretOwner>,
323		let mut to_add = expected_owners.difference(&current_owners);326		let mut to_add = expected_owners.difference(&current_owners);
324		if to_add.next().is_some() && unique && regenerate_on_owner_added {327		if to_add.next().is_some() && unique && regenerate_on_owner_added {
325			for dist in self.distributions_mut() {328			for dist in self.distributions_mut() {
326				dist.prune(format!(329				dist.prune(
327					"owners missing, can't add new distribution, regeneration preferred"330					"owners missing, can't add new distribution, regeneration preferred"
331						.to_string(),
328				));332				);
329			}333			}
330			return;334			return;
331		}335		}
332336
333		for to_remove in current_owners.difference(&expected_owners) {337		for to_remove in current_owners.difference(expected_owners) {
334			self.entry(to_remove.clone()).remove(338			self.entry(to_remove.clone()).remove(
335				regenerate_on_owner_removed,339				regenerate_on_owner_removed,
336				"owner was removed from expected owners list, regenerate_on_owner_removed is set"340				"owner was removed from expected owners list, regenerate_on_owner_removed is set"
362	) -> Option<usize> {366	) -> Option<usize> {
363		self.distributions()367		self.distributions()
364			.enumerate()368			.enumerate()
365			.max_by(|(_, a), (_, b)| {369			.max_by(|(_, a), (_, b)| compare_dists(a, b, prefer_identities, include_pruned_owners))
366				compare_dists(&a, &b, prefer_identities, include_pruned_owners)
367			})
368			.map(|(p, _)| p)370			.map(|(p, _)| p)
369	}371	}
370	/// Secret wants to be the same on all hosts, leave only one unpruned version of it372	/// Secret wants to be the same on all hosts, leave only one unpruned version of it
410		filter_owner: Option<&SecretOwner>,412		filter_owner: Option<&SecretOwner>,
411	) {413	) {
412		'dist: for ele in self.distributions_mut() {414		'dist: for ele in self.distributions_mut() {
413			if let Some(filter_owner) = filter_owner {415			if let Some(filter_owner) = filter_owner
414				if !ele.owners.contains(filter_owner) {416				&& !ele.owners.contains(filter_owner)
417			{
415					continue;418				continue;
416				}
417				// Note: secret still can have multiple owners even if it is host-owned419				// Note: secret still can have multiple owners even if it is host-owned
418				// in this case we expect that all owners using the same generator, so we can prune distribution for all of them420				// in this case we expect that all owners using the same generator, so we can prune distribution for all of them
419			}421			}
420			for (name, part) in expected_parts {422			for (name, part) in expected_parts {
421				let Some(stored_part) = ele.secret.parts.get(name) else {423				let Some(stored_part) = ele.secret.parts.get(name) else {
422					ele.prune(format!("secret definition added new part: {name}"));424					ele.prune(format!("secret definition added new part: {name}"));
442		filter_owner: Option<&SecretOwner>,444		filter_owner: Option<&SecretOwner>,
443	) {445	) {
444		for ele in self.distributions_mut() {446		for ele in self.distributions_mut() {
445			if let Some(filter_owner) = filter_owner {447			if let Some(filter_owner) = filter_owner
446				if !ele.owners.contains(filter_owner) {448				&& !ele.owners.contains(filter_owner)
449			{
447					continue;450				continue;
448				}
449				// Note: secret still can have multiple owners even if it is host-owned451				// Note: secret still can have multiple owners even if it is host-owned
450				// in this case we expect that all owners using the same generator, so we can prune distribution for all of them452				// in this case we expect that all owners using the same generator, so we can prune distribution for all of them
451			}453			}
452			if ele.secret.generation_data != *expected_generation_data {454			if ele.secret.generation_data != *expected_generation_data {
453				ele.prune(format!(455				ele.prune(format!(
454					"expected generation data mismatch: {expected_generation_data:?}"456					"expected generation data mismatch: {expected_generation_data:?}"
519	}521	}
520}522}
521523
522struct OccupiedDistEntry<'d> {524pub struct OccupiedDistEntry<'d> {
523	distributions: &'d mut FleetSecretDistributions,525	distributions: &'d mut FleetSecretDistributions,
524	idx: usize,526	idx: usize,
525	owners: BTreeSet<SecretOwner>,527	owners: BTreeSet<SecretOwner>,
537			owners: self.owners,539			owners: self.owners,
538		}540		}
539	}541	}
540	fn set(self, secret: FleetSecretData, reason: String) -> Self {542	pub fn set(self, secret: FleetSecretData, reason: String) -> Self {
541		self.remove(false, reason).set(secret)543		self.remove(false, reason).set(secret)
542	}544	}
543}545}
544struct VacantDistEntry<'d> {546pub struct VacantDistEntry<'d> {
545	distributions: &'d mut FleetSecretDistributions,547	distributions: &'d mut FleetSecretDistributions,
546	owners: BTreeSet<SecretOwner>,548	owners: BTreeSet<SecretOwner>,
547}549}
548impl<'d> VacantDistEntry<'d> {550impl<'d> VacantDistEntry<'d> {
549	fn set(self, secret: FleetSecretData) -> OccupiedDistEntry<'d> {551	pub fn set(self, secret: FleetSecretData) -> OccupiedDistEntry<'d> {
550		let Self {552		let Self {
551			distributions,553			distributions,
552			owners,554			owners,
568	}570	}
569}571}
570572
571enum DistEntry<'d> {573pub enum DistEntry<'d> {
572	Vacant(VacantDistEntry<'d>),574	Vacant(VacantDistEntry<'d>),
573	Occupied(OccupiedDistEntry<'d>),575	Occupied(OccupiedDistEntry<'d>),
574}576}
575impl DistEntry<'_> {577impl DistEntry<'_> {
576	fn remove(self, whole_dist: bool, reason: String) -> Self {578	pub fn remove(self, whole_dist: bool, reason: String) -> Self {
577		match self {579		match self {
578			DistEntry::Vacant(_) => self,580			DistEntry::Vacant(_) => self,
579			DistEntry::Occupied(o) => Self::Vacant(o.remove(whole_dist, reason)),581			DistEntry::Occupied(o) => Self::Vacant(o.remove(whole_dist, reason)),
580		}582		}
581	}583	}
582	fn set(self, secret: FleetSecretData, reason: String) -> Self {584	pub fn set(self, secret: FleetSecretData, reason: String) -> Self {
583		Self::Occupied(match self {585		Self::Occupied(match self {
584			DistEntry::Vacant(e) => e.set(secret),586			DistEntry::Vacant(e) => e.set(secret),
585			DistEntry::Occupied(e) => e.set(secret, reason),587			DistEntry::Occupied(e) => e.set(secret, reason),
683}685}
684686
685impl FleetSecrets {687impl FleetSecrets {
686	pub fn keys(&self) -> btree_map::Keys<String, FleetSecretDistributions> {688	pub fn keys(&self) -> btree_map::Keys<'_, String, FleetSecretDistributions> {
687		self.0.keys()689		self.0.keys()
688	}690	}
689691
713	}715	}
714716
715	pub fn get_or_create(&mut self, secret: &str) -> &mut FleetSecretDistributions {717	pub fn get_or_create(&mut self, secret: &str) -> &mut FleetSecretDistributions {
716		self.0718		self.0.entry(secret.to_owned()).or_default()
717			.entry(secret.to_owned())
718			.or_insert(FleetSecretDistributions::default())
719	}719	}
720720
721	pub fn contains(&self, secret: &str) -> bool {721	pub fn contains(&self, secret: &str) -> bool {

13use camino::{Utf8Path, Utf8PathBuf};13use camino::{Utf8Path, Utf8PathBuf};
14use chrono::{DateTime, Utc};14use chrono::{DateTime, Utc};
15use fleet_shared::SecretData;15use fleet_shared::SecretData;
16use nix_eval::{Store, Value, eval_store, nix_go, nix_go_json, util::assert_warn};16use nix_eval::{Store, Value, drv::DrvGraph, eval_store, nix_go, nix_go_json, util::assert_warn};
17use remowt_client::{AgentBundle, Remowt};17use remowt_client::{AgentBundle, Remowt};
18use remowt_endpoints::fs::FsClient;18use remowt_endpoints::fs::FsClient;
19use remowt_fleet::NixClient;
19use remowt_link_shared::Address;20use remowt_link_shared::BifConfig;
20use remowt_ui_prompt::auto::AutoPrompter;21use remowt_ui_prompt::auto::AutoPrompter;
21use remowt_ui_prompt::bifrost::PromptEndpoints;22use remowt_ui_prompt::bifrost::PromptEndpoints;
22use remowt_ui_prompt::{PrependSourcePrompter, Source};23use remowt_ui_prompt::{PrependSourcePrompter, Source};
23use tabled::Tabled;
24use tempfile::NamedTempFile;24use tempfile::NamedTempFile;
25use time::UtcDateTime;
26use tokio::task::spawn_blocking;25use tokio::{sync::OnceCell, task::spawn_blocking};
27use tracing::warn;26use tracing::{info, warn};
2827
29use crate::fleetdata::{28use crate::fleetdata::{
30	FleetData, FleetSecretData, FleetSecretDistribution, FleetSecretPart, SecretOwner,29	FleetData, FleetSecretData, FleetSecretDistribution, FleetSecretPart, SecretOwner,
101	groups: OnceLock<Vec<String>>,100	groups: OnceLock<Vec<String>>,
102101
103	// TODO: Both of those values are taken from host opts, there should be a cleaner way to specify it102	// TODO: Both of those values are taken from host opts, there should be a cleaner way to specify it
104	deploy_kind: OnceLock<DeployKind>,103	deploy_kind: OnceCell<DeployKind>,
105	session_destination: OnceLock<String>,104	session_destination: OnceLock<String>,
106	legacy_ssh_store: OnceLock<bool>,105	legacy_ssh_store: OnceLock<bool>,
107106
114	pub local: bool,113	pub local: bool,
115	pub remowt: OnceLock<Remowt>,114	pub remowt: OnceLock<Remowt>,
116	nix_store: OnceLock<Arc<Store>>,115	nix_store: OnceLock<Arc<Store>>,
117	nix_plugin: tokio::sync::OnceCell<()>,116	nix_plugin: OnceCell<()>,
118}117}
119118
120const NIX_PLUGIN_ID: u16 = 2;119const NIX_PLUGIN_ID: u16 = 2;
132	AgentBundle::from_dir(agents_dir()?)131	AgentBundle::from_dir(agents_dir()?)
133}132}
134133
135#[derive(Debug, Clone, Copy)]
136pub enum GenerationStorage {134enum RemoteDerivationMode {
137	Deployer,135	CopySigned,
138	Machine,136	Copy,
139	Pusher,137	Attic,
138	Cachix,
140}139}
141impl GenerationStorage {
142	fn prefix(&self) -> &'static str {
143		match self {
144			GenerationStorage::Deployer => "deployer.",
145			GenerationStorage::Machine => "",
146			GenerationStorage::Pusher => "pusher.",
147		}
148	}
149}
150
151#[derive(Tabled, Debug)]
152pub struct Generation {
153	#[tabled(rename = "ID", format("{}", self.rollback_id()))]
154	pub id: u32,
155	#[tabled(rename = "Current")]
156	pub current: bool,
157	#[tabled(rename = "Created at")]
158	pub datetime: UtcDateTime,
159	#[tabled(format = "{:?}")]
160	pub store_path: Utf8PathBuf,
161	#[tabled(skip)]
162	pub location: GenerationStorage,
163}
164impl Generation {
165	pub fn rollback_id(&self) -> String {
166		format!("{}{}", self.location.prefix(), self.id)
167	}
168}
169140
170impl ConfigHost {141impl ConfigHost {
171	pub async fn list_generations(&self, profile: &str) -> Result<Vec<Generation>> {
172		let plugin_id = self.ensure_nix_plugin().await?;
173		let nix = self
174			.remowt()
175			.await?
176			.plugin_endpoints::<remowt_fleet::NixClient<_>>(plugin_id);
177		let raw = nix
178			.list_generations(profile.to_owned())
179			.await
180			.map_err(|e| anyhow!("{e:?}"))?
181			.map_err(|e| anyhow!("{e}"))?;
182		raw.into_iter()
183			.map(|g| {
184				let id: u32 =
185					g.id.try_into()
186						.with_context(|| format!("generation id {} doesn't fit in u32", g.id))?;
187				let datetime = UtcDateTime::from_unix_timestamp(g.creation_time_unix)
188					.with_context(|| {
189						format!("invalid generation timestamp {}", g.creation_time_unix)
190					})?;
191				Ok(Generation {
192					id,
193					current: g.current,
194					datetime,
195					store_path: g.store_path,
196					location: GenerationStorage::Machine,
197				})
198			})
199			.collect()
200	}
201
202	pub fn set_session_destination(&self, dest: String) {142	pub fn set_session_destination(&self, dest: String) {
203		self.session_destination143		self.session_destination
215			.expect("legacy ssh store is already set")155			.expect("legacy ssh store is already set")
216	}156	}
217	pub async fn deploy_kind(&self) -> Result<DeployKind> {157	pub async fn deploy_kind(&self) -> Result<DeployKind> {
218		if let Some(kind) = self.deploy_kind.get() {158		self.deploy_kind.get_or_try_init(|| async {
219			return Ok(*kind);
220		}
221		let remowt = self.remowt().await?;159			let remowt = self.remowt().await?;
222		let fs = remowt.endpoints::<FsClient<_>>();160			let fs = remowt.endpoints::<FsClient<_>>();
223		let is_fleet_managed = match fs.file_exists(Utf8PathBuf::from("/etc/FLEET_HOST")).await {161			let is_fleet_managed = match fs.file_exists(Utf8PathBuf::from("/etc/FLEET_HOST")).await {
229		if !is_fleet_managed {167			if !is_fleet_managed {
230			bail!(168				bail!(
231				"{}",169					"{}",
232				indoc::indoc! {"170					indoc::indoc! {"
233				host is not marked as managed by fleet171					host is not marked as managed by fleet
234				if you're not trying to lustrate/install system from scratch,172					if you're not trying to lustrate/install system from scratch,
235				you should either173					you should either
236					1. manually create /etc/FLEET_HOST file on the target host,174						1. manually create /etc/FLEET_HOST file on the target host,
237					2. use ?deploy_kind=fleet host argument if you're upgrading from older version of fleet175						2. use ?deploy_kind=fleet host argument if you're upgrading from older version of fleet
238					3. use ?deploy_kind=upgrade_to_fleet if you're upgrading from plain nixos to fleet-managed nixos176						3. use ?deploy_kind=upgrade_to_fleet if you're upgrading from plain nixos to fleet-managed nixos
239				for installation use ?deploy_kind=nixos_install / ?deploy_kind=nixos_lustrate 177					for installation use ?deploy_kind=nixos_install / ?deploy_kind=nixos_lustrate 
240			"}178				"}
241			);179				);
242		}180			}
243		// TOCTOU is possible
244		let _ = self.deploy_kind.set(DeployKind::Fleet);181			Ok(DeployKind::Fleet)
245		Ok(*self.deploy_kind.get().expect("deploy kind is just set"))182		}).await.copied()
246	}183	}
247	async fn connection(&self) -> Result<Remowt> {184	async fn connection(&self) -> Result<Remowt> {
248		if let Some(conn) = self.remowt.get() {185		if let Some(conn) = self.remowt.get() {
285		self.connection().await222		self.connection().await
286	}223	}
287224
225	pub async fn nix_client(&self) -> Result<NixClient<BifConfig>> {
226		let remowt = self.remowt().await?;
227		let plugin_id = self.ensure_nix_plugin().await?;
228		Ok(remowt.plugin_endpoints(plugin_id))
229	}
288	pub fn ensure_nix_plugin(&self) -> Pin<Box<dyn Future<Output = Result<u16>> + Send + '_>> {230	pub fn ensure_nix_plugin(&self) -> Pin<Box<dyn Future<Output = Result<u16>> + Send + '_>> {
289		Box::pin(async {231		Box::pin(async {
290			self.nix_plugin232			self.nix_plugin
305						.run0_load_plugin_path(NIX_PLUGIN_ID, bin.as_str())247						.run0_load_plugin_path(NIX_PLUGIN_ID, bin.as_str())
306						.await248						.await
307						.context("failed to load the fleet nix plugin")?;249						.context("failed to load the fleet nix plugin")?;
308					self.remowt()
309						.await?
310						.rpc()
311						.wait_for_connection_to(Address::Plugin(NIX_PLUGIN_ID))
312						.await
313						.map_err(|_| anyhow!("failed to wait for plugin"))?;
314					anyhow::Ok(())250					anyhow::Ok(())
315				})251				})
316				.await?;252				.await?;
407		}343		}
408		let sign: Pin<Box<dyn Future<Output = Result<()>> + Send>> = {344		let sign: Pin<Box<dyn Future<Output = Result<()>> + Send>> = {
409			let path = path.clone();345			let path = path.clone();
346			let graph = DrvGraph::resolve(&eval_store(), &path)
347				.context("failed to resolve graph to be uploaded")?;
348			info!("signing {} paths", graph.nodes.len());
349
410			Box::pin(async move {350			Box::pin(async move {
411				let local = self.config.local_host();351				let local = self.config.local_host();
564					local: true,504					local: true,
565					remowt: OnceLock::new(),505					remowt: OnceLock::new(),
566					nix_store: OnceLock::new(),506					nix_store: OnceLock::new(),
567					nix_plugin: tokio::sync::OnceCell::new(),507					nix_plugin: OnceCell::new(),
568					deploy_kind: OnceLock::new(),508					deploy_kind: OnceCell::new(),
569					session_destination: OnceLock::new(),509					session_destination: OnceLock::new(),
570					legacy_ssh_store: OnceLock::new(),510					legacy_ssh_store: OnceLock::new(),
571				})511				})
607			local: self.localhost == name,547			local: self.localhost == name,
608			remowt: OnceLock::new(),548			remowt: OnceLock::new(),
609			nix_store: OnceLock::new(),549			nix_store: OnceLock::new(),
610			nix_plugin: tokio::sync::OnceCell::new(),550			nix_plugin: OnceCell::new(),
611			deploy_kind: OnceLock::new(),551			deploy_kind: OnceCell::new(),
612			session_destination: OnceLock::new(),552			session_destination: OnceLock::new(),
613			legacy_ssh_store: OnceLock::new(),553			legacy_ssh_store: OnceLock::new(),
614		})554		})