7 files changed
92 "scrypt",92 "scrypt",
93 "sha2",93 "sha2",
94 "subtle",94 "subtle",
95 "which",
96 "wsl",
95 "x25519-dalek",97 "x25519-dalek",
96 "zeroize",98 "zeroize",
97]99]
111 "rand 0.8.5",113 "rand 0.8.5",
112 "secrecy",114 "secrecy",
113 "sha2",115 "sha2",
116 "tempfile",
114]117]
115118
116[[package]]119[[package]]
1285 "digest",1288 "digest",
1286]1289]
1290
1291[[package]]
1292name = "home"
1293version = "0.5.11"
1294source = "registry+https://github.com/rust-lang/crates.io-index"
1295checksum = "589533453244b0995c858700322199b2becb13b627df2851f64a2775d024abcf"
1296dependencies = [
1297 "windows-sys 0.59.0",
1298]
12871299
1288[[package]]1300[[package]]
1289name = "hostname"1301name = "hostname"
3638 "wasm-bindgen",3650 "wasm-bindgen",
3639]3651]
3652
3653[[package]]
3654name = "which"
3655version = "4.4.2"
3656source = "registry+https://github.com/rust-lang/crates.io-index"
3657checksum = "87ba24419a2078cd2b0f2ede2691b6c66d8e47836da3b6db8265ebad47afbfc7"
3658dependencies = [
3659 "either",
3660 "home",
3661 "once_cell",
3662 "rustix 0.38.40",
3663]
36403664
3641[[package]]3665[[package]]
3642name = "winapi"3666name = "winapi"
3775 "bitflags",3799 "bitflags",
3776]3800]
3801
3802[[package]]
3803name = "wsl"
3804version = "0.1.0"
3805source = "registry+https://github.com/rust-lang/crates.io-index"
3806checksum = "f8dab7ac864710bdea6594becbea5b5050333cf34fefb0dc319567eb347950d4"
37773807
3778[[package]]3808[[package]]
3779name = "x25519-dalek"3809name = "x25519-dalek"
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -11,7 +11,7 @@
nix-eval = { path = "./crates/nix-eval" }
nixlike = { path = "./crates/nixlike" }
-age = { version = "0.11", features = ["ssh"] }
+age = { version = "0.11", features = ["ssh", "plugin"] }
anyhow = "1.0"
clap = { version = "4.5", features = ["derive", "env", "unicode", "wrap_help"] }
clap_complete = "4.5"
--- a/cmds/fleet/src/cmds/secrets/mod.rs
+++ b/cmds/fleet/src/cmds/secrets/mod.rs
@@ -23,6 +23,7 @@
#[derive(Parser)]
pub enum Secret {
+ AddManager,
/// Force load host keys for all defined hosts
ForceKeys,
/// Add secret, data should be provided in stdin
@@ -521,6 +522,9 @@
impl Secret {
pub async fn run(self, config: &Config, opts: &FleetOpts) -> Result<()> {
match self {
+ Secret::AddManager => {
+ todo!("part of fleet-pusher")
+ }
Secret::ForceKeys => {
for host in config.list_hosts().await? {
if opts.should_skip(&host).await? {
--- a/crates/fleet-base/src/fleetdata.rs
+++ b/crates/fleet-base/src/fleetdata.rs
@@ -53,12 +53,22 @@
#[derive(Serialize, Deserialize)]
#[serde(rename_all = "camelCase")]
+pub struct ManagerKey {
+ pub name: String,
+ pub key: String,
+}
+
+#[derive(Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
pub struct FleetData {
pub version: FleetDataVersion,
#[serde(default = "generate_gc_prefix")]
pub gc_root_prefix: String,
#[serde(default)]
+ pub manager_keys: Vec<ManagerKey>,
+
+ #[serde(default)]
pub hosts: BTreeMap<String, HostData>,
#[serde(default)]
#[serde(skip_serializing_if = "BTreeMap::is_empty")]
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
"nodes": {
"crane": {
"locked": {
- "lastModified": 1750266157,
- "narHash": "sha256-tL42YoNg9y30u7zAqtoGDNdTyXTi8EALDeCB13FtbQA=",
+ "lastModified": 1753316655,
+ "narHash": "sha256-tzWa2kmTEN69OEMhxFy+J2oWSvZP5QhEgXp3TROOzl0=",
"owner": "ipetkov",
"repo": "crane",
- "rev": "e37c943371b73ed87faf33f7583860f81f1d5a48",
+ "rev": "f35a3372d070c9e9ccb63ba7ce347f0634ddf3d2",
"type": "github"
},
"original": {
@@ -22,11 +22,11 @@
]
},
"locked": {
- "lastModified": 1749398372,
- "narHash": "sha256-tYBdgS56eXYaWVW3fsnPQ/nFlgWi/Z2Ymhyu21zVM98=",
+ "lastModified": 1753121425,
+ "narHash": "sha256-TVcTNvOeWWk1DXljFxVRp+E0tzG1LhrVjOGGoMHuXio=",
"owner": "hercules-ci",
"repo": "flake-parts",
- "rev": "9305fe4e5c2a6fcf5ba6a3ff155720fbe4076569",
+ "rev": "644e0fc48951a860279da645ba77fe4a6e814c5e",
"type": "github"
},
"original": {
@@ -37,11 +37,11 @@
},
"nixpkgs": {
"locked": {
- "lastModified": 1750895632,
- "narHash": "sha256-EPZWiRmaSTxoBArK5dQyRlSNVLXiBt2hmsYIPgMf3zk=",
+ "lastModified": 1753320130,
+ "narHash": "sha256-KCuv6iYQ0XTVAEJvDLIsk99CJm7fuqIE0/KknyeYPtM=",
"owner": "nixos",
"repo": "nixpkgs",
- "rev": "6ac57ce7fee0d80226095a57ccb7519855ad7c5e",
+ "rev": "788cc7374af486168b8aab6ca49e316c03508a86",
"type": "github"
},
"original": {
@@ -68,11 +68,11 @@
]
},
"locked": {
- "lastModified": 1750819193,
- "narHash": "sha256-XvkupGPZqD54HuKhN/2WhbKjAHeTl1UEnWspzUzRFfA=",
+ "lastModified": 1753238793,
+ "narHash": "sha256-jmQeEpgX+++MEgrcikcwoSiI7vDZWLP0gci7XiWb9uQ=",
"owner": "oxalica",
"repo": "rust-overlay",
- "rev": "1ba3b9c59b68a4b00156827ad46393127b51b808",
+ "rev": "0ad7ab4ca8e83febf147197e65c006dff60623ab",
"type": "github"
},
"original": {
@@ -103,11 +103,11 @@
]
},
"locked": {
- "lastModified": 1749194973,
- "narHash": "sha256-eEy8cuS0mZ2j/r/FE0/LYBSBcIs/MKOIVakwHVuqTfk=",
+ "lastModified": 1753006367,
+ "narHash": "sha256-tzbhc4XttkyEhswByk5R38l+ztN9UDbnj0cTcP6Hp9A=",
"owner": "numtide",
"repo": "treefmt-nix",
- "rev": "a05be418a1af1198ca0f63facb13c985db4cb3c5",
+ "rev": "421b56313c65a0815a52b424777f55acf0b56ddf",
"type": "github"
},
"original": {
--- a/modules/secrets-data.nix
+++ b/modules/secrets-data.nix
@@ -94,12 +94,28 @@
};
config = { };
};
+ managerKey = {
+ options = {
+ name = mkOption {
+ type = str;
+ description = "Who does this manager key belongs to.";
+ };
+ key = mkOption {
+ type = str;
+ description = "Age-compatible key";
+ };
+ };
+ config = {};
+ };
in
{
options.data = mkDataOption (
{ config, ... }:
{
options = {
+ managerKeys = mkOption {
+ type = listOf (submodule managerKey);
+ };
sharedSecrets = mkOption {
type = attrsOf (submodule sharedSecretData);
default = { };
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -1,3 +1,3 @@
[toolchain]
-channel = "1.86.0"
+channel = "nightly-2025-06-10"
components = ["rustfmt", "clippy", "rust-analyzer", "rust-src"]