15 files changed
--- a/cmds/fleet/src/cmds/build_systems.rs
+++ b/cmds/fleet/src/cmds/build_systems.rs
@@ -30,9 +30,9 @@
async fn build_task(config: Config, hostname: String, build_attr: &str) -> Result<PathBuf> {
info!("building");
- let host = config.host(&hostname).await?;
+ let host = config.host(&hostname)?;
// let action = Action::from(self.subcommand.clone());
- let nixos = host.nixos_config().await?;
+ let nixos = host.nixos_config()?;
let drv = nix_go!(nixos.system.build[{ build_attr }]);
let out_output = spawn_blocking(move || drv.build("out"))
.await
@@ -59,7 +59,7 @@
impl BuildSystems {
pub async fn run(self, config: &Config, opts: &FleetOpts) -> Result<()> {
- let hosts = opts.filter_skipped(config.list_hosts().await?).await?;
+ let hosts = opts.filter_skipped(config.list_hosts()?)?;
let set = LocalSet::new();
let build_attr = self.build_attr.clone();
for host in hosts {
@@ -95,20 +95,20 @@
impl Deploy {
pub async fn run(self, config: &Config, opts: &FleetOpts) -> Result<()> {
- let hosts = opts.filter_skipped(config.list_hosts().await?).await?;
+ let hosts = opts.filter_skipped(config.list_hosts()?)?;
let set = LocalSet::new();
for host in hosts.into_iter() {
let config = config.clone();
let span = info_span!("deploy", host = field::display(&host.name));
let hostname = host.name.clone();
let opts = opts.clone();
- if let Some(deploy_kind) = opts.action_attr::<DeployKind>(&host, "deploy_kind").await? {
+ if let Some(deploy_kind) = opts.action_attr::<DeployKind>(&host, "deploy_kind")? {
host.set_deploy_kind(deploy_kind);
};
- if let Some(destination) = opts.action_attr::<String>(&host, "dest").await? {
+ if let Some(destination) = opts.action_attr::<String>(&host, "dest")? {
host.set_session_destination(destination);
};
- if let Some(legacy) = opts.action_attr::<bool>(&host, "legacy_ssh_store").await? {
+ if let Some(legacy) = opts.action_attr::<bool>(&host, "legacy_ssh_store")? {
host.set_legacy_ssh_store(legacy);
};
@@ -153,7 +153,7 @@
self.action,
&host,
remote_path,
- match opts.action_attr(&host, "specialisation").await {
+ match opts.action_attr(&host, "specialisation") {
Ok(v) => v,
_ => {
error!("unreachable? failed to get specialization");
--- a/cmds/fleet/src/cmds/info.rs
+++ b/cmds/fleet/src/cmds/info.rs
@@ -35,7 +35,7 @@
let mut data = Vec::new();
match self.cmd {
InfoCmd::ListHosts { ref tagged } => {
- 'host: for host in config.list_hosts().await? {
+ 'host: for host in config.list_hosts()? {
if !tagged.is_empty() {
let config = &config.config_field;
let host_name = &host.name;
@@ -59,7 +59,7 @@
"at leas one of --external or --internal must be set"
);
let mut out = <BTreeSet<String>>::new();
- let host = config.system_config(&host).await?;
+ let host = config.system_config(&host)?;
if external {
let data: Vec<String> = nix_go_json!(host.network.externalIps);
out.extend(data);
--- a/cmds/fleet/src/cmds/rollback.rs
+++ b/cmds/fleet/src/cmds/rollback.rs
@@ -75,7 +75,7 @@
impl RollbackSingle {
pub(crate) async fn run(&self, config: &Config, _opts: &FleetOpts) -> Result<()> {
- let host = config.host(&self.machine).await?;
+ let host = config.host(&self.machine)?;
match &self.action {
RollbackAction::ListTargets => {
let generations = list_all_generations(&host, config).await;
1use std::{2 collections::{BTreeMap, BTreeSet, HashSet},3 io::{self, Read, Write, stdin, stdout},4 path::PathBuf,5};67use anyhow::{Context, Result, anyhow, bail, ensure};8use chrono::{DateTime, Utc};9use clap::Parser;10use fleet_base::{11 fleetdata::{FleetSecretData, FleetSecretDistribution, FleetSecretPart, encrypt_secret_data},12 host::Config,13 opts::FleetOpts,14 secret::{Expectations, RegenerationReason, secret_needs_regeneration},15};16use fleet_shared::SecretData;17use nix_eval::{NixType, Value, nix_go, nix_go_json};18use serde::Deserialize;19use tabled::{Table, Tabled};20use tokio::{fs::read, task::spawn_blocking};21use tracing::{Instrument, error, info, info_span, warn};2223#[derive(Parser)]24pub enum Secret {25 AddManager,26 27 ForceKeys,28 29 Read {30 31 name: String,3233 34 35 #[clap(short = 'm', long)]36 machine: Option<String>,3738 39 #[clap(short = 'p', long, default_value = "secret")]40 part: String,4142 43 44 #[clap(long)]45 prefer_identities: Vec<String>,46 },47 Regenerate {48 49 50 #[clap(long)]51 prefer_identities: Vec<String>,52 53 #[clap(long)]54 skip_hosts: bool,55 },56 List {},57 Edit {58 name: String,59 #[clap(short = 'm', long)]60 machine: String,6162 #[clap(long)]63 add: bool,6465 66 #[clap(short = 'p', long, default_value = "secret")]67 part: String,68 },69}707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148#[derive(Deserialize)]149#[serde(rename_all = "camelCase")]150enum GeneratorKind {151 Impure,152 Pure,153}154155async fn generate_pure(156 _config: &Config,157 _display_name: &str,158 _secret: Value,159 _default_generator: Value,160 _expectations: &Expectations,161) -> Result<FleetSecretData> {162 bail!("pure generators are broken for now")163}164async fn generate_impure(165 config: &Config,166 _display_name: &str,167 secret: Value,168 default_generator: Value,169 expectations: &Expectations,170) -> Result<FleetSecretData> {171 let generator = nix_go!(secret.generator);172 let on: Option<String> = nix_go_json!(default_generator.impureOn);173174 let nixpkgs = &config.nixpkgs;175176 let host = if let Some(on) = &on {177 config.host(on).await?178 } else {179 config.local_host()180 };181 let on_pkgs = host.pkgs().await?;182 let mk_secret_generators = nix_go!(on_pkgs.mkSecretGenerators);183184 let mut recipients = Vec::new();185 for owner in &expectations.owners {186 let key = config.key(owner).await?;187 recipients.push(key);188 }189 let generators = nix_go!(mk_secret_generators(Obj { recipients }));190 let pkgs_and_generators = on_pkgs.attrs_update(generators)?;191192 let call_package = nix_go!(nixpkgs.lib.callPackageWith(pkgs_and_generators));193194 let generator = nix_go!(call_package(generator)(Obj {}));195196 let generator = spawn_blocking(move || generator.build("out"))197 .await198 .expect("nix build shouldn't fail")?;199 let generator = host.remote_derivation(&generator).await?;200201 let out_parent = host.mktemp_dir().await?;202 let out = format!("{out_parent}/out");203204 let mut r#gen = host.cmd(generator).await?;205 r#gen.env("out", &out);206 if on.is_none() {207 208 let project_path: String = config209 .directory210 .clone()211 .into_os_string()212 .into_string()213 .map_err(|s| anyhow!("fleet project path is not utf-8: {s:?}"))?;214 r#gen.env("FLEET_PROJECT", project_path);215 }216 r#gen.run().await.context("impure generator")?;217218 {219 let marker = host.read_file_text(format!("{out}/marker")).await?;220 ensure!(marker == "SUCCESS", "generation not succeeded");221 }222223 let mut parts = BTreeMap::new();224 for part in host.read_dir(&out).await? {225 if part == "created_at" || part == "expires_at" || part == "marker" {226 continue;227 }228 let contents: SecretData = host229 .read_file_text(format!("{out}/{part}"))230 .await?231 .parse()232 .map_err(|e| anyhow!("failed to decode secret {out:?} part {part:?}: {e}"))?;233 parts.insert(part.to_owned(), FleetSecretPart { raw: contents });234 }235236 let created_at = host.read_file_value(format!("{out}/created_at")).await?;237 let expires_at = host.read_file_value(format!("{out}/expires_at")).await.ok();238239 let new_data = FleetSecretData {240 created_at,241 expires_at,242 parts,243 generation_data: expectations.generation_data.clone(),244 };245246 if let Some(reason) = secret_needs_regeneration(&new_data, &expectations.owners, expectations) {247 bail!("newly generated secret needs to be regenerated: {reason}")248 }249250 Ok(new_data)251}252253async fn generate(254 config: &Config,255 display_name: &str,256 secret: Value,257 expectations: &Expectations,258) -> Result<FleetSecretData> {259 let generator = nix_go!(secret.generator);260 261 {262 let gen_ty = generator.type_of();263 if matches!(gen_ty, NixType::Null) {264 bail!("secret has no generator defined, can't automatically generate it.");265 }266 if matches!(gen_ty, NixType::Attrs) {267 if !generator.has_field("__functor")? {268 bail!("generator should be functor, got {gen_ty:?}");269 }270 } else if matches!(gen_ty, NixType::Function) {271 bail!("generator should be functor, got {gen_ty:?}");272 }273 }274 let nixpkgs = &config.nixpkgs;275 let default_pkgs = &config.default_pkgs;276 let default_mk_secret_generators = nix_go!(default_pkgs.mkSecretGenerators);277 278 279 280 281 282 283 284 285 let generators = nix_go!(default_mk_secret_generators(Obj {286 recipients: <Vec<String>>::new(),287 }));288 let pkgs_and_generators = default_pkgs.clone().attrs_update(generators)?;289290 let call_package = nix_go!(nixpkgs.lib.callPackageWith(pkgs_and_generators));291 let default_generator = nix_go!(call_package(generator)(Obj {}));292293 let kind: GeneratorKind = nix_go_json!(default_generator.generatorKind);294295 match kind {296 GeneratorKind::Impure => {297 generate_impure(298 config,299 display_name,300 secret,301 default_generator,302 expectations,303 )304 .await305 }306 GeneratorKind::Pure => {307 generate_pure(308 config,309 display_name,310 secret,311 default_generator,312 expectations,313 )314 .await315 }316 }317}318319320321322323324325326327328329330331332333334335336337338339async fn parse_public(340 public: Option<String>,341 public_file: Option<PathBuf>,342) -> Result<Option<SecretData>> {343 Ok(match (public, public_file) {344 (Some(v), None) => Some(SecretData {345 data: v.into(),346 encrypted: false,347 }),348 (None, Some(v)) => Some(SecretData {349 data: read(v).await?,350 encrypted: false,351 }),352 (Some(_), Some(_)) => {353 bail!("only public or public_file should be set")354 }355 (None, None) => None,356 })357}358359async fn parse_secret() -> Result<Option<Vec<u8>>> {360 let mut input = vec![];361 stdin().read_to_end(&mut input)?;362 if input.is_empty() {363 Ok(None)364 } else {365 Ok(Some(input))366 }367}368369fn parse_machines(370 initial: BTreeSet<String>,371 machines: Option<Vec<String>>,372 mut add_machines: Vec<String>,373 mut remove_machines: Vec<String>,374) -> Result<BTreeSet<String>> {375 if machines.is_none() && add_machines.is_empty() && remove_machines.is_empty() {376 bail!("no operation");377 }378379 let initial_machines = initial.clone();380 let mut target_machines = initial;381 info!("Currently encrypted for {initial_machines:?}");382383 if let Some(machines) = machines {384 ensure!(385 add_machines.is_empty() && remove_machines.is_empty(),386 "can't combine --machines and --add-machines/--remove-machines"387 );388 let target = initial_machines.iter().collect::<HashSet<_>>();389 let source = machines.iter().collect::<HashSet<_>>();390 for removed in target.difference(&source) {391 remove_machines.push((*removed).clone());392 }393 for added in source.difference(&target) {394 add_machines.push((*added).clone());395 }396 }397398 for machine in &remove_machines {399 if !target_machines.remove(machine) {400 warn!("secret is not enabled for {machine}");401 }402 }403 for machine in &add_machines {404 if !target_machines.insert(machine.to_owned()) {405 warn!("secret is already added to {machine}");406 }407 }408 if !remove_machines.is_empty() {409 410 411 warn!(412 "secret will not be regenerated for removed machines, and until host rebuild, they will still possess the ability to decode secret"413 );414 }415 Ok(target_machines)416}417impl Secret {418 pub async fn run(self, config: &Config, opts: &FleetOpts) -> Result<()> {419 match self {420 Secret::AddManager => {421 todo!("part of fleet-pusher")422 }423 Secret::ForceKeys => {424 for host in config.list_hosts().await? {425 if opts.should_skip(&host).await? {426 continue;427 }428 config.key(&host.name).await?;429 }430 }431 Secret::Read {432 name,433 machine,434 part: part_name,435 mut prefer_identities,436 } => {437 let Some(secret) = config.shared_secret(&name) else {438 bail!("secret doesn't exists");439 };440441 let dist = if secret.len() == 1 {442 &secret[0]443 } else if let Some(machine) = machine {444 let dist = secret.get(&machine);445 let Some(dist) = dist else {446 bail!("machine {machine} has no distribution of secret {name}");447 };448 prefer_identities.push(machine);449 dist450 } else {451 bail!(452 "secret {name} has shares, but no --machine specified for specifing which do you need"453 )454 };455456 let Some(part) = dist.secret.parts.get(&part_name) else {457 bail!("no part {part_name} in secret {name}");458 };459 let data = if part.raw.encrypted {460 let identity_holder = if !prefer_identities.is_empty() {461 prefer_identities462 .iter()463 .find(|i| dist.owners.iter().any(|s| s == *i))464 } else {465 dist.owners.first()466 };467 let Some(identity_holder) = identity_holder else {468 bail!("no available holder found");469 };470 let host = config.host(identity_holder).await?;471 host.decrypt(part.raw.clone()).await?472 } else {473 part.raw.data.clone()474 };475 stdout().write_all(&data)?;476 }477 Secret::Regenerate {478 prefer_identities,479 skip_hosts,480 } => {481 482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618 todo!()619 }620 Secret::List {} => {621 let _span = info_span!("loading secrets").entered();622 let configured = config.list_configured_shared().await?;623 #[derive(Tabled)]624 struct SecretDisplay {625 #[tabled(rename = "Name")]626 name: String,627 #[tabled(rename = "Owners")]628 owners: String,629 }630 631 for name in configured.iter().cloned() {632 let config = config.clone();633 let data = config.shared_secret(&name).expect("exists");634 635636637638639640641642643644645646647648649650651652 }653 654 }655 Secret::Edit {656 name,657 machine,658 part,659 add,660 } => {661 let secret = config662 .host_secret(&machine, &name)663 .context("secret not found")?;664 if let Some(data) = secret.secret.parts.get(&part) {665 let host = config.host(&machine).await?;666 let secret = host.decrypt(data.raw.clone()).await?;667 String::from_utf8(secret).context("secret is not utf8")?668 } else if add {669 String::new()670 } else {671 bail!("part {part} not found in secret {name}. Did you mean to `--add` it?");672 };673 }674 }675 Ok(())676 }677}678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758
1use std::{2 collections::{BTreeSet, HashSet},3 io::{Read, Write, stdin, stdout},4 path::PathBuf,5};67use anyhow::{Context, Result, bail, ensure};8use clap::Parser;9use fleet_base::{host::Config, opts::FleetOpts};10use fleet_shared::SecretData;11use tabled::Tabled;12use tokio::fs::read;13use tracing::{info, info_span, warn};1415#[derive(Parser)]16pub enum Secret {17 AddManager,18 19 ForceKeys,20 21 Read {22 23 name: String,2425 26 27 #[clap(short = 'm', long)]28 machine: Option<String>,2930 31 #[clap(short = 'p', long, default_value = "secret")]32 part: String,3334 35 36 #[clap(long)]37 prefer_identities: Vec<String>,38 },39 Regenerate {40 41 42 #[clap(long)]43 prefer_identities: Vec<String>,44 45 #[clap(long)]46 skip_hosts: bool,47 },48 List {},49 Edit {50 name: String,51 #[clap(short = 'm', long)]52 machine: String,5354 #[clap(long)]55 add: bool,5657 58 #[clap(short = 'p', long, default_value = "secret")]59 part: String,60 },61}6263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326async fn parse_public(327 public: Option<String>,328 public_file: Option<PathBuf>,329) -> Result<Option<SecretData>> {330 Ok(match (public, public_file) {331 (Some(v), None) => Some(SecretData {332 data: v.into(),333 encrypted: false,334 }),335 (None, Some(v)) => Some(SecretData {336 data: read(v).await?,337 encrypted: false,338 }),339 (Some(_), Some(_)) => {340 bail!("only public or public_file should be set")341 }342 (None, None) => None,343 })344}345346async fn parse_secret() -> Result<Option<Vec<u8>>> {347 let mut input = vec![];348 stdin().read_to_end(&mut input)?;349 if input.is_empty() {350 Ok(None)351 } else {352 Ok(Some(input))353 }354}355356fn parse_machines(357 initial: BTreeSet<String>,358 machines: Option<Vec<String>>,359 mut add_machines: Vec<String>,360 mut remove_machines: Vec<String>,361) -> Result<BTreeSet<String>> {362 if machines.is_none() && add_machines.is_empty() && remove_machines.is_empty() {363 bail!("no operation");364 }365366 let initial_machines = initial.clone();367 let mut target_machines = initial;368 info!("Currently encrypted for {initial_machines:?}");369370 if let Some(machines) = machines {371 ensure!(372 add_machines.is_empty() && remove_machines.is_empty(),373 "can't combine --machines and --add-machines/--remove-machines"374 );375 let target = initial_machines.iter().collect::<HashSet<_>>();376 let source = machines.iter().collect::<HashSet<_>>();377 for removed in target.difference(&source) {378 remove_machines.push((*removed).clone());379 }380 for added in source.difference(&target) {381 add_machines.push((*added).clone());382 }383 }384385 for machine in &remove_machines {386 if !target_machines.remove(machine) {387 warn!("secret is not enabled for {machine}");388 }389 }390 for machine in &add_machines {391 if !target_machines.insert(machine.to_owned()) {392 warn!("secret is already added to {machine}");393 }394 }395 if !remove_machines.is_empty() {396 397 398 warn!(399 "secret will not be regenerated for removed machines, and until host rebuild, they will still possess the ability to decode secret"400 );401 }402 Ok(target_machines)403}404impl Secret {405 pub async fn run(self, config: &Config, opts: &FleetOpts) -> Result<()> {406 match self {407 Secret::AddManager => {408 todo!("part of fleet-pusher")409 }410 Secret::ForceKeys => {411 for host in config.list_hosts()? {412 if opts.should_skip(&host)? {413 continue;414 }415 config.key(&host.name).await?;416 }417 }418 Secret::Read {419 name,420 machine,421 part: part_name,422 mut prefer_identities,423 } => {424 let Some(secret) = config.shared_secret(&name) else {425 bail!("secret doesn't exists");426 };427428 let dist = if secret.len() == 1 {429 &secret[0]430 } else if let Some(machine) = machine {431 let dist = secret.get(&machine);432 let Some(dist) = dist else {433 bail!("machine {machine} has no distribution of secret {name}");434 };435 prefer_identities.push(machine);436 dist437 } else {438 bail!(439 "secret {name} has shares, but no --machine specified for specifing which do you need"440 )441 };442443 let Some(part) = dist.secret.parts.get(&part_name) else {444 bail!("no part {part_name} in secret {name}");445 };446 let data = if part.raw.encrypted {447 let identity_holder = if !prefer_identities.is_empty() {448 prefer_identities449 .iter()450 .find(|i| dist.owners.iter().any(|s| s == *i))451 } else {452 dist.owners.first()453 };454 let Some(identity_holder) = identity_holder else {455 bail!("no available holder found");456 };457 let host = config.host(identity_holder)?;458 host.decrypt(part.raw.clone()).await?459 } else {460 part.raw.data.clone()461 };462 stdout().write_all(&data)?;463 }464 Secret::Regenerate {465 prefer_identities,466 skip_hosts,467 } => {468 469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605 todo!()606 }607 Secret::List {} => {608 let _span = info_span!("loading secrets").entered();609 let configured = config.list_configured_shared()?;610 #[derive(Tabled)]611 struct SecretDisplay {612 #[tabled(rename = "Name")]613 name: String,614 #[tabled(rename = "Owners")]615 owners: String,616 }617 618 for name in configured.iter().cloned() {619 let config = config.clone();620 let data = config.shared_secret(&name).expect("exists");621 622623624625626627628629630631632633634635636637638639 }640 641 }642 Secret::Edit {643 name,644 machine,645 part,646 add,647 } => {648 let secret = config649 .host_secret(&machine, &name)650 .context("secret not found")?;651 if let Some(data) = secret.secret.parts.get(&part) {652 let host = config.host(&machine)?;653 let secret = host.decrypt(data.raw.clone()).await?;654 String::from_utf8(secret).context("secret is not utf8")?655 } else if add {656 String::new()657 } else {658 bail!("part {part} not found in secret {name}. Did you mean to `--add` it?");659 };660 }661 }662 Ok(())663 }664}665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745
--- a/cmds/fleet/src/main.rs
+++ b/cmds/fleet/src/main.rs
@@ -216,13 +216,10 @@
.map(|a| extra_args::parse_os(&a))
.transpose()?
.unwrap_or_default();
- let config = opts
- .fleet_opts
- .build(
- nix_args,
- matches!(opts.command, Opts::Deploy(_) | Opts::BuildSystems(_)),
- )
- .await?;
+ let config = opts.fleet_opts.build(
+ nix_args,
+ matches!(opts.command, Opts::Deploy(_) | Opts::BuildSystems(_)),
+ )?;
match run_command(&config, opts.fleet_opts, opts.command).await {
Ok(()) => {
--- a/crates/fleet-base/src/fleetdata.rs
+++ b/crates/fleet-base/src/fleetdata.rs
@@ -421,3 +421,14 @@
}
}
}
+
+#[derive(Debug)]
+pub struct Expectations {
+ pub owners: BTreeSet<String>,
+ pub generation_data: serde_json::Value,
+ pub parts: BTreeMap<String, GeneratorPart>,
+}
+#[derive(Deserialize, Debug, Clone)]
+pub struct GeneratorPart {
+ pub encrypted: bool,
+}
--- a/crates/fleet-base/src/host.rs
+++ b/crates/fleet-base/src/host.rs
@@ -471,10 +471,13 @@
cmd.run().await
}
}
+
+struct HostSecretDefinition(Value);
+
impl ConfigHost {
// TOCTOU is possible here in case if config is changed, but this case is not handled anywhere anyway,
// assuming getting tags always returns the same value.
- pub async fn tags(&self) -> Result<Vec<String>> {
+ pub fn tags(&self) -> Result<Vec<String>> {
if let Some(v) = self.groups.get() {
return Ok(v.clone());
}
@@ -487,7 +490,7 @@
Ok(tags)
}
- pub async fn nixos_config(&self) -> Result<Value> {
+ pub fn nixos_config(&self) -> Result<Value> {
if let Some(v) = self.nixos_config.get() {
return Ok(v.clone());
}
@@ -495,7 +498,7 @@
bail!("local host has no nixos_config");
};
let nixos_config = nix_go!(host_config.nixos.config);
- assert_warn("nixos config evaluation", &nixos_config).await?;
+ assert_warn("nixos config evaluation", &nixos_config)?;
let _ = self.nixos_config.set(nixos_config.clone());
@@ -522,7 +525,7 @@
}
/// Packages for this host, resolved with nixpkgs overlays
- pub async fn pkgs(&self) -> Result<Value> {
+ pub fn pkgs(&self) -> Result<Value> {
if let Some(value) = &self.pkgs_override {
return Ok(value.clone());
}
@@ -534,17 +537,29 @@
}
}
+pub struct SharedSecretDefinition(Value);
+impl SharedSecretDefinition {
+ pub fn expected_owners(&self) -> Result<BTreeSet<String>> {
+ let secret = &self.0;
+ Ok(nix_go_json!(secret.expectedOwners))
+ }
+ pub fn generator(&self) -> Result<Value> {
+ let secret = &self.0;
+ Ok(nix_go!(secret.generator))
+ }
+}
+
impl Config {
- pub async fn tagged_hostnames(&self, tag: &str) -> Result<Vec<String>> {
+ pub fn tagged_hostnames(&self, tag: &str) -> Result<Vec<String>> {
let config = &self.config_field;
let tagged: Vec<String> = nix_go_json!(config.taggedWith[{ tag }]);
Ok(tagged)
}
- pub async fn expand_owner_set(&self, owners: Vec<String>) -> Result<BTreeSet<String>> {
+ pub fn expand_owner_set(&self, owners: Vec<String>) -> Result<BTreeSet<String>> {
let mut out = BTreeSet::new();
for owner in owners {
if let Some(tag) = owner.strip_prefix('@') {
- let hosts = self.tagged_hostnames(tag).await?;
+ let hosts = self.tagged_hostnames(tag)?;
out.extend(hosts);
} else {
out.insert(owner);
@@ -574,7 +589,7 @@
}
}
- pub async fn host(&self, name: &str) -> Result<ConfigHost> {
+ pub fn host(&self, name: &str) -> Result<ConfigHost> {
let config = &self.config_field;
let host_config = nix_go!(config.hosts[{ name }]);
@@ -595,23 +610,23 @@
legacy_ssh_store: OnceCell::new(),
})
}
- pub async fn list_hosts(&self) -> Result<Vec<ConfigHost>> {
+ pub fn list_hosts(&self) -> Result<Vec<ConfigHost>> {
let config = &self.config_field;
let names = nix_go!(config.hosts).list_fields()?;
let mut out = vec![];
for name in names {
- out.push(self.host(&name).await?);
+ out.push(self.host(&name)?);
}
Ok(out)
}
// TODO: Replace usages with .host().nixos_config
- pub async fn system_config(&self, host: &str) -> Result<Value> {
+ pub fn system_config(&self, host: &str) -> Result<Value> {
let fleet_field = &self.config_field;
Ok(nix_go!(fleet_field.hosts[{ host }].nixos.config))
}
/// Shared secrets configured in fleet.nix or in flake
- pub async fn list_configured_shared(&self) -> Result<Vec<String>> {
+ pub fn list_configured_shared(&self) -> Result<Vec<String>> {
let config_field = &self.config_field;
nix_go!(config_field.sharedSecrets).list_fields()
}
@@ -659,6 +674,17 @@
data.secrets.get(secret).cloned()
}
+ pub fn secret_definition(&self, secret: &str) -> Result<Option<SharedSecretDefinition>> {
+ let config = &self.config_field;
+ let shared_secrets = nix_go!(config.secrets);
+ if !shared_secrets.has_field(secret)? {
+ return Ok(None);
+ }
+ Ok(Some(SharedSecretDefinition(nix_go!(
+ shared_secrets[secret]
+ ))))
+ }
+
// TODO: Should this be something modifiable from other processes?
// E.g terraform provider might want to update FleetData (e.g secrets),
// and current implementation assumes only one process holds current fleet.nix
--- a/crates/fleet-base/src/keys.rs
+++ b/crates/fleet-base/src/keys.rs
@@ -12,10 +12,10 @@
pub fn cached_key(&self, host: &str) -> Option<String> {
let data = self.data();
let key = data.hosts.get(host).map(|h| &h.encryption_key);
- if let Some(key) = key {
- if key.is_empty() {
- return None;
- }
+ if let Some(key) = key
+ && key.is_empty()
+ {
+ return None;
}
key.cloned()
}
@@ -30,7 +30,7 @@
Ok(key)
} else {
warn!("Loading key for {}", host);
- let host = self.host(host).await?;
+ let host = self.host(host)?;
let mut cmd = host.cmd("cat").await?;
cmd.arg("/etc/ssh/ssh_host_ed25519_key.pub");
let key = cmd.run_string().await?;
@@ -47,7 +47,7 @@
}
pub async fn recipients(&self, hosts: Vec<String>) -> Result<Vec<Box<dyn Recipient>>> {
- let hosts = self.expand_owner_set(hosts).await?;
+ let hosts = self.expand_owner_set(hosts)?;
futures::stream::iter(hosts.iter())
.then(|m| self.recipient(m.as_ref()))
.try_collect::<Vec<_>>()
@@ -57,12 +57,7 @@
#[allow(dead_code)]
pub async fn orphaned_data(&self) -> Result<Vec<String>> {
let mut out = Vec::new();
- let host_names = self
- .list_hosts()
- .await?
- .into_iter()
- .map(|h| h.name)
- .collect_vec();
+ let host_names = self.list_hosts()?.into_iter().map(|h| h.name).collect_vec();
for hostname in self
.data()
.hosts
--- a/crates/fleet-base/src/opts.rs
+++ b/crates/fleet-base/src/opts.rs
@@ -104,20 +104,20 @@
}
impl FleetOpts {
- pub async fn filter_skipped(
+ pub fn filter_skipped(
&self,
hosts: impl IntoIterator<Item = ConfigHost>,
) -> Result<Vec<ConfigHost>> {
let mut out = Vec::new();
for host in hosts {
- if self.should_skip(&host).await? {
+ if self.should_skip(&host)? {
continue;
}
out.push(host);
}
Ok(out)
}
- pub async fn should_skip(&self, host: &ConfigHost) -> Result<bool> {
+ pub fn should_skip(&self, host: &ConfigHost) -> Result<bool> {
if self.skip.iter().any(|h| h as &str == host.name) {
return Ok(true);
}
@@ -137,7 +137,7 @@
}
}
if have_group_matches {
- let host_tags = host.tags().await?;
+ let host_tags = host.tags()?;
for item in self.only.iter() {
match item {
HostItem::Tag { name, .. } if host_tags.contains(name) => {
@@ -149,15 +149,15 @@
}
Ok(true)
}
- pub async fn action_attr<T: FromStr>(&self, host: &ConfigHost, attr: &str) -> Result<Option<T>>
+ pub fn action_attr<T: FromStr>(&self, host: &ConfigHost, attr: &str) -> Result<Option<T>>
where
T::Err: Sync,
anyhow::Error: From<T::Err>,
{
- let str = self.action_attr_str(host, attr).await?;
+ let str = self.action_attr_str(host, attr)?;
Ok(str.map(|v| T::from_str(&v)).transpose()?)
}
- pub async fn action_attr_str(&self, host: &ConfigHost, attr: &str) -> Result<Option<String>> {
+ pub fn action_attr_str(&self, host: &ConfigHost, attr: &str) -> Result<Option<String>> {
if self.only.is_empty() {
return Ok(None);
}
@@ -176,7 +176,7 @@
}
}
if have_group_matches {
- let host_tags = host.tags().await?;
+ let host_tags = host.tags()?;
for item in self.only.iter() {
match item {
HostItem::Tag { name, attrs }
@@ -195,7 +195,7 @@
}
// TODO: Config should be detached from opts.
- pub async fn build(&self, nix_args: Vec<OsString>, assert: bool) -> Result<Config> {
+ pub fn build(&self, nix_args: Vec<OsString>, assert: bool) -> Result<Config> {
let cwd = current_dir()?;
let mut directory = cwd.clone();
let mut fleet_data_path = directory.join("fleet.nix");
@@ -248,7 +248,6 @@
if assert {
assert_warn("fleet config evaluation", &config_field)
- .await
.context("failed to verify assertions")?;
}
--- a/crates/fleet-base/src/primops.rs
+++ b/crates/fleet-base/src/primops.rs
@@ -1,38 +1,168 @@
-use std::cell::OnceCell;
-use std::collections::{BTreeMap, HashMap};
-use std::sync::{Arc, Mutex, OnceLock};
+use std::collections::{BTreeMap, BTreeSet, HashMap};
+use std::sync::OnceLock;
-use anyhow::{Context, bail};
+use anyhow::{Context, bail, ensure};
+use fleet_shared::SecretData;
use itertools::Itertools;
use nix_eval::{NativeFn, Value, nix_go, nix_go_json};
use serde::Deserialize;
use tracing::{info, warn};
-use crate::fleetdata::{FleetData, FleetSecrets};
-use crate::host::Config;
+use crate::fleetdata::{
+ Expectations, FleetSecretData, FleetSecretDistribution, FleetSecretPart, GeneratorPart,
+};
+use crate::host::{Config, ConfigHost};
+use crate::secret::{RegenerationReason, secret_needs_regeneration};
+use anyhow::{Result, anyhow};
#[derive(thiserror::Error, Debug)]
enum Error {}
-struct Parts {
- encrypted: Vec<String>,
- public: Vec<String>,
+pub static PRIMOPS_DATA: OnceLock<Config> = OnceLock::new();
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+enum GeneratorKind {
+ Impure,
+ Pure,
}
-trait SecretsBackend {
- fn has_shared(&self, name: &str);
- fn has_host(&self, host: &str, name: &str);
- fn shared_parts(&self, name: &str) -> Parts;
- fn host_parts(&self, host: &str, name: &str) -> Parts;
+pub fn get_pkgs_and_generators(host_on: &ConfigHost, recipients: Vec<String>) -> Result<Value> {
+ info!("get pkgs");
+ let pkgs = host_on.pkgs()?;
+ let default_mk_secret_generators = nix_go!(pkgs.mkSecretGenerators);
+ let generators = nix_go!(default_mk_secret_generators(Obj { recipients }));
+ Ok(pkgs.clone().attrs_update(generators)?)
+}
+pub fn get_default_pkgs_and_generators(config: &Config) -> Result<Value> {
+ let host_on = config.local_host();
+ get_pkgs_and_generators(&host_on, vec![])
}
+pub fn call_package(config: &Config, pkgs: &Value, package: &Value) -> Result<Value> {
+ ensure!(
+ package.is_function(),
+ "package should be a function to be called with callPackage"
+ );
+ // No need to use nixpkgs.buildUsing, as only nixpkgs-lib is used.
+ let nixpkgs = &config.nixpkgs;
+ let call_package = nix_go!(nixpkgs.lib.callPackageWith(pkgs));
+ Ok(nix_go!(call_package(package)(Obj {})))
+}
+
+pub fn get_default_generator_drv(config: &Config, generator: &Value) -> Result<Value> {
+ let default_pkgs_and_generators = get_default_pkgs_and_generators(config)?;
+ let default_generator_drv = call_package(config, &default_pkgs_and_generators, generator)
+ .context("failed to initialize generator to get metadata")?;
+
+ Ok(default_generator_drv)
+}
+
+pub async fn generate(
+ config: &Config,
+ expectations: Expectations,
+ generator: &Value,
+ default_generator_drv: &Value,
+) -> Result<FleetSecretDistribution> {
+ let kind: GeneratorKind = nix_go_json!(default_generator_drv.generatorKind);
+
+ match kind {
+ GeneratorKind::Impure => {
+ let impure_on: Option<String> = nix_go_json!(default_generator_drv.impureOn);
-struct FsSecretsBackend {}
+ let host_on = if let Some(on) = &impure_on {
+ config
+ .host(on)
+ .context("failed to get secret generation target host")?
+ } else {
+ config.local_host()
+ };
+ let pkgs_and_generators =
+ get_pkgs_and_generators(&host_on, expectations.owners.iter().cloned().collect())
+ .context("failed to get pkgs for target host")?;
+ let generator = call_package(config, &pkgs_and_generators, generator)
+ .context("failed to evaluate generator for target host")?;
-pub static PRIMOPS_DATA: OnceLock<Config> = OnceLock::new();
+ let generator = generator
+ .build("out")
+ .context("failed to build generator for target host")?;
-#[derive(Deserialize, Debug)]
-struct GeneratorPart {
- encrypted: bool,
+ let generator = host_on
+ .remote_derivation(&generator)
+ .await
+ .context("failed to copy generator to target host")?;
+
+ // TODO: Remove destdir after everything is done
+ let out_parent = host_on
+ .mktemp_dir()
+ .await
+ .context("failed to prepare generator output dir on target host")?;
+ let out = format!("{out_parent}/out");
+ let mut generator_cmd = host_on.cmd(generator).await?;
+ generator_cmd.env("out", &out);
+ if impure_on.is_none() {
+ let project_path: String = config
+ .directory
+ .clone()
+ .into_os_string()
+ .into_string()
+ .map_err(|e| anyhow!("fleet project path is not utf-8: {e:?}"))?;
+ generator_cmd.env("FLEET_PROJECT", project_path);
+ };
+ generator_cmd
+ .run()
+ .await
+ .context("failed to run impure generator")?;
+
+ {
+ let marker = host_on.read_file_text(format!("{out}/marker")).await?;
+ ensure!(
+ marker == "SUCCESS",
+ "impure generator ended prematurely, secret generation failed"
+ );
+ }
+
+ let mut parts = BTreeMap::new();
+ for part in host_on.read_dir(&out).await? {
+ if part == "created_at" || part == "expires_at" || part == "marker" {
+ continue;
+ }
+ let contents: SecretData = host_on
+ .read_file_text(format!("{out}/{part}"))
+ .await?
+ .parse()
+ .map_err(|e| anyhow!("failed to decode secret {out:?} part {part:?}: {e}"))?;
+ parts.insert(part.to_owned(), FleetSecretPart { raw: contents });
+ }
+
+ let created_at = host_on.read_file_value(format!("{out}/created_at")).await?;
+ let expires_at = host_on
+ .read_file_value(format!("{out}/expires_at"))
+ .await
+ .ok();
+
+ let new_data = FleetSecretData {
+ created_at,
+ expires_at,
+ parts,
+ generation_data: expectations.generation_data.clone(),
+ };
+
+ let new_data = FleetSecretDistribution {
+ secret: new_data,
+ owners: expectations.owners.clone(),
+ _deprecated_managed: true,
+ };
+
+ if let Some(reason) = secret_needs_regeneration(&new_data, &expectations) {
+ bail!("newly generated secret needs to be regenerated: {reason}")
+ }
+
+ Ok(new_data)
+ }
+ GeneratorKind::Pure => {
+ bail!("pure generators are disabled for now")
+ }
+ }
}
pub fn init_primops() {
@@ -52,52 +182,61 @@
.get()
.expect("primops data should be set on init");
- info!("get pkgs");
- let nixpkgs = &config.nixpkgs;
- let default_pkgs = &config.default_pkgs;
- let default_mk_secret_generators = nix_go!(default_pkgs.mkSecretGenerators);
- let generators = nix_go!(default_mk_secret_generators(Obj {
- recipients: <Vec<String>>::new(),
- }));
- let pkgs_and_generators = default_pkgs.clone().attrs_update(generators)?;
+ let shared_def = config.secret_definition(&secret).context("failed to get shared secret definition")?;
- info!("call package");
- let call_package = nix_go!(nixpkgs.lib.callPackageWith(pkgs_and_generators));
- let default_generator = call_package
- .call(generator.clone())
- .context("calling callPackage with generator")?
- .call(Value::new_attrs(HashMap::new()))
- .context("providing extra callPackage args")?;
+ let (shared, generator, expected_owners) = if generator.is_string() {
+ assert_eq!(generator.to_string()?, "shared", "asserted by nixos type system");
+ let Some(shared_def) = shared_def else {
+ bail!("secret {secret} is defined on host {host} as shared, but there is no shared secret with same name defined at fleetConfiguration.secrets.{secret}.generator")
+ };
+ let expected_owners = shared_def.expected_owners()?;
+
+ ensure!(expected_owners.contains(&host), "secret {secret} does not define {host} as expected owner");
- info!("get parts");
- let mut parts: BTreeMap<String, GeneratorPart> = nix_go_json!(default_generator.parts);
- info!("got parts: {parts:?}");
+ (true, shared_def.generator()?, expected_owners)
+ } else {
+ if shared_def.is_some() {
+ bail!("hosts can only have their own generators for non-shared secrets, either set host secret generator to \"shared\", or remove shared secret generator at fleetConfiguration.secrets.{secret}.generator")
+ }
- let Some(existing) = config
- .host_secret(&host, &secret) else {
- bail!("missing secret {secret} for host {host}; secret needs regeneration")
+ (false, generator.clone(), BTreeSet::from_iter([host.clone()]))
};
- info!("got existing: {existing:?}");
+ let default_generator_drv = get_default_generator_drv(config, &generator).context("failed to evaluate default generator")?;
+ let expectations = Expectations {
+ parts: nix_go_json!(default_generator_drv.parts),
+ generation_data: nix_go_json!(default_generator_drv.generationData),
+ owners: expected_owners,
+ };
+
+ let reason: RegenerationReason = 'regenerate: {
+ let Some(existing) = config
+ .host_secret(&host, &secret) else {
+ break 'regenerate RegenerationReason::Missing;
+ };
+ if let Some(reason) = secret_needs_regeneration(&existing, &expectations) {
+ break 'regenerate reason;
+ }
- let mut out = HashMap::new();
+ let mut parts = expectations.parts.clone();
- for (part_name, part) in &existing.secret.parts {
- let Some(definition) = parts.remove(part_name) else {
- warn!("secret {secret} part {part_name} is stored, but not defined in nixos config, it will not be passed to nix");
- continue;
- };
- if definition.encrypted != part.raw.encrypted {
- bail!("secret {secret} part {part_name} is supposed to be {}, but it is {}; secret needs regeneration", if definition.encrypted {"encrypted"} else {"unencrypted"}, if part.raw.encrypted {"encrypted"} else {"unencrypted"});
+ let mut out = HashMap::new();
+ for (part_name, part) in &existing.secret.parts {
+ let Some(definition) = parts.remove(part_name) else {
+ warn!("secret {secret} part {part_name} is stored, but not defined in nixos config, it will not be passed to nix");
+ continue;
+ };
+ assert!(definition.encrypted != part.raw.encrypted, "encryption status is checked by secret_needs_regeneration");
+ out.insert(part_name.as_str(), Value::new_attrs(HashMap::from_iter([("raw", Value::new_str(&part.raw.to_string()))])));
}
- out.insert(part_name.as_str(), Value::new_attrs(HashMap::from_iter([("raw", Value::new_str(&part.raw.to_string()))])));
- }
- if !parts.is_empty(){
- let defs = parts.keys().collect_vec();
- bail!("secret parts are defined, but not stored: {defs:?}, secret needs regeneration")
- }
+ assert!(parts.is_empty(), "secret part is missing, secret_needs_regeneration should check that");
- Ok(Value::new_attrs(out))
+ return Ok(Value::new_attrs(out))
+ };
+
+ todo!()
+
+
},
)
.register();
--- a/crates/fleet-base/src/secret.rs
+++ b/crates/fleet-base/src/secret.rs
@@ -1,16 +1,8 @@
-use std::collections::BTreeSet;
+use std::collections::{BTreeMap, BTreeSet};
use chrono::{DateTime, Utc};
-use crate::fleetdata::FleetSecretData;
-
-#[derive(Debug)]
-pub struct Expectations {
- pub owners: BTreeSet<String>,
- pub generation_data: serde_json::Value,
- pub public_parts: BTreeSet<String>,
- pub private_parts: BTreeSet<String>,
-}
+use crate::fleetdata::{Expectations, FleetSecretData, FleetSecretDistribution, GeneratorPart};
#[derive(thiserror::Error, Debug)]
pub enum RegenerationReason {
@@ -34,56 +26,62 @@
ExpectedPublic(String),
#[error("secret is expired at {0}")]
Expired(DateTime<Utc>),
+
+ #[error("secret is not generated for this host")]
+ Missing,
}
pub fn secret_needs_regeneration(
- secret: &FleetSecretData,
- owners: &BTreeSet<String>,
+ secret: &FleetSecretDistribution,
expectations: &Expectations,
) -> Option<RegenerationReason> {
- if !owners.is_empty() {
- let added: BTreeSet<String> = expectations.owners.difference(owners).cloned().collect();
- if !added.is_empty() {
- return Some(RegenerationReason::OwnersAdded(added));
- }
+ let added: BTreeSet<String> = expectations
+ .owners
+ .difference(&secret.owners)
+ .cloned()
+ .collect();
+ if !added.is_empty() {
+ return Some(RegenerationReason::OwnersAdded(added));
+ }
- let removed: BTreeSet<String> = owners.difference(&expectations.owners).cloned().collect();
- if !removed.is_empty() {
- return Some(RegenerationReason::OwnersRemoved(removed));
- }
+ let removed: BTreeSet<String> = secret
+ .owners
+ .difference(&expectations.owners)
+ .cloned()
+ .collect();
+ if !removed.is_empty() {
+ return Some(RegenerationReason::OwnersRemoved(removed));
}
- if secret.generation_data != expectations.generation_data {
+ if secret.secret.generation_data != expectations.generation_data {
return Some(RegenerationReason::GenerationData {
expected: expectations.generation_data.clone(),
- found: secret.generation_data.clone(),
+ found: secret.secret.generation_data.clone(),
});
}
- if !expectations.public_parts.is_empty() || !expectations.private_parts.is_empty() {
- let expected: BTreeSet<String> = expectations
- .public_parts
- .union(&expectations.private_parts)
- .cloned()
- .collect();
- let found: BTreeSet<String> = secret.parts.keys().cloned().collect();
+ let expected: BTreeSet<String> = expectations.parts.keys().cloned().collect();
+ let found: BTreeSet<String> = secret.secret.parts.keys().cloned().collect();
- if found != expected {
- return Some(RegenerationReason::PartList { expected, found });
- }
+ if found != expected {
+ return Some(RegenerationReason::PartList { expected, found });
+ }
- for (name, value) in secret.parts.iter() {
- if value.raw.encrypted {
- if !expectations.private_parts.contains(name) {
- return Some(RegenerationReason::ExpectedPrivate(name.clone()));
- }
- } else if !expectations.public_parts.contains(name) {
- return Some(RegenerationReason::ExpectedPublic(name.clone()));
+ for (name, value) in secret.secret.parts.iter() {
+ let expectation = expectations
+ .parts
+ .get(name)
+ .expect("found == expected checked");
+ if value.raw.encrypted {
+ if !expectation.encrypted {
+ return Some(RegenerationReason::ExpectedPrivate(name.clone()));
}
+ } else if expectation.encrypted {
+ return Some(RegenerationReason::ExpectedPublic(name.clone()));
}
}
- if let Some(expiration) = secret.expires_at {
+ if let Some(expiration) = secret.secret.expires_at {
// TODO: Leeway?
if expiration < Utc::now() {
return Some(RegenerationReason::Expired(expiration));
--- a/crates/nix-eval/src/lib.rs
+++ b/crates/nix-eval/src/lib.rs
@@ -731,6 +731,10 @@
}
pub fn has_field(&self, field: &str) -> Result<bool> {
+ if !matches!(self.type_of(), NixType::Attrs) {
+ bail!("invalid type: expected attrs");
+ }
+
let f = init_field_name(field);
with_default_context(|c, es| unsafe { has_attr_byname(c, self.0, es, f.as_ptr().cast()) })
}
@@ -881,6 +885,12 @@
pub fn is_null(&self) -> bool {
matches!(self.type_of(), NixType::Null)
}
+ pub fn is_string(&self) -> bool {
+ matches!(self.type_of(), NixType::String)
+ }
+ pub fn is_attrs(&self) -> bool {
+ matches!(self.type_of(), NixType::Attrs)
+ }
}
impl From<String> for Value {
--- a/crates/nix-eval/src/util.rs
+++ b/crates/nix-eval/src/util.rs
@@ -1,23 +1,15 @@
use std::time::Instant;
use anyhow::bail;
-use serde::Deserialize;
use tracing::{debug, warn};
use crate::{Value, nix_go_json};
-
-#[derive(Deserialize, Debug)]
-struct Assertion {
- assertion: bool,
- message: String,
-}
#[tracing::instrument(level = "info", skip(val))]
-pub async fn assert_warn(action: &str, val: &Value) -> anyhow::Result<()> {
+pub fn assert_warn(action: &str, val: &Value) -> anyhow::Result<()> {
let before_errors = Instant::now();
let errors: Vec<String> = nix_go_json!(val.errors);
- // let assertions: Vec<Assertion> = nix_go_json!(val.assertions);
- debug!("errors evaluation took {:?} {errors:?} ", before_errors.elapsed());
+ debug!("errors evaluation took {:?}", before_errors.elapsed());
if !errors.is_empty() {
bail!(
"failed with error{}{}",
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -160,7 +160,7 @@
mkImpureSecretGenerator,
}:
mkImpureSecretGenerator {
- # TODO: Escape prompt?
+ # TODO: Escape prompt/part (preferrably just use env) to prevent shell injection
script = ''
${kdePackages.kdialog}/bin/kdialog --inputbox "${prompt}" | gh private -o $out/${part}
'';
--- a/modules/secrets.nix
+++ b/modules/secrets.nix
@@ -89,6 +89,7 @@
# If set - script will be run on remote machine, otherwise it will be run with fleet project in CWD
# (Some secrets-encryption-in-git/managed PKI solution is expected)
impureOn ? null,
+ generationData ? null,
parts,
}:
(prev.writeShellScript "impureGenerator.sh" ''
@@ -117,7 +118,7 @@
'').overrideAttrs
(old: {
passthru = {
- inherit impureOn parts;
+ inherit impureOn parts generationData;
generatorKind = "impure";
};
});