git.delta.rocks / jrsonnet / refs/commits / 0528ea184e69

1use std::{2	env::current_dir,3	ffi::{OsStr, OsString},4	fmt::Display,5	io::Write,6	ops::Deref,7	path::PathBuf,8	str::FromStr,9	sync::{Arc, Mutex, MutexGuard, OnceLock},10};1112use anyhow::{anyhow, bail, ensure, Context, Result};13use clap::{ArgGroup, Parser};14use fleet_shared::SecretData;15use nix_eval::{nix_go, nix_go_json, NixSessionPool, Value};16use openssh::SessionBuilder;17use serde::de::DeserializeOwned;18use tempfile::NamedTempFile;1920use crate::{21	command::MyCommand,22	fleetdata::{FleetData, FleetSecret, FleetSharedSecret},23};2425pub struct FleetConfigInternals {26	pub local_system: String,27	pub directory: PathBuf,28	pub opts: FleetOpts,29	pub data: Mutex<FleetData>,30	pub nix_args: Vec<OsString>,31	/// fleet_config.config32	pub config_field: Value,33	/// fleet_config.unchecked.config34	pub config_unchecked_field: Value,3536	/// import nixpkgs {system = local};37	pub default_pkgs: Value,38}3940#[derive(Clone)]41pub struct Config(Arc<FleetConfigInternals>);4243impl Deref for Config {44	type Target = FleetConfigInternals;4546	fn deref(&self) -> &Self::Target {47		&self.048	}49}5051pub struct ConfigHost {52	config: Config,53	pub name: String,54	pub local: bool,55	pub session: OnceLock<Arc<openssh::Session>>,5657	pub nixos_config: Option<Value>,58}59impl ConfigHost {60	async fn open_session(&self) -> Result<Arc<openssh::Session>> {61		assert!(!self.local, "do not open ssh connection to local session");62		// FIXME: TOCTOU63		if let Some(session) = &self.session.get() {64			return Ok((*session).clone());65		};66		let session = SessionBuilder::default();6768		let session = session69			.connect(&self.name)70			.await71			.map_err(|e| anyhow!("ssh error while connecting to {}: {e}", self.name))?;72		let session = Arc::new(session);73		self.session.set(session.clone()).expect("TOCTOU happened");74		Ok(session)75	}76	pub async fn mktemp_dir(&self) -> Result<String> {77		let mut cmd = self.cmd("mktemp").await?;78		cmd.arg("-d");79		let path = cmd.run_string().await?;80		Ok(path.trim_end().to_owned())81	}82	pub async fn read_file_bin(&self, path: impl AsRef<OsStr>) -> Result<Vec<u8>> {83		let mut cmd = self.cmd("cat").await?;84		cmd.arg(path);85		cmd.run_bytes().await86	}87	pub async fn read_file_text(&self, path: impl AsRef<OsStr>) -> Result<String> {88		let mut cmd = self.cmd("cat").await?;89		cmd.arg(path);90		cmd.run_string().await91	}92	pub async fn read_dir(&self, path: impl AsRef<OsStr>) -> Result<Vec<String>> {93		let mut cmd = self.cmd("ls").await?;94		cmd.arg(path);95		let out = cmd.run_string().await?;96		let mut lines = out.split('\n');97		if let Some(last) = lines.next_back() {98			ensure!(last.is_empty(), "output of ls should end with newline");99		}100		Ok(lines.map(ToOwned::to_owned).collect())101	}102	#[allow(dead_code)]103	pub async fn read_file_json<D: DeserializeOwned>(&self, path: impl AsRef<OsStr>) -> Result<D> {104		let text = self.read_file_text(path).await?;105		Ok(serde_json::from_str(&text)?)106	}107	pub async fn read_file_value<D: FromStr>(&self, path: impl AsRef<OsStr>) -> Result<D>108	where109		<D as FromStr>::Err: Display,110	{111		let text = self.read_file_text(path).await?;112		D::from_str(&text).map_err(|e| anyhow!("failed to parse value: {e}"))113	}114	pub async fn cmd(&self, cmd: impl AsRef<OsStr>) -> Result<MyCommand> {115		if self.local {116			Ok(MyCommand::new(cmd))117		} else {118			let session = self.open_session().await?;119			Ok(MyCommand::new_on(cmd, session))120		}121	}122123	pub async fn decrypt(&self, data: SecretData) -> Result<Vec<u8>> {124		ensure!(data.encrypted, "secret is not encrypted");125		let mut cmd = self.cmd("fleet-install-secrets").await?;126		cmd.arg("decrypt").eqarg("--secret", data.to_string());127		let encoded = cmd128			.sudo()129			.run_string()130			.await131			.context("failed to call remote host for decrypt")?;132		let data: SecretData = encoded.parse().map_err(|e| anyhow!("{e}"))?;133		ensure!(!data.encrypted, "didn't decrypted secret");134		Ok(data.data)135	}136	pub async fn reencrypt(&self, data: SecretData, targets: Vec<String>) -> Result<SecretData> {137		ensure!(data.encrypted, "secret is not encrypted");138		let mut cmd = self.cmd("fleet-install-secrets").await?;139		cmd.arg("reencrypt").eqarg("--secret", data.to_string());140		for target in targets {141			let key = self.config.key(&target).await?;142			cmd.eqarg("--targets", key);143		}144		let encoded = cmd145			.sudo()146			.run_string()147			.await148			.context("failed to call remote host for decrypt")?;149		let data: SecretData = encoded.parse().map_err(|e| anyhow!("{e}"))?;150		ensure!(!data.encrypted, "didn't decrypted secret");151		Ok(data)152	}153	/// Returns path for futureproofing, as path might change i.e on conversion to CA154	pub async fn remote_derivation(&self, path: &PathBuf) -> Result<PathBuf> {155		if self.local {156			// Path is located locally, thus already trusted.157			return Ok(path.to_owned());158		}159		let mut nix = MyCommand::new("nix");160		nix.arg("copy")161			.arg("--substitute-on-destination")162			.comparg("--to", format!("ssh-ng://{}", self.name))163			.arg(path);164		nix.run_nix().await.context("nix copy")?;165		Ok(path.to_owned())166	}167	pub async fn systemctl_stop(&self, name: &str) -> Result<()> {168		let mut cmd = self.cmd("systemctl").await?;169		cmd.arg("stop").arg(name);170		cmd.sudo().run().await171	}172	pub async fn systemctl_start(&self, name: &str) -> Result<()> {173		let mut cmd = self.cmd("systemctl").await?;174		cmd.arg("start").arg(name);175		cmd.sudo().run().await176	}177178	pub async fn rm_file(&self, path: impl AsRef<OsStr>, sudo: bool) -> Result<()> {179		let mut cmd = self.cmd("rm").await?;180		cmd.arg("-f").arg(path);181		if sudo {182			cmd = cmd.sudo()183		}184		cmd.run().await185	}186187	pub async fn list_configured_secrets(&self) -> Result<Vec<String>> {188		let Some(nixos) = &self.nixos_config else {189			return Ok(vec![]);190		};191		let secrets = nix_go!(nixos.secrets);192		let mut out = Vec::new();193		for name in secrets.list_fields().await? {194			let secret = nix_go!(secrets[{ name }]);195			let is_shared: bool = nix_go_json!(secret.shared);196			if is_shared {197				continue;198			}199			out.push(name);200		}201		Ok(out)202	}203	pub async fn secret_field(&self, name: &str) -> Result<Value> {204		let Some(nixos) = &self.nixos_config else {205			bail!("host is virtual and has no secrets");206		};207		Ok(nix_go!(nixos.secrets[{ name }]))208	}209210	/// Packages for this host, resolved with nixpkgs overlays211	pub async fn pkgs(&self) -> Result<Value> {212		let Some(nixos) = &self.nixos_config else {213			return Ok(self.config.default_pkgs.clone());214		};215		Ok(nix_go!(nixos.nixpkgs.resolvedPkgs))216	}217}218219impl Config {220	pub fn should_skip(&self, host: &str) -> bool {221		if !self.opts.skip.is_empty() {222			self.opts.skip.iter().any(|h| h as &str == host)223		} else if !self.opts.only.is_empty() {224			!self.opts.only.iter().any(|h| h as &str == host)225		} else {226			false227		}228	}229	pub fn is_local(&self, host: &str) -> bool {230		self.opts.localhost.as_ref().map(|s| s as &str) == Some(host)231	}232233	pub fn local_host(&self) -> ConfigHost {234		ConfigHost {235			config: self.clone(),236			name: "<virtual localhost>".to_owned(),237			local: true,238			session: OnceLock::new(),239			nixos_config: None,240		}241	}242243	pub async fn host(&self, name: &str) -> Result<ConfigHost> {244		let config = &self.config_unchecked_field;245		let nixos_config = nix_go!(config.hosts[{ name }].nixosSystem.config);246		Ok(ConfigHost {247			config: self.clone(),248			name: name.to_owned(),249			local: self.is_local(name),250			session: OnceLock::new(),251			nixos_config: Some(nixos_config),252		})253	}254	pub async fn list_hosts(&self) -> Result<Vec<ConfigHost>> {255		let config = &self.config_unchecked_field;256		let names = nix_go!(config.hosts).list_fields().await?;257		let mut out = vec![];258		for name in names {259			out.push(self.host(&name).await?);260		}261		Ok(out)262	}263	pub async fn system_config(&self, host: &str) -> Result<Value> {264		let fleet_field = &self.config_unchecked_field;265		Ok(nix_go!(fleet_field.hosts[{ host }].nixosSystem.config))266	}267268	pub(super) fn data(&self) -> MutexGuard<FleetData> {269		self.data.lock().unwrap()270	}271	pub(super) fn data_mut(&self) -> MutexGuard<FleetData> {272		self.data.lock().unwrap()273	}274	/// Shared secrets configured in fleet.nix or in flake275	pub async fn list_configured_shared(&self) -> Result<Vec<String>> {276		let config_field = &self.config_unchecked_field;277		Ok(nix_go!(config_field.sharedSecrets).list_fields().await?)278	}279	/// Shared secrets configured in fleet.nix280	pub fn list_shared(&self) -> Vec<String> {281		let data = self.data();282		data.shared_secrets.keys().cloned().collect()283	}284	pub fn has_shared(&self, name: &str) -> bool {285		let data = self.data();286		data.shared_secrets.contains_key(name)287	}288	pub fn replace_shared(&self, name: String, shared: FleetSharedSecret) {289		let mut data = self.data_mut();290		data.shared_secrets.insert(name.to_owned(), shared);291	}292	pub fn remove_shared(&self, secret: &str) {293		let mut data = self.data_mut();294		data.shared_secrets.remove(secret);295	}296297	pub fn list_secrets(&self, host: &str) -> Vec<String> {298		let data = self.data();299		let Some(secrets) = data.host_secrets.get(host) else {300			return Vec::new();301		};302		secrets.keys().cloned().collect()303	}304305	pub fn has_secret(&self, host: &str, secret: &str) -> bool {306		let data = self.data();307		let Some(host_secrets) = data.host_secrets.get(host) else {308			return false;309		};310		host_secrets.contains_key(secret)311	}312	pub fn insert_secret(&self, host: &str, secret: String, value: FleetSecret) {313		let mut data = self.data_mut();314		let host_secrets = data.host_secrets.entry(host.to_owned()).or_default();315		host_secrets.insert(secret, value);316	}317318	pub fn host_secret(&self, host: &str, secret: &str) -> Result<FleetSecret> {319		let data = self.data();320		let Some(host_secrets) = data.host_secrets.get(host) else {321			bail!("no secrets for machine {host}");322		};323		let Some(secret) = host_secrets.get(secret) else {324			bail!("machine {host} has no secret {secret}");325		};326		Ok(secret.clone())327	}328	pub fn shared_secret(&self, secret: &str) -> Result<FleetSharedSecret> {329		let data = self.data();330		let Some(secret) = data.shared_secrets.get(secret) else {331			bail!("no shared secret {secret}");332		};333		Ok(secret.clone())334	}335	pub async fn shared_secret_expected_owners(&self, secret: &str) -> Result<Vec<String>> {336		let config_field = &self.config_unchecked_field;337		Ok(nix_go_json!(338			config_field.sharedSecrets[{ secret }].expectedOwners339		))340	}341342	pub fn save(&self) -> Result<()> {343		let mut tempfile = NamedTempFile::new_in(self.directory.clone()).context("failed to create updated version of fleet.nix in the same directory as original.\nDo you have write access to it? Access only to the fleet.nix won't be enough, the directory is used for atomic overwrite operation.\nIt is not recommended to use fleet by root anyway, move fleet project to your home directory.")?;344		let data = nixlike::serialize(&self.data() as &FleetData)?;345		tempfile.write_all(346			format!(347				"# This file contains fleet state and shouldn't be edited by hand\n\n{}\n\n# vim: ts=2 et nowrap\n",348				data349			)350			.as_bytes(),351		)?;352		let mut fleet_data_path = self.directory.clone();353		fleet_data_path.push("fleet.nix");354		tempfile.persist(fleet_data_path)?;355		Ok(())356	}357}358359#[derive(Parser, Clone)]360#[clap(group = ArgGroup::new("target_hosts"))]361pub struct FleetOpts {362	/// All hosts except those would be skipped363	#[clap(long, number_of_values = 1, group = "target_hosts")]364	only: Vec<String>,365366	/// Hosts to skip367	#[clap(long, number_of_values = 1, group = "target_hosts")]368	skip: Vec<String>,369370	/// Host, which should be threaten as current machine371	#[clap(long)]372	pub localhost: Option<String>,373374	/// Override detected system for host, to perform builds via375	/// binfmt-declared qemu instead of trying to crosscompile376	#[clap(long, default_value = "detect")]377	pub local_system: String,378}379380impl FleetOpts {381	pub async fn build(mut self, nix_args: Vec<OsString>) -> Result<Config> {382		if self.localhost.is_none() {383			self.localhost384				.replace(hostname::get().unwrap().to_str().unwrap().to_owned());385		}386		let directory = current_dir()?;387388		let pool = NixSessionPool::new(directory.as_os_str().to_owned(), nix_args.clone()).await?;389		let root_field = pool.get().await?;390391		let builtins_field = Value::binding(root_field.clone(), "builtins").await?;392		if self.local_system == "detect" {393			self.local_system = nix_go_json!(builtins_field.currentSystem);394		}395		let local_system = self.local_system.clone();396397		let fleet_root = Value::binding(root_field, "fleetConfigurations").await?;398		let fleet_field = nix_go!(fleet_root.default);399400		let config_field = nix_go!(fleet_field.config);401		let config_unchecked_field = nix_go!(fleet_field.unchecked.config);402403		let import = nix_go!(builtins_field.import);404		let overlays = nix_go!(config_unchecked_field.overlays);405		let nixpkgs = nix_go!(fleet_field.nixpkgs | import);406407		let default_pkgs = nix_go!(nixpkgs(Obj {408			overlays,409			system: { self.local_system.clone() },410		}));411412		let mut fleet_data_path = directory.clone();413		fleet_data_path.push("fleet.nix");414		let bytes = std::fs::read_to_string(fleet_data_path)?;415		let data = nixlike::parse_str(&bytes)?;416417		Ok(Config(Arc::new(FleetConfigInternals {418			opts: self,419			directory,420			data,421			local_system,422			nix_args,423			config_field,424			config_unchecked_field,425			default_pkgs,426		})))427	}428}