git.delta.rocks / jrsonnet / refs/commits / 15ef984b843b

--- a/cmds/fleet/Cargo.toml
+++ b/cmds/fleet/Cargo.toml
@@ -13,14 +13,14 @@
 tempfile = "3.2"
 once_cell = "1.5"
 hostname = "0.3.1"
-age-core = "0.8.0"
+age-core = "0.9.0"
 peg = "0.8.0"
 nixlike = { path = "../../crates/nixlike" }
-age = { version = "0.8.1", features = ["ssh", "armor"] }
-base64 = "0.13.0"
+age = { version = "0.9.0", features = ["ssh", "armor"] }
+base64 = "0.21.0"
 chrono = { version = "0.4.19", features = ["serde"] }
 z85 = "3.0.3"
-clap = { version = "3.1.0", features = [
+clap = { version = "4.0.29", features = [
 	"derive",
 	"env",
 	"wrap_help",

--- a/cmds/fleet/src/cmds/build_systems.rs
+++ b/cmds/fleet/src/cmds/build_systems.rs
@@ -8,9 +8,6 @@
 
 #[derive(Parser, Clone)]
 pub struct BuildSystems {
-	/// Jobs to run locally
-	#[clap(long)]
-	jobs: Option<usize>,
 	/// Do not continue on error
 	#[clap(long)]
 	fail_fast: bool,
@@ -19,13 +16,6 @@
 	privileged_build: bool,
 	#[clap(subcommand)]
 	subcommand: Subcommand,
-
-	/// --builders arg for nix
-	#[clap(long)]
-	builders: Option<String>,
-	/// --show-trace arg for nix
-	#[structopt(long)]
-	show_trace: bool,
 }
 
 enum UploadAction {
@@ -126,7 +116,7 @@
 			Command::new("nix")
 		};
 		nix_build
-			.args(&[
+			.args([
 				"build",
 				"--impure",
 				"--json",
@@ -140,22 +130,9 @@
 					"buildSystems.{}.{host}",
 					action.build_attr()
 				)),
-			);
+			)
+			.args(&config.nix_args);
 
-		if self.show_trace {
-			nix_build.arg("--show-trace");
-		}
-		if let Some(builders) = &self.builders {
-			nix_build.arg("--builders").arg(builders);
-		}
-		if let Some(jobs) = &self.jobs {
-			nix_build.arg("--max-jobs");
-			nix_build.arg(format!("{}", jobs));
-		}
-		if !self.fail_fast {
-			nix_build.arg("--keep-going");
-		}
-
 		nix_build.run_nix().await?;
 		let built = std::fs::canonicalize(built)?;
 
@@ -166,7 +143,7 @@
 					let mut tries = 0;
 					loop {
 						match Command::new("nix")
-							.args(&["copy", "--to"])
+							.args(["copy", "--to"])
 							.arg(format!("ssh://root@{}", host))
 							.arg(&built)
 							.inherit_stdio()
@@ -188,7 +165,7 @@
 						info!("switching generation");
 						config
 							.command_on(&host, "nix-env", true)
-							.args(&["-p", "/nix/var/nix/profiles/system", "--set"])
+							.args(["-p", "/nix/var/nix/profiles/system", "--set"])
 							.arg(&built)
 							.inherit_stdio()
 							.run()
@@ -219,18 +196,10 @@
 					Command::new("nix")
 				};
 				nix_build
-					.args(&["build", "--impure", "--no-link", "--out-link"])
+					.args(["build", "--impure", "--no-link", "--out-link"])
 					.arg(&out)
-					.arg(
-						config.configuration_attr_name(&format!("buildSystems.sdImage.{}", host,)),
-					);
-				if let Some(builders) = &self.builders {
-					nix_build.arg("--builders").arg(builders);
-				}
-				if let Some(jobs) = &self.jobs {
-					nix_build.arg("--max-jobs");
-					nix_build.arg(format!("{}", jobs));
-				}
+					.arg(config.configuration_attr_name(&format!("buildSystems.sdImage.{}", host,)))
+					.args(&config.nix_args);
 				if !self.fail_fast {
 					nix_build.arg("--keep-going");
 				}
@@ -250,21 +219,15 @@
 					Command::new("nix")
 				};
 				nix_build
-					.args(&["build", "--impure", "--no-link", "--out-link"])
+					.args(["build", "--impure", "--no-link", "--out-link"])
 					.arg(&out)
 					.arg(
 						config.configuration_attr_name(&format!(
 							"buildSystems.installationCd.{}",
 							host,
 						)),
-					);
-				if let Some(builders) = &self.builders {
-					nix_build.arg("--builders").arg(builders);
-				}
-				if let Some(jobs) = &self.jobs {
-					nix_build.arg("--max-jobs");
-					nix_build.arg(format!("{}", jobs));
-				}
+					)
+					.args(&config.nix_args);
 				if !self.fail_fast {
 					nix_build.arg("--keep-going");
 				}

--- a/cmds/fleet/src/cmds/info.rs
+++ b/cmds/fleet/src/cmds/info.rs
@@ -1,8 +1,15 @@
-use std::collections::BTreeSet;
+use std::{collections::BTreeSet, time::Duration};
 
-use crate::host::Config;
-use anyhow::{ensure, Result};
+use crate::{command::CommandExt, host::Config};
+use anyhow::{bail, ensure, Result};
 use clap::Parser;
+use nixlike::format_nix;
+use serde_json::{json, Value};
+use tokio::{
+	fs::{self, File},
+	io::AsyncWriteExt,
+	process::Command,
+};
 
 #[derive(Parser)]
 pub struct Info {

--- a/cmds/fleet/src/cmds/secrets/mod.rs
+++ b/cmds/fleet/src/cmds/secrets/mod.rs
@@ -2,13 +2,17 @@
 	fleetdata::{FleetSecret, FleetSharedSecret},
 	host::Config,
 };
-use anyhow::{bail, Result};
+use age::{Decryptor, Encryptor};
+use anyhow::{bail, ensure, Context, Result};
 use clap::Parser;
 use futures::{StreamExt, TryStreamExt};
 use std::{
-	io::{self, Cursor, Read},
+	collections::HashSet,
+	io::{self, Cursor, Read, Write},
+	iter,
 	path::PathBuf,
 };
+use tracing::{info, warn};
 
 #[derive(Parser)]
 pub enum Secrets {
@@ -42,6 +46,23 @@
 		#[clap(long)]
 		public_file: Option<PathBuf>,
 	},
+	/// Read secret from remote host, requires sudo on said host
+	Read {
+		name: String,
+		machine: String,
+	},
+	UpdateShared {
+		name: String,
+
+		machines: Option<Vec<String>>,
+
+		add_machines: Vec<String>,
+		remove_machines: Vec<String>,
+
+		/// Which host should we use to decrypt
+		prefer_identities: Vec<String>,
+	},
+	Regenerate,
 }
 
 impl Secrets {
@@ -78,9 +99,10 @@
 						let recipients = recipients
 							.iter()
 							.cloned()
-							.map(|r| Box::new(r) as Box<dyn age::Recipient>)
+							.map(|r| Box::new(r) as Box<dyn age::Recipient + Send>)
 							.collect();
 						let mut encryptor = age::Encryptor::with_recipients(recipients)
+							.expect("recipients provided")
 							.wrap_output(&mut encrypted)?;
 						io::copy(&mut Cursor::new(input), &mut encryptor)?;
 						encryptor.finish()?;
@@ -101,7 +123,7 @@
 							secret,
 							public: match (public, public_file) {
 								(Some(v), None) => Some(v),
-								(None, Some(v)) => Some(std::fs::read_to_string(&v)?),
+								(None, Some(v)) => Some(std::fs::read_to_string(v)?),
 								(Some(_), Some(_)) => {
 									bail!("only public or public_file should be set")
 								}
@@ -123,10 +145,14 @@
 				let secret = {
 					let mut input = vec![];
 					io::stdin().read_to_end(&mut input)?;
+					if input.is_empty() {
+						bail!("no data provided")
+					}
 
 					let mut encrypted = vec![];
-					let recipient = Box::new(recipient) as Box<dyn age::Recipient>;
+					let recipient = Box::new(recipient) as Box<dyn age::Recipient + Send>;
 					let mut encryptor = age::Encryptor::with_recipients(vec![recipient])
+						.expect("recipients provided")
 						.wrap_output(&mut encrypted)?;
 					io::copy(&mut Cursor::new(input), &mut encryptor)?;
 					encryptor.finish()?;
@@ -145,13 +171,180 @@
 						secret,
 						public: match (public, public_file) {
 							(Some(v), None) => Some(v),
-							(None, Some(v)) => Some(std::fs::read_to_string(&v)?),
+							(None, Some(v)) => Some(std::fs::read_to_string(v)?),
 							(Some(_), Some(_)) => bail!("only public or public_file should be set"),
 							(None, None) => None,
 						},
 					},
 				);
 			}
+			// TODO: Instead of using sudo, decode secret on remote machine
+			#[allow(clippy::await_holding_refcell_ref)]
+			Secrets::Read { name, machine } => {
+				let data = config.data();
+
+				let Some(host_secrets) = data.host_secrets.get(&machine) else {
+                    bail!("no secrets for machine {machine}");
+                };
+				let Some(secret) = host_secrets.get(&name) else {
+                    bail!("machine {machine} has no secret {name}");
+                };
+				if secret.secret.is_empty() {
+					bail!("no secret {name}");
+				}
+				let identity = config.identity(&machine).await?;
+				let decryptor = Decryptor::new(Cursor::new(&secret.secret))?;
+				let decryptor = match decryptor {
+					Decryptor::Recipients(r) => r,
+					Decryptor::Passphrase(_) => bail!("should be recipients"),
+				};
+				let mut decryptor = decryptor
+					.decrypt(iter::once(&identity as &dyn age::Identity))
+					.context("failed to decrypt, wrong key?")?;
+
+				let mut decrypted = Vec::new();
+				decryptor
+					.read_to_end(&mut decrypted)
+					.context("failed to decrypt")?;
+				// secret.secret
+				std::io::stdout().lock().write_all(&decrypted)?;
+			}
+			Secrets::UpdateShared {
+				name,
+				machines,
+				mut add_machines,
+				mut remove_machines,
+				prefer_identities,
+			} => {
+				let mut data = config.data_mut();
+				if machines.is_none() && add_machines.is_empty() && remove_machines.is_empty() {
+					bail!("no operation");
+				}
+
+				let Some(mut secret) = data.shared_secrets.get_mut(&name) else {
+                    bail!("no shared secret {name}");
+                };
+				if secret.secret.secret.is_empty() {
+					bail!("no secret");
+				}
+
+				let initial_machines = secret.owners.clone();
+				let mut target_machines = secret.owners.clone();
+
+				// ensure!(machines.is_some() || !add_machines.is_empty() || )
+				if let Some(machines) = machines {
+					ensure!(
+						add_machines.is_empty() && remove_machines.is_empty(),
+						"can't combine --machines and --add-machines/--remove-machines"
+					);
+					let target = initial_machines.iter().collect::<HashSet<_>>();
+					let source = machines.iter().collect::<HashSet<_>>();
+					for removed in target.difference(&source) {
+						remove_machines.push((*removed).clone());
+					}
+					for added in source.difference(&target) {
+						add_machines.push((*added).clone());
+					}
+				}
+
+				for machine in &remove_machines {
+					let mut removed = false;
+					while let Some(pos) = target_machines.iter().position(|m| m == machine) {
+						target_machines.swap_remove(pos);
+						removed = true;
+					}
+					if !removed {
+						bail!("secret is not enabled for {machine}");
+					}
+				}
+				for machine in &add_machines {
+					if target_machines.iter().any(|m| m == machine) {
+						warn!("secret is already added to {machine}");
+					}
+				}
+				if remove_machines.is_empty() {
+					warn!("secret will not be regenerated for removed machines, and until host rebuild, they will still possess the ability to decode secret");
+				}
+				if target_machines.is_empty() {
+					info!("no machines left for secret, removing it");
+					data.shared_secrets.remove(&name);
+					return Ok(());
+				}
+
+				let identity_holder = if !prefer_identities.is_empty() {
+					prefer_identities
+						.iter()
+						.find(|i| initial_machines.iter().any(|s| s == *i))
+				} else {
+					secret.owners.first()
+				};
+				let Some(identity_holder) = identity_holder else {
+                    bail!("no available holder found");
+                };
+				let target_recipients = futures::stream::iter(&target_machines)
+					.flat_map(|m| futures::stream::once(config.recipient(m)))
+					.collect::<Vec<_>>()
+					.await
+					.into_iter()
+					.map(|v| v.map(|v| Box::new(v) as Box<dyn age::Recipient + Send>))
+					.collect::<Result<Vec<_>>>()?;
+
+				let identity = config.identity(identity_holder).await?;
+				let decryptor = Decryptor::new(Cursor::new(&secret.secret.secret))?;
+				let decryptor = match decryptor {
+					Decryptor::Recipients(r) => r,
+					Decryptor::Passphrase(_) => bail!("should be recipients"),
+				};
+				let mut decryptor = decryptor
+					.decrypt(iter::once(&identity as &dyn age::Identity))
+					.context("failed to decrypt, wrong key?")?;
+
+				let mut decrypted = Vec::new();
+				decryptor
+					.read_to_end(&mut decrypted)
+					.context("failed to decrypt")?;
+
+				let mut encrypted = vec![];
+				let mut encryptor = Encryptor::with_recipients(target_recipients)
+					.expect("recipients provided")
+					.wrap_output(&mut encrypted)?;
+				io::copy(&mut Cursor::new(decrypted), &mut encryptor)?;
+				encryptor.finish()?;
+
+				secret.secret.secret = encrypted;
+			}
+			Secrets::Regenerate => {
+				// config.data_mut().shared_secrets
+				{
+					let expected_shared_set =
+						config.shared_config_attr_names("sharedSecrets").await?;
+					let expected_shared_set = expected_shared_set.iter().collect::<HashSet<_>>();
+					let shared_set = config.data();
+					let shared_set = shared_set.shared_secrets.keys().collect::<HashSet<_>>();
+					for removed in expected_shared_set.difference(&shared_set) {
+						warn!("secret needs to be generated: {removed}")
+					}
+				}
+				let mut to_remove = Vec::new();
+				for (name, data) in &config.data().shared_secrets {
+					let expected_owners: Vec<String> = config
+						.shared_config_attr(&format!("sharedSecrets.\"{name}\".expectedOwners"))
+						.await?;
+					if expected_owners.is_empty() {
+						warn!("secret was removed from fleet config: {name}, removing from data");
+						to_remove.push(name.to_string());
+						continue;
+					}
+					let set = data.owners.iter().collect::<HashSet<_>>();
+					let expected_set = expected_owners.iter().collect::<HashSet<_>>();
+					if set != expected_set {
+						warn!("reconfiguring owners for {name}");
+					}
+				}
+				for k in to_remove {
+					config.data_mut().shared_secrets.remove(&k);
+				}
+			}
 		}
 		Ok(())
 	}