1use age::Decryptor;2use anyhow::{anyhow, bail, Context, Result};3use clap::Parser;4use log::{error, warn};5use nix::fcntl::{renameat2, RenameFlags};6use nix::sys::stat::Mode;7use nix::unistd::{chown, Group, User};8use serde::{Deserialize, Deserializer};9use std::fs::{self, DirBuilder};10use std::io::{self, Cursor, Read};11use std::iter;12use std::os::unix::prelude::PermissionsExt;13use std::str::from_utf8;14use std::{15 collections::HashMap,16 os::unix::fs::DirBuilderExt,17 path::{Path, PathBuf},18};1920#[derive(Parser)]21#[clap(author)]22struct Opts {23 data: PathBuf,24}2526#[derive(Deserialize)]27#[serde(rename_all = "camelCase")]28struct DataItem {29 group: String,30 mode: String,31 owner: String,3233 #[serde(deserialize_with = "from_z85")]34 secret: Option<Vec<u8>>,35 public: String,3637 secret_hash: String,38 public_path: String,39}4041fn from_z85<'de, D>(deserializer: D) -> Result<Option<Vec<u8>>, D::Error>42where43 D: Deserializer<'de>,44{45 use serde::de::Error;46 if let Some(v) = <Option<String>>::deserialize(deserializer)? {47 Ok(Some(48 z85::decode(&v).map_err(|err| Error::custom(err.to_string()))?,49 ))50 } else {51 Ok(None)52 }53}5455type Data = HashMap<String, DataItem>;5657fn init_secret(58 identity: &age::ssh::Identity,59 dir: &Path,60 name: &str,61 value: DataItem,62) -> Result<()> {63 if value.secret.is_none() {64 return Ok(());65 }66 let secret = value.secret.as_ref().unwrap();6768 let mut path = dir.to_path_buf();69 path.push(name);70 if path.strip_prefix(&dir).is_err() {71 bail!("found escaping name");72 }7374 let secret_dir = path75 .parent()76 .expect("path is in tempdir, so it should have parent");7778 if secret_dir != dir {79 DirBuilder::new()80 .recursive(true)81 82 83 84 .mode(0o755)85 .create(86 path.parent()87 .expect("path is in tempdir, so it should have parent"),88 )89 .context("failed to create secret directory")?;90 }9192 let mode = Mode::from_bits(93 u32::from_str_radix(&value.mode, 8).context("failed to parse mode as octal")?,94 )95 .context("failed to parse mode")?;96 let user = User::from_name(&value.owner)97 .context("failed to get user")?98 .ok_or_else(|| anyhow!("user not found"))?;99 let group = Group::from_name(&value.group)100 .context("failed to get group")?101 .ok_or_else(|| anyhow!("group not found"))?;102 let mut tempfile =103 tempfile::NamedTempFile::new_in(secret_dir).context("failed to create tempfile")?;104 105106 let decrypted = {107 let mut input = Cursor::new(&secret);108 let decryptor = Decryptor::new(&mut input).context("failed to init decryptor")?;109 let decryptor = match decryptor {110 Decryptor::Recipients(r) => r,111 Decryptor::Passphrase(_) => bail!("should be recipients"),112 };113 let mut decryptor = decryptor114 .decrypt(iter::once(identity as &dyn age::Identity))115 .context("failed to decrypt, wrong key?")?;116117 let mut decrypted = Vec::new();118 decryptor119 .read_to_end(&mut decrypted)120 .context("failed to decrypt")?;121 decrypted122 };123124 io::copy(&mut Cursor::new(decrypted), &mut tempfile)125 .context("failed to write decrypted file")?;126127 128 chown(tempfile.path(), Some(user.uid), Some(group.gid))129 .context("failed to apply user/group")?;130 fs::set_permissions(tempfile.path(), fs::Permissions::from_mode(mode.bits())).unwrap();131 tempfile.persist(path).context("failed to persist")?;132133 Ok(())134}135136fn main() -> anyhow::Result<()> {137 env_logger::Builder::new()138 .filter_level(log::LevelFilter::Info)139 .init();140141 let opts = Opts::parse();142 let data = fs::read(&opts.data).context("failed to read secrets data")?;143 let data_str = from_utf8(&data).context("failed to read data to string")?;144 let data: Data = serde_json::from_str(data_str).context("failed to parse data")?;145146 let tempdir = tempfile::tempdir_in("/run/").context("failed to create secrets tempdir")?;147148 let identity = age::ssh::Identity::from_buffer(149 &mut Cursor::new(150 fs::read("/etc/ssh/ssh_host_ed25519_key").context("failed to read host private key")?,151 ),152 None,153 )154 .context("failed to parse identity")?;155156 let mut failed = false;157 for (name, value) in data {158 if let Err(e) = init_secret(&identity, tempdir.path(), &name, value) {159 error!(160 "{:?}",161 e.context(format!("failed to initialize secret {}", name))162 );163 failed = true;164 }165 }166 if failed {167 bail!("one or more secrets failed");168 }169170 if fs::metadata("/run/secrets")171 .map(|m| m.is_dir())172 .unwrap_or(false)173 {174 175 renameat2(176 None,177 tempdir.path(),178 None,179 "/run/secrets",180 RenameFlags::RENAME_EXCHANGE,181 )182 .context("failed to exchange secret directories")?;183 if tempdir.close().is_err() {184 warn!("failed to unlink old secrets");185 }186 } else {187 188 let persisted = tempdir.into_path();189 fs::rename(&persisted, "/run/secrets").context("failed to link secret directory")?;190 }191 Ok(())192}