git.delta.rocks / jrsonnet / refs/commits / 67bf612dbfd3

1use std::{2	collections::{BTreeMap, BTreeSet, HashSet},3	ffi::OsString,4	io::{self, stdin, stdout, Read, Write},5	path::PathBuf,6};78use anyhow::{anyhow, bail, ensure, Context, Result};9use chrono::{DateTime, Utc};10use clap::Parser;11use crossterm::{terminal, tty::IsTty};12use fleet_shared::SecretData;13use itertools::Itertools;14use nix_eval::{nix_go, nix_go_json, Value};15use owo_colors::OwoColorize;16use serde::Deserialize;17use tabled::{Table, Tabled};18use tokio::{fs::read, process::Command};19use tracing::{error, info, info_span, warn, Instrument};2021use crate::{22	fleetdata::{encrypt_secret_data, FleetSecret, FleetSecretPart, FleetSharedSecret},23	host::Config,24};2526#[derive(Parser)]27pub enum Secret {28	/// Force load host keys for all defined hosts29	ForceKeys,30	/// Add secret, data should be provided in stdin31	AddShared {32		/// Secret name33		name: String,34		/// Secret owners35		#[clap(long, short)]36		machines: Vec<String>,37		/// Override secret if already present38		#[clap(long)]39		force: bool,40		/// Secret public part41		#[clap(long)]42		public: Option<String>,43		/// Load public part from specified file44		#[clap(long)]45		public_file: Option<PathBuf>,4647		/// Create a notification on secret expiration48		#[clap(long)]49		expires_at: Option<DateTime<Utc>>,5051		/// Secret with this name already exists, override its value while keeping the same owners.52		#[clap(long)]53		re_add: bool,5455		/// How to name public secret part56		#[clap(long, short = 'p', default_value = "public")]57		public_part: String,58		/// How to name private secret part59		#[clap(short = 's', long, default_value = "secret")]60		part: String,61	},62	/// Add secret, data should be provided in stdin63	Add {64		/// Secret name65		name: String,66		/// Secret owner67		#[clap(short = 'm', long)]68		machine: String,69		/// Override secret if already present70		#[clap(long)]71		force: bool,72		/// Secret public part73		#[clap(long)]74		public: Option<String>,75		/// Load public part from specified file76		#[clap(long)]77		public_file: Option<PathBuf>,7879		/// How to name public secret part80		#[clap(short = 'p', long, default_value = "public")]81		public_part: String,82		/// How to name private secret part83		#[clap(short = 's', long, default_value = "secret")]84		part: String,85	},86	/// Read secret from remote host, requires sudo on said host87	Read {88		name: String,89		#[clap(short = 'm', long)]90		machine: String,9192		/// Which private secret part to read93		#[clap(short = 'p', long, default_value = "secret")]94		part: String,95	},96	UpdateShared {97		name: String,9899		#[clap(short = 'm', long)]100		machine: Option<Vec<String>>,101102		#[clap(long)]103		add_machine: Vec<String>,104		#[clap(long)]105		remove_machine: Vec<String>,106107		/// Which host should we use to decrypt108		#[clap(long)]109		prefer_identities: Vec<String>,110	},111	Regenerate {112		/// Which host should we use to decrypt, in case if reencryption is required, without113		/// regeneration114		#[clap(long)]115		prefer_identities: Vec<String>,116	},117	List {},118	Edit {119		name: String,120		#[clap(short = 'm', long)]121		machine: String,122123		#[clap(long)]124		add: bool,125126		/// Which private secret part to read127		#[clap(short = 'p', long, default_value = "secret")]128		part: String,129	},130}131132#[tracing::instrument(skip(config, secret, field, prefer_identities))]133async fn update_owner_set(134	secret_name: &str,135	config: &Config,136	mut secret: FleetSharedSecret,137	field: Value,138	updated_set: &[String],139	prefer_identities: &[String],140) -> Result<FleetSharedSecret> {141	let original_set = secret.owners.clone();142143	let set = original_set.iter().collect::<BTreeSet<_>>();144	let expected_set = updated_set.iter().collect::<BTreeSet<_>>();145146	if set == expected_set {147		info!("no need to update owner list, it is already correct");148		return Ok(secret);149	}150151	let should_regenerate = if set.difference(&expected_set).next().is_some() {152		// TODO: Remove this warning for revokable secrets.153		warn!("host was removed from secret owners, but until this host rebuild, the secret will still be stored on it.");154		nix_go_json!(field.regenerateOnOwnerRemoved)155	} else if expected_set.difference(&set).next().is_some() {156		nix_go_json!(field.regenerateOnOwnerAdded)157	} else {158		false159	};160161	if should_regenerate {162		info!("secret is owner-dependent, will regenerate");163		let generated = generate_shared(config, secret_name, field, updated_set.to_vec()).await?;164		Ok(generated)165	} else {166		let identity_holder = if !prefer_identities.is_empty() {167			prefer_identities168				.iter()169				.find(|i| original_set.iter().any(|s| s == *i))170		} else {171			secret.owners.first()172		};173		let Some(identity_holder) = identity_holder else {174			bail!("no available holder found");175		};176177		for (part_name, part) in secret.secret.parts.iter_mut() {178			let _span = info_span!("part reencryption", part_name);179			if !part.raw.encrypted {180				continue;181			}182			let host = config.host(identity_holder).await?;183			let encrypted = host184				.reencrypt(part.raw.clone(), updated_set.to_vec())185				.await?;186			part.raw = encrypted;187		}188189		secret.owners = updated_set.to_vec();190		Ok(secret)191	}192}193194#[derive(Deserialize)]195#[serde(rename_all = "camelCase")]196enum GeneratorKind {197	Impure,198	Pure,199}200201async fn generate_pure(202	_config: &Config,203	_display_name: &str,204	_secret: Value,205	_default_generator: Value,206	_owners: &[String],207) -> Result<FleetSecret> {208	bail!("pure generators are broken for now")209}210async fn generate_impure(211	config: &Config,212	_display_name: &str,213	secret: Value,214	default_generator: Value,215	owners: &[String],216) -> Result<FleetSecret> {217	let generator = nix_go!(secret.generator);218	let on: Option<String> = nix_go_json!(default_generator.impureOn);219220	let host = if let Some(on) = &on {221		config.host(on).await?222	} else {223		config.local_host()224	};225	let on_pkgs = host.pkgs().await?;226	let call_package = nix_go!(on_pkgs.callPackage);227	let mk_secret_generators = nix_go!(on_pkgs.mkSecretGenerators);228229	let mut recipients = Vec::new();230	for owner in owners {231		let key = config.key(owner).await?;232		recipients.push(key);233	}234	let generators = nix_go!(mk_secret_generators(Obj {235		recipients: { recipients },236	}));237238	let generator = nix_go!(call_package(generator)(generators));239240	let generator = generator.build().await?;241	let generator = generator242		.get("out")243		.ok_or_else(|| anyhow!("missing generateImpure out"))?;244	let generator = host.remote_derivation(generator).await?;245246	let out_parent = host.mktemp_dir().await?;247	let out = format!("{out_parent}/out");248249	let mut gen = host.cmd(generator).await?;250	gen.env("out", &out);251	if on.is_none() {252		// This path is local, thus we can feed `OsString` directly to env var... But I don't think that's necessary to handle.253		let project_path: String = config254			.directory255			.clone()256			.into_os_string()257			.into_string()258			.map_err(|s| anyhow!("fleet project path is not utf-8: {s:?}"))?;259		gen.env("FLEET_PROJECT", project_path);260	}261	gen.run().await.context("impure generator")?;262263	{264		let marker = host.read_file_text(format!("{out}/marker")).await?;265		ensure!(marker == "SUCCESS", "generation not succeeded");266	}267268	let mut parts = BTreeMap::new();269	for part in host.read_dir(&out).await? {270		if part == "created_at" || part == "expired_at" || part == "marker" {271			continue;272		}273		let contents: SecretData = host274			.read_file_text(format!("{out}/{part}"))275			.await?276			.parse()277			.map_err(|e| anyhow!("failed to decode secret {out:?} part {part:?}: {e}"))?;278		parts.insert(part.to_owned(), FleetSecretPart { raw: contents });279	}280281	let created_at = host.read_file_value(format!("{out}/created_at")).await?;282	let expires_at = host.read_file_value(format!("{out}/expires_at")).await.ok();283284	Ok(FleetSecret {285		created_at,286		expires_at,287		parts,288	})289}290async fn generate(291	config: &Config,292	display_name: &str,293	secret: Value,294	owners: &[String],295) -> Result<FleetSecret> {296	let generator = nix_go!(secret.generator);297	// Can't properly check on nix module system level298	{299		let gen_ty = generator.type_of().await?;300		if gen_ty == "null" {301			bail!("secret has no generator defined, can't automatically generate it.");302		}303		if gen_ty != "lambda" {304			bail!("generator should be lambda, got {gen_ty}");305		}306	}307	let default_pkgs = &config.default_pkgs;308	let default_call_package = nix_go!(default_pkgs.callPackage);309	let default_mk_secret_generators = nix_go!(default_pkgs.mkSecretGenerators);310	// Generators provide additional information in passthru, to access311	// passthru we should call generator, but information about where this generator is supposed to build312	// is located in passthru... Thus evaluating generator on host.313	//314	// Maybe it is also possible to do some magic with __functor?315	//316	// I don't want to make modules always responsible for additional secret data anyway,317	// so it should be in derivation, and not in the secret data itself.318	let generators = nix_go!(default_mk_secret_generators(Obj {319		recipients: { <Vec<String>>::new() },320	}));321	let default_generator = nix_go!(default_call_package(generator)(generators));322323	let kind: GeneratorKind = nix_go_json!(default_generator.generatorKind);324325	match kind {326		GeneratorKind::Impure => {327			generate_impure(config, display_name, secret, default_generator, owners).await328		}329		GeneratorKind::Pure => {330			generate_pure(config, display_name, secret, default_generator, owners).await331		}332	}333}334async fn generate_shared(335	config: &Config,336	display_name: &str,337	secret: Value,338	expected_owners: Vec<String>,339) -> Result<FleetSharedSecret> {340	// let owners: Vec<String> = nix_go_json!(secret.expectedOwners);341	Ok(FleetSharedSecret {342		secret: generate(config, display_name, secret, &expected_owners).await?,343		owners: expected_owners,344	})345}346347async fn parse_public(348	public: Option<String>,349	public_file: Option<PathBuf>,350) -> Result<Option<SecretData>> {351	Ok(match (public, public_file) {352		(Some(v), None) => Some(SecretData {353			data: v.into(),354			encrypted: false,355		}),356		(None, Some(v)) => Some(SecretData {357			data: read(v).await?,358			encrypted: false,359		}),360		(Some(_), Some(_)) => {361			bail!("only public or public_file should be set")362		}363		(None, None) => None,364	})365}366367async fn parse_secret() -> Result<Option<Vec<u8>>> {368	let mut input = vec![];369	stdin().read_to_end(&mut input)?;370	if input.is_empty() {371		Ok(None)372	} else {373		Ok(Some(input))374	}375}376377fn parse_machines(378	initial: Vec<String>,379	machines: Option<Vec<String>>,380	mut add_machines: Vec<String>,381	mut remove_machines: Vec<String>,382) -> Result<Vec<String>> {383	if machines.is_none() && add_machines.is_empty() && remove_machines.is_empty() {384		bail!("no operation");385	}386387	let initial_machines = initial.clone();388	let mut target_machines = initial;389	info!("Currently encrypted for {initial_machines:?}");390391	// ensure!(machines.is_some() || !add_machines.is_empty() || )392	if let Some(machines) = machines {393		ensure!(394			add_machines.is_empty() && remove_machines.is_empty(),395			"can't combine --machines and --add-machines/--remove-machines"396		);397		let target = initial_machines.iter().collect::<HashSet<_>>();398		let source = machines.iter().collect::<HashSet<_>>();399		for removed in target.difference(&source) {400			remove_machines.push((*removed).clone());401		}402		for added in source.difference(&target) {403			add_machines.push((*added).clone());404		}405	}406407	for machine in &remove_machines {408		let mut removed = false;409		while let Some(pos) = target_machines.iter().position(|m| m == machine) {410			target_machines.swap_remove(pos);411			removed = true;412		}413		if !removed {414			warn!("secret is not enabled for {machine}");415		}416	}417	for machine in &add_machines {418		if target_machines.iter().any(|m| m == machine) {419			warn!("secret is already added to {machine}");420		} else {421			target_machines.push(machine.to_owned());422		}423	}424	if !remove_machines.is_empty() {425		// TODO: maybe force secret regeneration?426		// Not that useful without revokation.427		warn!("secret will not be regenerated for removed machines, and until host rebuild, they will still possess the ability to decode secret");428	}429	Ok(target_machines)430}431impl Secret {432	pub async fn run(self, config: &Config) -> Result<()> {433		match self {434			Secret::ForceKeys => {435				for host in config.list_hosts().await? {436					if config.should_skip(&host.name) {437						continue;438					}439					config.key(&host.name).await?;440				}441			}442			Secret::AddShared {443				mut machines,444				name,445				force,446				public,447				public_part: public_name,448				public_file,449				expires_at,450				re_add,451				part: part_name,452			} => {453				// TODO: Forbid updating secrets with set expectedOwners (= not user-managed).454455				let exists = config.has_shared(&name);456				if exists && !force && !re_add {457					bail!("secret already defined");458				}459				if re_add {460					// Fixme: use clap to limit this usage461					ensure!(!force, "--force and --readd are not compatible");462					ensure!(exists, "secret doesn't exists");463					ensure!(464						machines.is_empty(),465						"you can't use machines argument for --readd"466					);467					let shared = config.shared_secret(&name)?;468					machines = shared.owners;469				}470471				let recipients = config.recipients(machines.clone()).await?;472473				let mut parts = BTreeMap::new();474475				let mut input = vec![];476				io::stdin().read_to_end(&mut input)?;477478				if !input.is_empty() {479					let encrypted = encrypt_secret_data(recipients, input)480						.ok_or_else(|| anyhow!("no recipients provided"))?;481					parts.insert(part_name, FleetSecretPart { raw: encrypted });482				}483484				if let Some(public) = parse_public(public, public_file).await? {485					parts.insert(public_name, FleetSecretPart { raw: public });486				}487488				config.replace_shared(489					name,490					FleetSharedSecret {491						owners: machines,492						secret: FleetSecret {493							created_at: Utc::now(),494							expires_at,495							parts,496						},497					},498				);499			}500			Secret::Add {501				machine,502				name,503				force,504				public,505				public_part: public_name,506				public_file,507				part: part_name,508			} => {509				if config.has_secret(&machine, &name) && !force {510					bail!("secret already defined");511				}512513				let mut parts = BTreeMap::new();514515				if let Some(secret) = parse_secret().await? {516					let recipient = config.recipient(&machine).await?;517					let encrypted =518						encrypt_secret_data(vec![recipient], secret).expect("recipient provided");519					parts.insert(part_name, FleetSecretPart { raw: encrypted });520				}521522				if let Some(public) = parse_public(public, public_file).await? {523					parts.insert(public_name, FleetSecretPart { raw: public });524				};525526				config.insert_secret(527					&machine,528					name,529					FleetSecret {530						created_at: Utc::now(),531						expires_at: None,532						parts,533					},534				);535			}536			#[allow(clippy::await_holding_refcell_ref)]537			Secret::Read {538				name,539				machine,540				part: part_name,541			} => {542				let secret = config.host_secret(&machine, &name)?;543				let Some(secret) = secret.parts.get(&part_name) else {544					bail!("no part {part_name} in secret {name}");545				};546				let data = if secret.raw.encrypted {547					let host = config.host(&machine).await?;548					host.decrypt(secret.raw.clone()).await?549				} else {550					secret.raw.data.clone()551				};552553				stdout().write_all(&data)?;554			}555			Secret::UpdateShared {556				name,557				machine,558				add_machine,559				remove_machine,560				prefer_identities,561			} => {562				// TODO: Forbid updating secrets with set expectedOwners (= not user-managed).563564				let secret = config.shared_secret(&name)?;565				if secret.secret.parts.values().all(|v| !v.raw.encrypted) {566					bail!("no secret");567				}568569				let initial_machines = secret.owners.clone();570				let target_machines = parse_machines(571					initial_machines.clone(),572					machine,573					add_machine,574					remove_machine,575				)?;576577				if target_machines.is_empty() {578					info!("no machines left for secret, removing it");579					config.remove_shared(&name);580					return Ok(());581				}582583				let config_field = &config.config_unchecked_field;584				let field = nix_go!(config_field.sharedSecrets[{ name }]);585586				let updated = update_owner_set(587					&name,588					config,589					secret,590					field,591					&target_machines,592					&prefer_identities,593				)594				.await?;595				config.replace_shared(name, updated);596			}597			Secret::Regenerate { prefer_identities } => {598				info!("checking for secrets to regenerate");599				{600					let _span = info_span!("shared").entered();601					let expected_shared_set = config602						.list_configured_shared()603						.await?604						.into_iter()605						.collect::<HashSet<_>>();606					let shared_set = config.list_shared().into_iter().collect::<HashSet<_>>();607					for missing in expected_shared_set.difference(&shared_set) {608						let config_field = &config.config_unchecked_field;609						let secret = nix_go!(config_field.sharedSecrets[{ missing }]);610						let expected_owners: Option<Vec<String>> =611							nix_go_json!(secret.expectedOwners);612						let Some(expected_owners) = expected_owners else {613							// TODO: Might still need to regenerate614							continue;615						};616						info!("generating secret: {missing}");617						let shared = generate_shared(config, missing, secret, expected_owners)618							.in_current_span()619							.await?;620						config.replace_shared(missing.to_string(), shared)621					}622				}623				for host in config.list_hosts().await? {624					if config.should_skip(&host.name) {625						continue;626					}627628					let _span = info_span!("host", host = host.name).entered();629					let expected_set = host630						.list_configured_secrets()631						.in_current_span()632						.await?633						.into_iter()634						.collect::<HashSet<_>>();635					let stored_set = config636						.list_secrets(&host.name)637						.into_iter()638						.collect::<HashSet<_>>();639					for missing in expected_set.difference(&stored_set) {640						info!("generating secret: {missing}");641						let secret = host.secret_field(missing).in_current_span().await?;642						let generated =643							match generate(config, missing, secret, &[host.name.clone()])644								.in_current_span()645								.await646							{647								Ok(v) => v,648								Err(e) => {649									error!("{e:?}");650									continue;651								}652							};653						config.insert_secret(&host.name, missing.to_string(), generated)654					}655				}656				let mut to_remove = Vec::new();657				for name in &config.list_shared() {658					info!("updating secret: {name}");659					let data = config.shared_secret(name)?;660					let config_field = &config.config_unchecked_field;661					let expected_owners: Vec<String> =662						nix_go_json!(config_field.sharedSecrets[{ name }].expectedOwners);663					if expected_owners.is_empty() {664						warn!("secret was removed from fleet config: {name}, removing from data");665						to_remove.push(name.to_string());666						continue;667					}668669					let secret = nix_go!(config_field.sharedSecrets[{ name }]);670					config.replace_shared(671						name.to_owned(),672						update_owner_set(673							name,674							config,675							data,676							secret,677							&expected_owners,678							&prefer_identities,679						)680						.await?,681					);682				}683				for k in to_remove {684					config.remove_shared(&k);685				}686			}687			Secret::List {} => {688				let _span = info_span!("loading secrets").entered();689				let configured = config.list_configured_shared().await?;690				#[derive(Tabled)]691				struct SecretDisplay {692					#[tabled(rename = "Name")]693					name: String,694					#[tabled(rename = "Owners")]695					owners: String,696				}697				let mut table = vec![];698				for name in configured.iter().cloned() {699					let config = config.clone();700					let expected_owners = config.shared_secret_expected_owners(&name).await?;701					let data = config.shared_secret(&name)?;702					let owners = data703						.owners704						.iter()705						.map(|o| {706							if expected_owners.contains(o) {707								o.green().to_string()708							} else {709								o.red().to_string()710							}711						})712						.collect::<Vec<_>>();713					table.push(SecretDisplay {714						owners: owners.join(", "),715						name,716					})717				}718				info!("loaded\n{}", Table::new(table).to_string())719			}720			Secret::Edit {721				name,722				machine,723				part,724				add,725			} => {726				let secret = config.host_secret(&machine, &name)?;727				if let Some(data) = secret.parts.get(&part) {728					let host = config.host(&machine).await?;729					let secret = host.decrypt(data.raw.clone()).await?;730					String::from_utf8(secret).context("secret is not utf8")?731				} else if add {732					String::new()733				} else {734					bail!("part {part} not found in secret {name}. Did you mean to `--add` it?");735				};736			}737		}738		Ok(())739	}740}741742async fn edit_temp_file(743	builder: tempfile::Builder<'_, '_>,744	r: Vec<u8>,745	header: &str,746	comment: &str,747) -> Result<(Vec<u8>, Option<String>), anyhow::Error> {748	if !stdin().is_tty() {749		// TODO: Also try to open /dev/tty directly?750		bail!("stdin is not tty, can't open editor");751	}752753	use std::fmt::Write;754	let mut file = builder.tempfile()?;755756	let mut full_header = String::new();757	let mut had = false;758	for line in header.trim_end().lines() {759		had = true;760		writeln!(&mut full_header, "{comment}{line}")?;761	}762	if had {763		writeln!(&mut full_header, "{}", comment.trim_end())?;764	}765	writeln!(766		&mut full_header,767		"{comment}Do not touch this header! It will be removed automatically"768	)?;769770	file.write_all(full_header.as_bytes())?;771	file.write_all(&r)?;772773	let abs_path = file.into_temp_path();774	let editor = std::env::var_os("VISUAL")775		.or_else(|| std::env::var_os("EDITOR"))776		.unwrap_or_else(|| "vi".into());777	let editor_args = shlex::bytes::split(editor.as_encoded_bytes())778		.ok_or_else(|| anyhow!("EDITOR env var has wrong syntax"))?;779	let editor_args = editor_args780		.into_iter()781		.map(|v| {782			// Only ASCII subsequences are replaced783			unsafe { OsString::from_encoded_bytes_unchecked(v) }784		})785		.collect_vec();786	let Some((editor, args)) = editor_args.split_first() else {787		bail!("EDITOR env var has no command");788	};789	let mut command = Command::new(editor);790	command.args(args);791792	let path_arg = abs_path.canonicalize()?;793794	// TODO: Save full state, using tcget/_getmode/_setmode795	let was_raw = terminal::is_raw_mode_enabled()?;796	terminal::enable_raw_mode()?;797798	let status = command.arg(path_arg).status().await;799800	if !was_raw {801		terminal::disable_raw_mode()?;802	}803804	let success = match status {805		Ok(s) => s.success(),806		Err(e) if e.kind() == io::ErrorKind::NotFound => {807			bail!("editor not found")808		}809		Err(e) => bail!("editor spawn error: {e}"),810	};811812	let mut file = std::fs::read(&abs_path).context("read editor output")?;813	let Some(v) = file.strip_prefix(full_header.as_bytes()) else {814		todo!();815	};816	todo!();817818	// Ok((success, abs_path))819}