1use std::{2 env::current_dir,3 ffi::{OsStr, OsString},4 fmt::Display,5 io::Write,6 ops::Deref,7 path::PathBuf,8 str::FromStr,9 sync::{Arc, Mutex, MutexGuard, OnceLock},10};1112use anyhow::{anyhow, bail, Context, Result};13use clap::{ArgGroup, Parser};14use openssh::SessionBuilder;15use serde::de::DeserializeOwned;16use tempfile::NamedTempFile;1718use crate::{19 better_nix_eval::{Field, NixSessionPool},20 command::MyCommand,21 fleetdata::{FleetData, FleetSecret, FleetSharedSecret, SecretData},22 nix_go, nix_go_json,23};2425pub struct FleetConfigInternals {26 pub local_system: String,27 pub directory: PathBuf,28 pub opts: FleetOpts,29 pub data: Mutex<FleetData>,30 pub nix_args: Vec<OsString>,31 32 pub config_field: Field,33 34 pub config_unchecked_field: Field,3536 37 pub default_pkgs: Field,38}3940#[derive(Clone)]41pub struct Config(Arc<FleetConfigInternals>);4243impl Deref for Config {44 type Target = FleetConfigInternals;4546 fn deref(&self) -> &Self::Target {47 &self.048 }49}5051pub struct ConfigHost {52 config: Config,53 pub name: String,54 pub local: bool,55 pub session: OnceLock<Arc<openssh::Session>>,5657 pub nixos_config: Field,58}59impl ConfigHost {60 async fn open_session(&self) -> Result<Arc<openssh::Session>> {61 assert!(!self.local, "do not open ssh connection to local session");62 63 if let Some(session) = &self.session.get() {64 return Ok((*session).clone());65 };66 let session = SessionBuilder::default();6768 let session = session69 .connect(&self.name)70 .await71 .map_err(|e| anyhow!("ssh error while connecting to {}: {e}", self.name))?;72 let session = Arc::new(session);73 self.session.set(session.clone()).expect("TOCTOU happened");74 Ok(session)75 }76 pub async fn mktemp_dir(&self) -> Result<String> {77 let mut cmd = self.cmd("mktemp").await?;78 cmd.arg("-d");79 let path = cmd.run_string().await?;80 Ok(path.trim_end().to_owned())81 }82 pub async fn read_file_bin(&self, path: impl AsRef<OsStr>) -> Result<Vec<u8>> {83 let mut cmd = self.cmd("cat").await?;84 cmd.arg(path);85 cmd.run_bytes().await86 }87 pub async fn read_file_text(&self, path: impl AsRef<OsStr>) -> Result<String> {88 let mut cmd = self.cmd("cat").await?;89 cmd.arg(path);90 cmd.run_string().await91 }92 #[allow(dead_code)]93 pub async fn read_file_json<D: DeserializeOwned>(&self, path: impl AsRef<OsStr>) -> Result<D> {94 let text = self.read_file_text(path).await?;95 Ok(serde_json::from_str(&text)?)96 }97 pub async fn read_file_value<D: FromStr>(&self, path: impl AsRef<OsStr>) -> Result<D>98 where99 <D as FromStr>::Err: Display,100 {101 let text = self.read_file_text(path).await?;102 D::from_str(&text).map_err(|e| anyhow!("failed to parse value: {e}"))103 }104 pub async fn cmd(&self, cmd: impl AsRef<OsStr>) -> Result<MyCommand> {105 if self.local {106 Ok(MyCommand::new(cmd))107 } else {108 let session = self.open_session().await?;109 Ok(MyCommand::new_on(cmd, session))110 }111 }112113 pub async fn decrypt(&self, data: SecretData) -> Result<Vec<u8>> {114 let mut cmd = self.cmd("fleet-install-secrets").await?;115 cmd.arg("decrypt").eqarg("--secret", data.encode_z85());116 let encoded = cmd117 .sudo()118 .run_string()119 .await120 .context("failed to call remote host for decrypt")?;121 z85::decode(encoded.trim_end()).context("bad encoded data? outdated host?")122 }123 pub async fn reencrypt(&self, data: SecretData, targets: Vec<String>) -> Result<SecretData> {124 let mut cmd = self.cmd("fleet-install-secrets").await?;125 cmd.arg("reencrypt").eqarg("--secret", data.encode_z85());126 for target in targets {127 let key = self.config.key(&target).await?;128 cmd.eqarg("--targets", key);129 }130 let encoded = cmd131 .sudo()132 .run_string()133 .await134 .context("failed to call remote host for decrypt")?;135 SecretData::decode_z85(encoded.trim_end()).context("bad encoded data? outdated host?")136 }137 138 pub async fn remote_derivation(&self, path: &PathBuf) -> Result<PathBuf> {139 if self.local {140 141 return Ok(path.to_owned());142 }143 let mut nix = MyCommand::new("nix");144 nix.arg("copy")145 .arg("--substitute-on-destination")146 .comparg("--to", format!("ssh-ng://{}", self.name))147 .arg(path);148 nix.run_nix().await.context("nix copy")?;149 Ok(path.to_owned())150 }151 pub async fn systemctl_stop(&self, name: &str) -> Result<()> {152 let mut cmd = self.cmd("systemctl").await?;153 cmd.arg("stop").arg(name);154 cmd.sudo().run().await155 }156 pub async fn systemctl_start(&self, name: &str) -> Result<()> {157 let mut cmd = self.cmd("systemctl").await?;158 cmd.arg("start").arg(name);159 cmd.sudo().run().await160 }161162 pub async fn rm_file(&self, path: impl AsRef<OsStr>, sudo: bool) -> Result<()> {163 let mut cmd = self.cmd("rm").await?;164 cmd.arg("-f").arg(path);165 if sudo {166 cmd = cmd.sudo()167 }168 cmd.run().await169 }170171 pub async fn list_configured_secrets(&self) -> Result<Vec<String>> {172 let nixos = &self.nixos_config;173 let secrets = nix_go!(nixos.secrets);174 let mut out = Vec::new();175 for name in secrets.list_fields().await? {176 let secret = nix_go!(secrets[{ name }]);177 let is_shared: bool = nix_go_json!(secret.shared);178 if is_shared {179 continue;180 }181 out.push(name);182 }183 Ok(out)184 }185 pub async fn secret_field(&self, name: &str) -> Result<Field> {186 let nixos = &self.nixos_config;187 Ok(nix_go!(nixos.secrets[{ name }]))188 }189}190191impl Config {192 pub fn should_skip(&self, host: &str) -> bool {193 if !self.opts.skip.is_empty() {194 self.opts.skip.iter().any(|h| h as &str == host)195 } else if !self.opts.only.is_empty() {196 !self.opts.only.iter().any(|h| h as &str == host)197 } else {198 false199 }200 }201 pub fn is_local(&self, host: &str) -> bool {202 self.opts.localhost.as_ref().map(|s| s as &str) == Some(host)203 }204205 pub async fn host(&self, name: &str) -> Result<ConfigHost> {206 let config = &self.config_unchecked_field;207 let nixos_config = nix_go!(config.hosts[{ name }].nixosSystem.config);208 Ok(ConfigHost {209 config: self.clone(),210 name: name.to_owned(),211 local: self.is_local(name),212 session: OnceLock::new(),213 nixos_config,214 })215 }216 pub async fn list_hosts(&self) -> Result<Vec<ConfigHost>> {217 let config = &self.config_unchecked_field;218 let names = nix_go!(config.hosts).list_fields().await?;219 let mut out = vec![];220 for name in names {221 out.push(self.host(&name).await?);222 }223 Ok(out)224 }225 pub async fn system_config(&self, host: &str) -> Result<Field> {226 let fleet_field = &self.config_unchecked_field;227 Ok(nix_go!(fleet_field.hosts[{ host }].nixosSystem.config))228 }229230 pub(super) fn data(&self) -> MutexGuard<FleetData> {231 self.data.lock().unwrap()232 }233 pub(super) fn data_mut(&self) -> MutexGuard<FleetData> {234 self.data.lock().unwrap()235 }236 237 pub async fn list_configured_shared(&self) -> Result<Vec<String>> {238 let config_field = &self.config_unchecked_field;239 nix_go!(config_field.sharedSecrets).list_fields().await240 }241 242 pub fn list_shared(&self) -> Vec<String> {243 let data = self.data();244 data.shared_secrets.keys().cloned().collect()245 }246 pub fn has_shared(&self, name: &str) -> bool {247 let data = self.data();248 data.shared_secrets.contains_key(name)249 }250 pub fn replace_shared(&self, name: String, shared: FleetSharedSecret) {251 let mut data = self.data_mut();252 data.shared_secrets.insert(name.to_owned(), shared);253 }254 pub fn remove_shared(&self, secret: &str) {255 let mut data = self.data_mut();256 data.shared_secrets.remove(secret);257 }258259 pub fn list_secrets(&self, host: &str) -> Vec<String> {260 let data = self.data();261 let Some(secrets) = data.host_secrets.get(host) else {262 return Vec::new();263 };264 secrets.keys().cloned().collect()265 }266267 pub fn has_secret(&self, host: &str, secret: &str) -> bool {268 let data = self.data();269 let Some(host_secrets) = data.host_secrets.get(host) else {270 return false;271 };272 host_secrets.contains_key(secret)273 }274 pub fn insert_secret(&self, host: &str, secret: String, value: FleetSecret) {275 let mut data = self.data_mut();276 let host_secrets = data.host_secrets.entry(host.to_owned()).or_default();277 host_secrets.insert(secret, value);278 }279280 pub fn host_secret(&self, host: &str, secret: &str) -> Result<FleetSecret> {281 let data = self.data();282 let Some(host_secrets) = data.host_secrets.get(host) else {283 bail!("no secrets for machine {host}");284 };285 let Some(secret) = host_secrets.get(secret) else {286 bail!("machine {host} has no secret {secret}");287 };288 Ok(secret.clone())289 }290 pub fn shared_secret(&self, secret: &str) -> Result<FleetSharedSecret> {291 let data = self.data();292 let Some(secret) = data.shared_secrets.get(secret) else {293 bail!("no shared secret {secret}");294 };295 Ok(secret.clone())296 }297 pub async fn shared_secret_expected_owners(&self, secret: &str) -> Result<Vec<String>> {298 let config_field = &self.config_unchecked_field;299 Ok(nix_go_json!(300 config_field.sharedSecrets[{ secret }].expectedOwners301 ))302 }303304 pub fn save(&self) -> Result<()> {305 let mut tempfile = NamedTempFile::new_in(self.directory.clone())?;306 let data = nixlike::serialize(&self.data() as &FleetData)?;307 tempfile.write_all(308 format!(309 "# This file contains fleet state and shouldn't be edited by hand\n\n{}\n\n# vim: ts=2 et nowrap\n",310 data311 )312 .as_bytes(),313 )?;314 let mut fleet_data_path = self.directory.clone();315 fleet_data_path.push("fleet.nix");316 tempfile.persist(fleet_data_path)?;317 Ok(())318 }319}320321#[derive(Parser, Clone)]322#[clap(group = ArgGroup::new("target_hosts"))]323pub struct FleetOpts {324 325 #[clap(long, number_of_values = 1, group = "target_hosts")]326 only: Vec<String>,327328 329 #[clap(long, number_of_values = 1, group = "target_hosts")]330 skip: Vec<String>,331332 333 #[clap(long)]334 pub localhost: Option<String>,335336 337 338 #[clap(long, default_value = "detect")]339 pub local_system: String,340}341342impl FleetOpts {343 pub async fn build(mut self, nix_args: Vec<OsString>) -> Result<Config> {344 if self.localhost.is_none() {345 self.localhost346 .replace(hostname::get().unwrap().to_str().unwrap().to_owned());347 }348 let directory = current_dir()?;349350 let pool = NixSessionPool::new(directory.as_os_str().to_owned(), nix_args.clone()).await?;351 let root_field = pool.get().await?;352353 let builtins_field = Field::field(root_field.clone(), "builtins").await?;354 if self.local_system == "detect" {355 self.local_system = nix_go_json!(builtins_field.currentSystem);356 }357 let local_system = self.local_system.clone();358359 let fleet_root = Field::field(root_field, "fleetConfigurations").await?;360 let fleet_field = nix_go!(fleet_root.default);361362 let config_field = nix_go!(fleet_field.config);363 let config_unchecked_field = nix_go!(fleet_field.unchecked.config);364365 let import = nix_go!(builtins_field.import);366 let overlays = nix_go!(fleet_field.overlays);367 let nixpkgs = nix_go!(fleet_field.nixpkgs | import);368369 let default_pkgs = nix_go!(nixpkgs(Obj {370 overlays,371 system: { self.local_system.clone() },372 }));373374 let mut fleet_data_path = directory.clone();375 fleet_data_path.push("fleet.nix");376 let bytes = std::fs::read_to_string(fleet_data_path)?;377 let data = nixlike::parse_str(&bytes)?;378379 Ok(Config(Arc::new(FleetConfigInternals {380 opts: self,381 directory,382 data,383 local_system,384 nix_args,385 config_field,386 config_unchecked_field,387 default_pkgs,388 })))389 }390}