From 757475fe4caba2693929af9cd30658ca1bb5a357 Mon Sep 17 00:00:00 2001 From: Yaroslav Bolyukin Date: Tue, 29 Jul 2025 20:41:05 +0000 Subject: [PATCH] feat: manager identities --- --- a/Cargo.lock +++ b/Cargo.lock @@ -92,6 +92,8 @@ "scrypt", "sha2", "subtle", + "which", + "wsl", "x25519-dalek", "zeroize", ] @@ -111,6 +113,7 @@ "rand 0.8.5", "secrecy", "sha2", + "tempfile", ] [[package]] @@ -1286,6 +1289,15 @@ ] [[package]] +name = "home" +version = "0.5.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "589533453244b0995c858700322199b2becb13b627df2851f64a2775d024abcf" +dependencies = [ + "windows-sys 0.59.0", +] + +[[package]] name = "hostname" version = "0.4.1" source = "registry+https://github.com/rust-lang/crates.io-index" @@ -3639,6 +3651,18 @@ ] [[package]] +name = "which" +version = "4.4.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "87ba24419a2078cd2b0f2ede2691b6c66d8e47836da3b6db8265ebad47afbfc7" +dependencies = [ + "either", + "home", + "once_cell", + "rustix 0.38.40", +] + +[[package]] name = "winapi" version = "0.3.9" source = "registry+https://github.com/rust-lang/crates.io-index" @@ -3776,6 +3800,12 @@ ] [[package]] +name = "wsl" +version = "0.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f8dab7ac864710bdea6594becbea5b5050333cf34fefb0dc319567eb347950d4" + +[[package]] name = "x25519-dalek" version = "2.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" --- a/Cargo.toml +++ b/Cargo.toml @@ -11,7 +11,7 @@ nix-eval = { path = "./crates/nix-eval" } nixlike = { path = "./crates/nixlike" } -age = { version = "0.11", features = ["ssh"] } +age = { version = "0.11", features = ["ssh", "plugin"] } anyhow = "1.0" clap = { version = "4.5", features = ["derive", "env", "unicode", "wrap_help"] } clap_complete = "4.5" --- a/cmds/fleet/src/cmds/secrets/mod.rs +++ b/cmds/fleet/src/cmds/secrets/mod.rs @@ -23,6 +23,7 @@ #[derive(Parser)] pub enum Secret { + AddManager, /// Force load host keys for all defined hosts ForceKeys, /// Add secret, data should be provided in stdin @@ -521,6 +522,9 @@ impl Secret { pub async fn run(self, config: &Config, opts: &FleetOpts) -> Result<()> { match self { + Secret::AddManager => { + todo!("part of fleet-pusher") + } Secret::ForceKeys => { for host in config.list_hosts().await? { if opts.should_skip(&host).await? { --- a/crates/fleet-base/src/fleetdata.rs +++ b/crates/fleet-base/src/fleetdata.rs @@ -53,12 +53,22 @@ #[derive(Serialize, Deserialize)] #[serde(rename_all = "camelCase")] +pub struct ManagerKey { + pub name: String, + pub key: String, +} + +#[derive(Serialize, Deserialize)] +#[serde(rename_all = "camelCase")] pub struct FleetData { pub version: FleetDataVersion, #[serde(default = "generate_gc_prefix")] pub gc_root_prefix: String, #[serde(default)] + pub manager_keys: Vec, + + #[serde(default)] pub hosts: BTreeMap, #[serde(default)] #[serde(skip_serializing_if = "BTreeMap::is_empty")] --- a/flake.lock +++ b/flake.lock @@ -2,11 +2,11 @@ "nodes": { "crane": { "locked": { - "lastModified": 1750266157, - "narHash": "sha256-tL42YoNg9y30u7zAqtoGDNdTyXTi8EALDeCB13FtbQA=", + "lastModified": 1753316655, + "narHash": "sha256-tzWa2kmTEN69OEMhxFy+J2oWSvZP5QhEgXp3TROOzl0=", "owner": "ipetkov", "repo": "crane", - "rev": "e37c943371b73ed87faf33f7583860f81f1d5a48", + "rev": "f35a3372d070c9e9ccb63ba7ce347f0634ddf3d2", "type": "github" }, "original": { @@ -22,11 +22,11 @@ ] }, "locked": { - "lastModified": 1749398372, - "narHash": "sha256-tYBdgS56eXYaWVW3fsnPQ/nFlgWi/Z2Ymhyu21zVM98=", + "lastModified": 1753121425, + "narHash": "sha256-TVcTNvOeWWk1DXljFxVRp+E0tzG1LhrVjOGGoMHuXio=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "9305fe4e5c2a6fcf5ba6a3ff155720fbe4076569", + "rev": "644e0fc48951a860279da645ba77fe4a6e814c5e", "type": "github" }, "original": { @@ -37,11 +37,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1750895632, - "narHash": "sha256-EPZWiRmaSTxoBArK5dQyRlSNVLXiBt2hmsYIPgMf3zk=", + "lastModified": 1753320130, + "narHash": "sha256-KCuv6iYQ0XTVAEJvDLIsk99CJm7fuqIE0/KknyeYPtM=", "owner": "nixos", "repo": "nixpkgs", - "rev": "6ac57ce7fee0d80226095a57ccb7519855ad7c5e", + "rev": "788cc7374af486168b8aab6ca49e316c03508a86", "type": "github" }, "original": { @@ -68,11 +68,11 @@ ] }, "locked": { - "lastModified": 1750819193, - "narHash": "sha256-XvkupGPZqD54HuKhN/2WhbKjAHeTl1UEnWspzUzRFfA=", + "lastModified": 1753238793, + "narHash": "sha256-jmQeEpgX+++MEgrcikcwoSiI7vDZWLP0gci7XiWb9uQ=", "owner": "oxalica", "repo": "rust-overlay", - "rev": "1ba3b9c59b68a4b00156827ad46393127b51b808", + "rev": "0ad7ab4ca8e83febf147197e65c006dff60623ab", "type": "github" }, "original": { @@ -103,11 +103,11 @@ ] }, "locked": { - "lastModified": 1749194973, - "narHash": "sha256-eEy8cuS0mZ2j/r/FE0/LYBSBcIs/MKOIVakwHVuqTfk=", + "lastModified": 1753006367, + "narHash": "sha256-tzbhc4XttkyEhswByk5R38l+ztN9UDbnj0cTcP6Hp9A=", "owner": "numtide", "repo": "treefmt-nix", - "rev": "a05be418a1af1198ca0f63facb13c985db4cb3c5", + "rev": "421b56313c65a0815a52b424777f55acf0b56ddf", "type": "github" }, "original": { --- a/modules/secrets-data.nix +++ b/modules/secrets-data.nix @@ -94,12 +94,28 @@ }; config = { }; }; + managerKey = { + options = { + name = mkOption { + type = str; + description = "Who does this manager key belongs to."; + }; + key = mkOption { + type = str; + description = "Age-compatible key"; + }; + }; + config = {}; + }; in { options.data = mkDataOption ( { config, ... }: { options = { + managerKeys = mkOption { + type = listOf (submodule managerKey); + }; sharedSecrets = mkOption { type = attrsOf (submodule sharedSecretData); default = { }; --- a/rust-toolchain.toml +++ b/rust-toolchain.toml @@ -1,3 +1,3 @@ [toolchain] -channel = "1.86.0" +channel = "nightly-2025-06-10" components = ["rustfmt", "clippy", "rust-analyzer", "rust-src"] -- gitstuff