git.delta.rocks / jrsonnet / refs/commits / 7de62040eec5

1use std::{2	cell::OnceCell,3	collections::BTreeSet,4	ffi::{OsStr, OsString},5	fmt::Display,6	io::Write,7	ops::Deref,8	path::PathBuf,9	str::FromStr,10	sync::{Arc, Mutex, MutexGuard, OnceLock},11};1213use anyhow::{anyhow, bail, ensure, Context, Result};14use fleet_shared::SecretData;15use nix_eval::{nix_go, nix_go_json, util::assert_warn, NixSession, Value};16use openssh::SessionBuilder;17use serde::de::DeserializeOwned;18use tempfile::NamedTempFile;1920use crate::{21	command::MyCommand,22	fleetdata::{FleetData, FleetSecret, FleetSharedSecret},23};2425pub struct FleetConfigInternals {26	pub local_system: String,27	pub directory: PathBuf,28	pub data: Mutex<FleetData>,29	pub nix_args: Vec<OsString>,30	/// fleet_config.config31	pub config_field: Value,32	// TODO: Remove with connectivity refactor33	pub localhost: String,3435	/// import nixpkgs {system = local};36	pub default_pkgs: Value,3738	pub nix_session: NixSession,39}4041// TODO: Make field not pub42#[derive(Clone)]43pub struct Config(pub Arc<FleetConfigInternals>);4445impl Deref for Config {46	type Target = FleetConfigInternals;4748	fn deref(&self) -> &Self::Target {49		&self.050	}51}5253#[derive(Clone, Copy, Debug)]54pub enum EscalationStrategy {55	Sudo,56	Run0,57	Su,58}5960pub struct ConfigHost {61	config: Config,62	pub name: String,63	groups: OnceCell<Vec<String>>,6465	pub host_config: Option<Value>,66	pub nixos_config: OnceCell<Value>,67	pub pkgs_override: Option<Value>,6869	// TODO: Move command helpers away with connectivity refactor70	pub local: bool,71	pub session: OnceLock<Arc<openssh::Session>>,72}73// TODO: Move command helpers away with connectivity refactor74impl ConfigHost {75	pub async fn escalation_strategy(&self) -> Result<EscalationStrategy> {76		// Prefer sudo, as run0 has some gotchas with polkit77		// and too many repeating prompts.78		if (self.find_in_path("sudo").await).is_ok() {79			return Ok(EscalationStrategy::Sudo);80		}81		if (self.find_in_path("run0").await).is_ok() {82			return Ok(EscalationStrategy::Run0);83		}84		Ok(EscalationStrategy::Su)85	}86	async fn open_session(&self) -> Result<Arc<openssh::Session>> {87		assert!(!self.local, "do not open ssh connection to local session");88		// FIXME: TOCTOU89		if let Some(session) = &self.session.get() {90			return Ok((*session).clone());91		};92		let session = SessionBuilder::default();93		let session = session94			.connect(&self.name)95			.await96			.map_err(|e| anyhow!("ssh error while connecting to {}: {e}", self.name))?;97		let session = Arc::new(session);98		self.session.set(session.clone()).expect("TOCTOU happened");99		Ok(session)100	}101	pub async fn mktemp_dir(&self) -> Result<String> {102		let mut cmd = self.cmd("mktemp").await?;103		cmd.arg("-d");104		let path = cmd.run_string().await?;105		Ok(path.trim_end().to_owned())106	}107	pub async fn read_file_bin(&self, path: impl AsRef<OsStr>) -> Result<Vec<u8>> {108		let mut cmd = self.cmd("cat").await?;109		cmd.arg(path);110		cmd.run_bytes().await111	}112	pub async fn read_file_text(&self, path: impl AsRef<OsStr>) -> Result<String> {113		let mut cmd = self.cmd("cat").await?;114		cmd.arg(path);115		cmd.run_string().await116	}117	pub async fn read_dir(&self, path: impl AsRef<OsStr>) -> Result<Vec<String>> {118		let mut cmd = self.cmd("ls").await?;119		cmd.arg(path);120		let out = cmd.run_string().await?;121		let mut lines = out.split('\n');122		if let Some(last) = lines.next_back() {123			ensure!(last.is_empty(), "output of ls should end with newline");124		}125		Ok(lines.map(ToOwned::to_owned).collect())126	}127	#[allow(dead_code)]128	pub async fn read_file_json<D: DeserializeOwned>(&self, path: impl AsRef<OsStr>) -> Result<D> {129		let text = self.read_file_text(path).await?;130		Ok(serde_json::from_str(&text)?)131	}132	pub async fn read_env(&self, env: &str) -> Result<String> {133		let mut cmd = self.cmd("printenv").await?;134		cmd.arg(env);135		cmd.run_string().await136	}137	pub async fn find_in_path(&self, command: &str) -> Result<String> {138		// // `which` is not a part of coreutils, and it might not exist on machine.139		// let path = self.read_env("PATH").await?;140		// // Assuming delimiter is :, we don't work with windows host, this check will be much141		// // more sophisticated in remowt backend (and quicker, since actual PATH search will be done on remote machine)142		// for ele in path.split(':') {143		// 	let test_path = format!("{ele}/{cmd}");144		// 	test -x etc145		// }146		// let mut cmd = self.cmd("printenv").await?;147		// cmd.arg(env);148		// Ok(cmd.run_string().await?)149		// Assuming this is an environment issue if which doesn't exist, will be fixed with remowt.150		let mut cmd = self151			.cmd_escalation(152				// Not used153				EscalationStrategy::Su,154				"which",155			)156			.await?;157		cmd.arg(command);158		cmd.run_string().await159	}160	pub async fn read_file_value<D: FromStr>(&self, path: impl AsRef<OsStr>) -> Result<D>161	where162		<D as FromStr>::Err: Display,163	{164		let text = self.read_file_text(path).await?;165		D::from_str(&text).map_err(|e| anyhow!("failed to parse value: {e}"))166	}167	pub async fn cmd(&self, cmd: impl AsRef<OsStr>) -> Result<MyCommand> {168		self.cmd_escalation(self.escalation_strategy().await?, cmd)169			.await170	}171	pub async fn cmd_escalation(172		&self,173		escalation: EscalationStrategy,174		cmd: impl AsRef<OsStr>,175	) -> Result<MyCommand> {176		if self.local {177			Ok(MyCommand::new(escalation, cmd))178		} else {179			let session = self.open_session().await?;180			Ok(MyCommand::new_on(escalation, cmd, session))181		}182	}183184	pub async fn decrypt(&self, data: SecretData) -> Result<Vec<u8>> {185		ensure!(data.encrypted, "secret is not encrypted");186		let mut cmd = self.cmd("fleet-install-secrets").await?;187		cmd.arg("decrypt").eqarg("--secret", data.to_string());188		let encoded = cmd189			.sudo()190			.run_string()191			.await192			.context("failed to call remote host for decrypt")?;193		let data: SecretData = encoded.parse().map_err(|e| anyhow!("{e}"))?;194		ensure!(!data.encrypted, "secret came out encrypted");195		Ok(data.data)196	}197	pub async fn reencrypt(&self, data: SecretData, targets: Vec<String>) -> Result<SecretData> {198		ensure!(data.encrypted, "secret is not encrypted");199		let mut cmd = self.cmd("fleet-install-secrets").await?;200		cmd.arg("reencrypt").eqarg("--secret", data.to_string());201		for target in targets {202			let key = self.config.key(&target).await?;203			cmd.eqarg("--targets", key);204		}205		let encoded = cmd206			.sudo()207			.run_string()208			.await209			.context("failed to call remote host for decrypt")?;210		let data: SecretData = encoded.parse().map_err(|e| anyhow!("{e}"))?;211		ensure!(data.encrypted, "secret came out not encrypted");212		Ok(data)213	}214	/// Returns path for futureproofing, as path might change i.e on conversion to CA215	pub async fn remote_derivation(&self, path: &PathBuf) -> Result<PathBuf> {216		if self.local {217			// Path is located locally, thus already trusted.218			return Ok(path.to_owned());219		}220		let mut nix = MyCommand::new(221			// Not used222			EscalationStrategy::Su,223			"nix",224		);225		nix.arg("copy")226			.arg("--substitute-on-destination")227			.comparg("--to", format!("ssh-ng://{}", self.name))228			.arg(path);229		nix.run_nix().await.context("nix copy")?;230		Ok(path.to_owned())231	}232	pub async fn systemctl_stop(&self, name: &str) -> Result<()> {233		let mut cmd = self.cmd("systemctl").await?;234		cmd.arg("stop").arg(name);235		cmd.sudo().run().await236	}237	pub async fn systemctl_start(&self, name: &str) -> Result<()> {238		let mut cmd = self.cmd("systemctl").await?;239		cmd.arg("start").arg(name);240		cmd.sudo().run().await241	}242243	pub async fn rm_file(&self, path: impl AsRef<OsStr>, sudo: bool) -> Result<()> {244		let mut cmd = self.cmd("rm").await?;245		cmd.arg("-f").arg(path);246		if sudo {247			cmd = cmd.sudo()248		}249		cmd.run().await250	}251}252impl ConfigHost {253	// TOCTOU is possible here in case if config is changed, but this case is not handled anywhere anyway,254	// assuming getting tags always returns the same value.255	pub async fn tags(&self) -> Result<Vec<String>> {256		if let Some(v) = self.groups.get() {257			return Ok(v.clone());258		}259		let Some(host_config) = &self.host_config else {260			return Ok(vec![]);261		};262		let tags: Vec<String> = nix_go_json!(host_config.tags);263264		let _ = self.groups.set(tags.clone());265266		Ok(tags)267	}268	pub async fn nixos_config(&self) -> Result<Value> {269		if let Some(v) = self.nixos_config.get() {270			return Ok(v.clone());271		}272		let Some(host_config) = &self.host_config else {273			bail!("local host has no nixos_config");274		};275		let nixos_config = nix_go!(host_config.nixos.config);276		assert_warn("nixos config evaluation", &nixos_config).await?;277278		let _ = self.nixos_config.set(nixos_config.clone());279280		Ok(nixos_config)281	}282283	pub async fn list_configured_secrets(&self) -> Result<Vec<String>> {284		let nixos = self.nixos_config().await?;285		let secrets = nix_go!(nixos.secrets);286		let mut out = Vec::new();287		for name in secrets.list_fields().await? {288			let secret = nix_go!(secrets[{ name }]);289			let is_shared: bool = nix_go_json!(secret.shared);290			if is_shared {291				continue;292			}293			out.push(name);294		}295		Ok(out)296	}297	pub async fn secret_field(&self, name: &str) -> Result<Value> {298		let nixos = self.nixos_config().await?;299		Ok(nix_go!(nixos.secrets[{ name }]))300	}301302	/// Packages for this host, resolved with nixpkgs overlays303	pub async fn pkgs(&self) -> Result<Value> {304		if let Some(value) = &self.pkgs_override {305			return Ok(value.clone());306		}307		let Some(host_config) = &self.host_config else {308			bail!("local host has no host_config");309		};310		// TODO: Should nixos.options be cached?311		Ok(nix_go!(host_config.nixos.options._module.args.value.pkgs))312	}313}314315impl Config {316	pub async fn tagged_hostnames(&self, tag: &str) -> Result<Vec<String>> {317		let config = &self.config_field;318		let tagged: Vec<String> = nix_go_json!(config.taggedWith[{ tag }]);319		Ok(tagged)320	}321	pub async fn expand_owner_set(&self, owners: Vec<String>) -> Result<BTreeSet<String>> {322		let mut out = BTreeSet::new();323		for owner in owners {324			if let Some(tag) = owner.strip_prefix('@') {325				let hosts = self.tagged_hostnames(tag).await?;326				out.extend(hosts);327			} else {328				out.insert(owner);329			}330		}331		Ok(out)332	}333	pub fn local_host(&self) -> ConfigHost {334		ConfigHost {335			config: self.clone(),336			name: "<virtual localhost>".to_owned(),337			host_config: None,338			nixos_config: OnceCell::new(),339			groups: {340				let cell = OnceCell::new();341				let _ = cell.set(vec![]);342				cell343			},344			pkgs_override: Some(self.default_pkgs.clone()),345346			local: true,347			session: OnceLock::new(),348		}349	}350351	pub async fn host(&self, name: &str) -> Result<ConfigHost> {352		let config = &self.config_field;353		let host_config = nix_go!(config.hosts[{ name }]);354355		Ok(ConfigHost {356			config: self.clone(),357			name: name.to_owned(),358			host_config: Some(host_config),359			nixos_config: OnceCell::new(),360			groups: OnceCell::new(),361			pkgs_override: None,362363			// TODO: Remove with connectivit refactor364			local: self.localhost == name,365			session: OnceLock::new(),366		})367	}368	pub async fn list_hosts(&self) -> Result<Vec<ConfigHost>> {369		let config = &self.config_field;370		let names = nix_go!(config.hosts).list_fields().await?;371		let mut out = vec![];372		for name in names {373			out.push(self.host(&name).await?);374		}375		Ok(out)376	}377	// TODO: Replace usages with .host().nixos_config378	pub async fn system_config(&self, host: &str) -> Result<Value> {379		let fleet_field = &self.config_field;380		Ok(nix_go!(fleet_field.hosts[{ host }].nixos.config))381	}382383	/// Shared secrets configured in fleet.nix or in flake384	pub async fn list_configured_shared(&self) -> Result<Vec<String>> {385		let config_field = &self.config_field;386		Ok(nix_go!(config_field.sharedSecrets).list_fields().await?)387	}388	/// Shared secrets configured in fleet.nix389	pub fn list_shared(&self) -> Vec<String> {390		let data = self.data();391		data.shared_secrets.keys().cloned().collect()392	}393	pub fn has_shared(&self, name: &str) -> bool {394		let data = self.data();395		data.shared_secrets.contains_key(name)396	}397	pub fn replace_shared(&self, name: String, shared: FleetSharedSecret) {398		let mut data = self.data_mut();399		data.shared_secrets.insert(name.to_owned(), shared);400	}401	pub fn remove_shared(&self, secret: &str) {402		let mut data = self.data_mut();403		data.shared_secrets.remove(secret);404	}405406	pub fn list_secrets(&self, host: &str) -> Vec<String> {407		let data = self.data();408		let Some(secrets) = data.host_secrets.get(host) else {409			return Vec::new();410		};411		secrets.keys().cloned().collect()412	}413414	pub fn has_secret(&self, host: &str, secret: &str) -> bool {415		let data = self.data();416		let Some(host_secrets) = data.host_secrets.get(host) else {417			return false;418		};419		host_secrets.contains_key(secret)420	}421	pub fn insert_secret(&self, host: &str, secret: String, value: FleetSecret) {422		let mut data = self.data_mut();423		let host_secrets = data.host_secrets.entry(host.to_owned()).or_default();424		host_secrets.insert(secret, value);425	}426427	pub fn host_secret(&self, host: &str, secret: &str) -> Result<FleetSecret> {428		let data = self.data();429		let Some(host_secrets) = data.host_secrets.get(host) else {430			bail!("no secrets for machine {host}");431		};432		let Some(secret) = host_secrets.get(secret) else {433			bail!("machine {host} has no secret {secret}");434		};435		Ok(secret.clone())436	}437	pub fn shared_secret(&self, secret: &str) -> Result<FleetSharedSecret> {438		let data = self.data();439		let Some(secret) = data.shared_secrets.get(secret) else {440			bail!("no shared secret {secret}");441		};442		Ok(secret.clone())443	}444	pub async fn shared_secret_expected_owners(&self, secret: &str) -> Result<Vec<String>> {445		let config_field = &self.config_field;446		Ok(nix_go_json!(447			config_field.sharedSecrets[{ secret }].expectedOwners448		))449	}450451	// TODO: Should this be something modifiable from other processes?452	// E.g terraform provider might want to update FleetData (e.g secrets),453	// and current implementation assumes only one process holds current fleet.nix454	// Given that it is no longer needs to be a file for nix evaluation,455	// maybe it can be a .nix file for persistence, but accessible only456	// thru some shared state controller? Might it be stored in terraform457	// state provider?458	pub fn data(&self) -> MutexGuard<FleetData> {459		self.data.lock().unwrap()460	}461	pub fn data_mut(&self) -> MutexGuard<FleetData> {462		self.data.lock().unwrap()463	}464	pub fn save(&self) -> Result<()> {465		let mut tempfile = NamedTempFile::new_in(self.directory.clone()).context("failed to create updated version of fleet.nix in the same directory as original.\nDo you have write access to it? Access only to the fleet.nix won't be enough, the directory is used for atomic overwrite operation.\nIt is not recommended to use fleet by root anyway, move fleet project to your home directory.")?;466		let data = nixlike::serialize(&self.data() as &FleetData)?;467		tempfile.write_all(468			format!(469				"# This file contains fleet state and shouldn't be edited by hand\n\n{}\n\n# vim: ts=2 et nowrap\n",470				data471			)472			.as_bytes(),473		)?;474		let mut fleet_data_path = self.directory.clone();475		fleet_data_path.push("fleet.nix");476		tempfile.persist(fleet_data_path)?;477		Ok(())478	}479}