git.delta.rocks / jrsonnet / refs/commits / 904d12180e52

1use crate::{2	better_nix_eval::Field,3	fleetdata::{FleetSecret, FleetSharedSecret, SecretData},4	host::Config,5	nix_go, nix_go_json,6};7use anyhow::{anyhow, bail, ensure, Context, Result};8use chrono::{DateTime, Utc};9use clap::Parser;10use futures::{StreamExt, TryStreamExt};11use itertools::Itertools;12use owo_colors::OwoColorize;13use std::{14	collections::HashSet,15	io::{self, Cursor, Read},16	path::PathBuf,17};18use tabled::{Table, Tabled};19use tokio::fs::read_to_string;20use tracing::{info, info_span, warn};2122#[derive(Parser)]23pub enum Secret {24	/// Force load host keys for all defined hosts25	ForceKeys,26	/// Add secret, data should be provided in stdin27	AddShared {28		/// Secret name29		name: String,30		/// Secret owners31		machines: Vec<String>,32		/// Override secret if already present33		#[clap(long)]34		force: bool,35		/// Secret public part36		#[clap(long)]37		public: Option<String>,38		/// Load public part from specified file39		#[clap(long)]40		public_file: Option<PathBuf>,4142		/// Create a notification on secret expiration43		#[clap(long)]44		expires_at: Option<DateTime<Utc>>,4546		/// Secret with this name already exists, override its value while keeping the same owners.47		#[clap(long)]48		re_add: bool,49	},50	/// Add secret, data should be provided in stdin51	Add {52		/// Secret name53		name: String,54		/// Secret owners55		machine: String,56		/// Override secret if already present57		#[clap(long)]58		force: bool,59		#[clap(long)]60		public: Option<String>,61		#[clap(long)]62		public_file: Option<PathBuf>,63	},64	/// Read secret from remote host, requires sudo on said host65	Read {66		name: String,67		machine: String,68		#[clap(long)]69		plaintext: bool,70	},71	UpdateShared {72		name: String,7374		#[clap(long)]75		machines: Option<Vec<String>>,7677		#[clap(long)]78		add_machines: Vec<String>,79		#[clap(long)]80		remove_machines: Vec<String>,8182		/// Which host should we use to decrypt83		#[clap(long)]84		prefer_identities: Vec<String>,85	},86	Regenerate {87		/// Which host should we use to decrypt, in case if reencryption is required, without88		/// regeneration89		#[clap(long)]90		prefer_identities: Vec<String>,91	},92	List {},93}9495async fn generate_shared(96	config: &Config,97	display_name: &str,98	secret: Field,99) -> Result<FleetSharedSecret> {100	Ok(if secret.has_field("generateImpure").await? {101		let config_field = &config.config_unchecked_field;102		let generate = nix_go!(secret.generateImpure);103		let owners: Vec<String> = nix_go_json!(secret.expectedOwners);104105		let on: String = nix_go_json!(generate.on);106		let call_package = nix_go!(107			config_field.buildableSystems(Obj {108				localSystem: { config.local_system.clone() }109			})[{ on }]110			.config111			.nixpkgs112			.resolvedPkgs113			.callPackage114		);115116		let host = config.host(&on).await?;117118		let generator = nix_go!(call_package(generate.generator)(Obj {}));119		let generator = generator.build().await?;120		let generator = generator121			.get("out")122			.ok_or_else(|| anyhow!("missing generateImpure out"))?;123		let generator = host.remote_derivation(generator).await?;124125		let mut recipients = String::new();126		for owner in &owners {127			let key = config.key(owner).await?;128			recipients.push_str(&format!("-r \"{key}\" "));129		}130		recipients.push_str("-e");131132		let out = host.mktemp_dir().await?;133134		let mut gen = host.cmd(generator).await?;135		gen.env("rageArgs", recipients).env("out", &out);136		gen.run().await?;137138		{139			let marker = host.read_file_text(format!("{out}/marker")).await?;140			ensure!(marker == "SUCCESS", "generation not succeeded");141		}142143		let public = host.read_file_text(format!("{out}/public")).await.ok();144		let secret = host.read_file_bin(format!("{out}/secret")).await.ok();145		if let Some(secret) = &secret {146			ensure!(147				age::Decryptor::new(Cursor::new(&secret)).is_ok(),148				"builder produced non-encrypted value as secret, this is highly insecure"149			);150		}151152		let created_at = host.read_file_value(format!("{out}/created_at")).await?;153		let expires_at = host.read_file_value(format!("{out}/expires_at")).await.ok();154155		FleetSharedSecret {156			owners,157			secret: FleetSecret {158				created_at,159				expires_at,160				public,161				secret: secret.map(SecretData),162			},163		}164	} else {165		bail!("no generator defined for {display_name}")166	})167}168169async fn parse_public(170	public: Option<String>,171	public_file: Option<PathBuf>,172) -> Result<Option<String>> {173	Ok(match (public, public_file) {174		(Some(v), None) => Some(v),175		(None, Some(v)) => Some(read_to_string(v).await?),176		(Some(_), Some(_)) => {177			bail!("only public or public_file should be set")178		}179		(None, None) => None,180	})181}182183fn parse_machines(184	initial: Vec<String>,185	machines: Option<Vec<String>>,186	mut add_machines: Vec<String>,187	mut remove_machines: Vec<String>,188) -> Result<Vec<String>> {189	if machines.is_none() && add_machines.is_empty() && remove_machines.is_empty() {190		bail!("no operation");191	}192193	let initial_machines = initial.clone();194	let mut target_machines = initial;195	info!("Currently encrypted for {initial_machines:?}");196197	// ensure!(machines.is_some() || !add_machines.is_empty() || )198	if let Some(machines) = machines {199		ensure!(200			add_machines.is_empty() && remove_machines.is_empty(),201			"can't combine --machines and --add-machines/--remove-machines"202		);203		let target = initial_machines.iter().collect::<HashSet<_>>();204		let source = machines.iter().collect::<HashSet<_>>();205		for removed in target.difference(&source) {206			remove_machines.push((*removed).clone());207		}208		for added in source.difference(&target) {209			add_machines.push((*added).clone());210		}211	}212213	for machine in &remove_machines {214		let mut removed = false;215		while let Some(pos) = target_machines.iter().position(|m| m == machine) {216			target_machines.swap_remove(pos);217			removed = true;218		}219		if !removed {220			warn!("secret is not enabled for {machine}");221		}222	}223	for machine in &add_machines {224		if target_machines.iter().any(|m| m == machine) {225			warn!("secret is already added to {machine}");226		} else {227			target_machines.push(machine.to_owned());228		}229	}230	if !remove_machines.is_empty() {231		// TODO: maybe force secret regeneration?232		// Not that useful without revokation.233		warn!("secret will not be regenerated for removed machines, and until host rebuild, they will still possess the ability to decode secret");234	}235	Ok(target_machines)236}237impl Secret {238	pub async fn run(self, config: &Config) -> Result<()> {239		match self {240			Secret::ForceKeys => {241				for host in config.list_hosts().await? {242					if config.should_skip(&host.name) {243						continue;244					}245					config.key(&host.name).await?;246				}247			}248			Secret::AddShared {249				mut machines,250				name,251				force,252				public,253				public_file,254				expires_at,255				re_add,256			} => {257				let exists = config.has_shared(&name);258				if exists && !force && !re_add {259					bail!("secret already defined");260				}261				if re_add {262					// Fixme: use clap to limit this usage263					ensure!(!force, "--force and --readd are not compatible");264					ensure!(exists, "secret doesn't exists");265					ensure!(266						machines.is_empty(),267						"you can't use machines argument for --readd"268					);269					let shared = config.shared_secret(&name)?;270					machines = shared.owners;271				}272273				let recipients = config274					.recipients(&machines.iter().map(String::as_str).collect_vec())275					.await?;276277				let secret = {278					let mut input = vec![];279					io::stdin().read_to_end(&mut input)?;280281					if input.is_empty() {282						None283					} else {284						Some(285							SecretData::encrypt(recipients, input)286								.ok_or_else(|| anyhow!("no recipients provided"))?,287						)288					}289				};290				let public = parse_public(public, public_file).await?;291				config.replace_shared(292					name,293					FleetSharedSecret {294						owners: machines,295						secret: FleetSecret {296							created_at: Utc::now(),297							expires_at,298							secret,299							public,300						},301					},302				);303			}304			Secret::Add {305				machine,306				name,307				force,308				public,309				public_file,310			} => {311				let recipient = config.recipient(&machine).await?;312313				let secret = {314					let mut input = vec![];315					io::stdin().read_to_end(&mut input)?;316					if input.is_empty() {317						bail!("no data provided")318					}319320					Some(SecretData::encrypt(vec![recipient], input).expect("recipient provided"))321				};322323				if config.has_secret(&machine, &name) && !force {324					bail!("secret already defined");325				}326				let public = parse_public(public, public_file).await?;327328				config.insert_secret(329					&machine,330					name,331					FleetSecret {332						created_at: Utc::now(),333						expires_at: None,334						secret,335						public,336					},337				);338			}339			#[allow(clippy::await_holding_refcell_ref)]340			Secret::Read {341				name,342				machine,343				plaintext,344			} => {345				let secret = config.host_secret(&machine, &name)?;346				let Some(secret) = secret.secret else {347					bail!("no secret {name}");348				};349				let host = config.host(&machine).await?;350				let data = host.decrypt(secret).await?;351				if plaintext {352					let s = String::from_utf8(data).context("output is not utf8")?;353					print!("{s}");354				} else {355					println!("{}", z85::encode(&data));356				}357			}358			Secret::UpdateShared {359				name,360				machines,361				add_machines,362				remove_machines,363				prefer_identities,364			} => {365				let mut secret = config.shared_secret(&name)?;366				if secret.secret.secret.is_none() {367					bail!("no secret");368				}369370				let initial_machines = secret.owners.clone();371				let target_machines = parse_machines(372					initial_machines.clone(),373					machines,374					add_machines,375					remove_machines,376				)?;377378				if target_machines.is_empty() {379					info!("no machines left for secret, removing it");380					config.remove_shared(&name);381					return Ok(());382				}383384				if target_machines == initial_machines {385					warn!("secret owners are already correct");386					return Ok(());387				}388389				let identity_holder = if !prefer_identities.is_empty() {390					prefer_identities391						.iter()392						.find(|i| initial_machines.iter().any(|s| s == *i))393				} else {394					secret.owners.first()395				};396				let Some(identity_holder) = identity_holder else {397					bail!("no available holder found");398				};399				let target_recipients = futures::stream::iter(&target_machines)400					.then(|m| async { config.key(m).await })401					.collect::<Vec<_>>()402					.await;403				let target_recipients =404					target_recipients.into_iter().collect::<Result<Vec<_>>>()?;405406				if let Some(data) = secret.secret.secret {407					let encrypted = config408						.reencrypt_on_host(identity_holder, data, target_recipients)409						.await?;410					secret.secret.secret = Some(encrypted);411				}412413				secret.owners = target_machines;414				config.replace_shared(name, secret);415			}416			Secret::Regenerate { prefer_identities } => {417				{418					let expected_shared_set = config419						.list_configured_shared()420						.await?421						.into_iter()422						.collect::<HashSet<_>>();423					let shared_set = config.list_shared().into_iter().collect::<HashSet<_>>();424					for removed in expected_shared_set.difference(&shared_set) {425						info!("generating secret: {removed}");426						let config_field = &config.config_unchecked_field;427						let config_field = nix_go!(config_field.configUnchecked);428						let secret = nix_go!(config_field.sharedSecrets[{ removed }]);429						let shared = generate_shared(config, removed, secret).await?;430						config.replace_shared(removed.to_string(), shared)431					}432				}433				let mut to_remove = Vec::new();434				for name in &config.list_shared() {435					info!("updating secret: {name}");436					let mut data = config.shared_secret(name)?;437					let config_field = &config.config_unchecked_field;438					let config_field = nix_go!(config_field.configUnchecked);439					let expected_owners: Vec<String> =440						nix_go_json!(config_field.sharedSecrets[{ name }].expectedOwners);441					if expected_owners.is_empty() {442						warn!("secret was removed from fleet config: {name}, removing from data");443						to_remove.push(name.to_string());444						continue;445					}446					let set = data.owners.iter().collect::<HashSet<_>>();447					let expected_set = expected_owners.iter().collect::<HashSet<_>>();448					let should_remove = set.difference(&expected_set).next().is_some();449					if set == expected_set {450						info!("secret data is ok");451						continue;452					}453454					let secret = nix_go!(config_field.sharedSecrets[{ name }]);455					let owner_dependent: bool = nix_go_json!(secret.ownerDependent);456					let regenerate_on_remove: bool = nix_go_json!(secret.regenerateOnOwnerRemoved);457					#[allow(clippy::nonminimal_bool)]458					if !owner_dependent && !(should_remove && regenerate_on_remove) {459						warn!("reencrypting secret '{name}' for new owner set");460						// TODO: force regeneration461						if should_remove {462							warn!("secret will not be regenerated for removed machines, and until host rebuild, they will still possess the ability to decode secret");463						}464465						let identity_holder = if !prefer_identities.is_empty() {466							prefer_identities467								.iter()468								.find(|i| data.owners.iter().any(|s| s == *i))469						} else {470							data.owners.first()471						};472						let Some(identity_holder) = identity_holder else {473							bail!("no available holder found");474						};475476						let target_recipients = futures::stream::iter(&expected_owners)477							.then(|m| async { config.key(m).await })478							.collect::<Vec<_>>()479							.await;480						let target_recipients =481							target_recipients.into_iter().collect::<Result<Vec<_>>>()?;482483						if let Some(secret) = data.secret.secret {484							let encrypted = config485								.reencrypt_on_host(identity_holder, secret, target_recipients)486								.await?;487488							data.secret.secret = Some(encrypted);489						}490						data.owners = expected_owners;491						config.replace_shared(name.to_owned(), data);492					} else {493						let shared = generate_shared(config, name, secret).await?;494						config.replace_shared(name.to_owned(), shared)495					}496				}497				for k in to_remove {498					config.remove_shared(&k);499				}500			}501			Secret::List {} => {502				let _span = info_span!("loading secrets").entered();503				let configured = config.list_configured_shared().await?;504				#[derive(Tabled)]505				struct SecretDisplay {506					#[tabled(rename = "Name")]507					name: String,508					#[tabled(rename = "Owners")]509					owners: String,510				}511				let mut table = vec![];512				for name in configured.iter().cloned() {513					let config = config.clone();514					let expected_owners = config.shared_secret_expected_owners(&name).await?;515					let data = config.shared_secret(&name)?;516					let owners = data517						.owners518						.iter()519						.map(|o| {520							if expected_owners.contains(o) {521								o.green().to_string()522							} else {523								o.red().to_string()524							}525						})526						.collect::<Vec<_>>();527					table.push(SecretDisplay {528						owners: owners.join(", "),529						name,530					})531				}532				info!("loaded\n{}", Table::new(table).to_string())533			}534		}535		Ok(())536	}537}