git.delta.rocks / jrsonnet / refs/commits / a369041a95eb

1use crate::{2	command::MyCommand,3	fleetdata::{FleetSecret, FleetSharedSecret},4	host::Config,5	nix_go, nix_go_json,6};7use anyhow::{anyhow, bail, ensure, Context, Result};8use chrono::{DateTime, Utc};9use clap::Parser;10use futures::{StreamExt, TryStreamExt};11use owo_colors::OwoColorize;12use std::{13	collections::HashSet,14	io::{self, Cursor, Read},15	path::PathBuf,16	sync::Arc,17};18use tabled::{Table, Tabled};19use tokio::fs::read_to_string;20use tracing::{error, info, info_span, warn};2122#[derive(Parser)]23pub enum Secret {24	/// Force load host keys for all defined hosts25	ForceKeys,26	/// Add secret, data should be provided in stdin27	AddShared {28		/// Secret name29		name: String,30		/// Secret owners31		machines: Vec<String>,32		/// Override secret if already present33		#[clap(long)]34		force: bool,35		/// Secret public part36		#[clap(long)]37		public: Option<String>,38		/// Load public part from specified file39		#[clap(long)]40		public_file: Option<PathBuf>,4142		/// Create a notification on secret expiration43		#[clap(long)]44		expires_at: Option<DateTime<Utc>>,4546		/// Secret with this name already exists, override its value while keeping the same owners.47		#[clap(long)]48		re_add: bool,49	},50	/// Add secret, data should be provided in stdin51	Add {52		/// Secret name53		name: String,54		/// Secret owners55		machine: String,56		/// Override secret if already present57		#[clap(long)]58		force: bool,59		#[clap(long)]60		public: Option<String>,61		#[clap(long)]62		public_file: Option<PathBuf>,63	},64	/// Read secret from remote host, requires sudo on said host65	Read {66		name: String,67		machine: String,68		#[clap(long)]69		plaintext: bool,70	},71	UpdateShared {72		name: String,7374		#[clap(long)]75		machines: Option<Vec<String>>,7677		#[clap(long)]78		add_machines: Vec<String>,79		#[clap(long)]80		remove_machines: Vec<String>,8182		/// Which host should we use to decrypt83		#[clap(long)]84		prefer_identities: Vec<String>,85	},86	Regenerate {87		/// Which host should we use to decrypt, in case if reencryption is required, without88		/// regeneration89		#[clap(long)]90		prefer_identities: Vec<String>,91	},92	List {},93	InvokeGenerator,94}9596impl Secret {97	pub async fn run(self, config: &Config) -> Result<()> {98		match self {99			Secret::InvokeGenerator => {100				let config_field = &config.config_unchecked_field;101102				let secret =103					nix_go!(config_field.configUnchecked.sharedSecrets["kube-apiserver.pem"]);104				let generate_impure = nix_go!(secret.generateImpure);105				let on = nix_go!(generate_impure.on);106				let call_package = nix_go!(107					config_field.buildableSystems(Obj {108						localSystem: { config.local_system.clone() }109					})[on]110						.config111						.nixpkgs112						.resolvedPkgs113						.callPackage114				);115				let generator = nix_go!(call_package(generate_impure.generator)(Obj {}));116				let built = &generator.build().await?["out"];117				let mut nix = MyCommand::new("nix");118				let on: String = on.as_json().await?;119				nix.arg("copy")120					.arg("--substitute-on-destination")121					.comparg("--to", format!("ssh-ng://{on}"))122					.arg(built);123				nix.run_nix().await?;124125				let session = config.host(&on).await?;126127				let owners: Vec<String> = nix_go_json!(secret.expectedOwners);128				dbg!(&owners);129130				let mut recipients = String::new();131				for owner in owners {132					let key = config.key(&owner).await?;133					recipients.push_str(&format!("-r \"{key}\" "));134				}135				recipients.push_str("-e");136137				// FIXME: security: created directory might be accessible to other users138				// This shouldn't be much of a concern, as data is encrypted right after creation, yet139				// still better to have.140				let tempdir = session.mktemp_dir().await?;141142				let mut gen = session.cmd(built).await?;143				gen.env("rageArgs", recipients).env("out", &tempdir);144				gen.run().await?;145146				{147					let marker = session.read_file_text(format!("{tempdir}/marker")).await?;148					ensure!(marker == "SUCCESS", "generation not succeeded");149				}150151				let public = session152					.read_file_bin(format!("{tempdir}/public"))153					.await154					.ok();155				let secret = session156					.read_file_bin(format!("{tempdir}/secret"))157					.await158					.ok();159				if let Some(secret) = &secret {160					ensure!(161						age::Decryptor::new(Cursor::new(&secret)).is_ok(),162						"builder produced non-encrypted value as secret, this is highly insecure"163					);164				}165				dbg!(&secret);166				// // .as_json().await?;167				// dbg!(&built);168			}169			Secret::ForceKeys => {170				for host in config.list_hosts().await? {171					if config.should_skip(&host.name) {172						continue;173					}174					config.key(&host.name).await?;175				}176			}177			Secret::AddShared {178				mut machines,179				name,180				force,181				public,182				public_file,183				expires_at,184				re_add,185			} => {186				let exists = config.has_shared(&name);187				if exists && !force && !re_add {188					bail!("secret already defined");189				}190				if re_add {191					// Fixme: use clap to limit this usage192					ensure!(!force, "--force and --readd are not compatible");193					ensure!(exists, "secret doesn't exists");194					ensure!(195						machines.is_empty(),196						"you can't use machines argument for --readd"197					);198					let shared = config.shared_secret(&name)?;199					machines = shared.owners;200				}201202				let recipients = futures::stream::iter(machines.iter())203					.then(|m| config.recipient(m))204					.try_collect::<Vec<_>>()205					.await?;206207				let secret = {208					let mut input = vec![];209					io::stdin().read_to_end(&mut input)?;210211					if input.is_empty() {212						input213					} else {214						let mut encrypted = vec![];215						let recipients = recipients216							.iter()217							.cloned()218							.map(|r| Box::new(r) as Box<dyn age::Recipient + Send>)219							.collect();220						let mut encryptor = age::Encryptor::with_recipients(recipients)221							.ok_or_else(|| anyhow!("no recipients provided"))?222							.wrap_output(&mut encrypted)?;223						io::copy(&mut Cursor::new(input), &mut encryptor)?;224						encryptor.finish()?;225						encrypted226					}227				};228				config.replace_shared(229					name,230					FleetSharedSecret {231						owners: machines,232						secret: FleetSecret {233							created_at: Utc::now(),234							expires_at,235							secret,236							public: match (public, public_file) {237								(Some(v), None) => Some(v),238								(None, Some(v)) => Some(read_to_string(v).await?),239								(Some(_), Some(_)) => {240									bail!("only public or public_file should be set")241								}242								(None, None) => None,243							},244						},245					},246				);247			}248			Secret::Add {249				machine,250				name,251				force,252				public,253				public_file,254			} => {255				let recipient = config.recipient(&machine).await?;256257				let secret = {258					let mut input = vec![];259					io::stdin().read_to_end(&mut input)?;260					if input.is_empty() {261						bail!("no data provided")262					}263264					let mut encrypted = vec![];265					let recipient = Box::new(recipient) as Box<dyn age::Recipient + Send>;266					let mut encryptor = age::Encryptor::with_recipients(vec![recipient])267						.expect("recipients provided")268						.wrap_output(&mut encrypted)?;269					io::copy(&mut Cursor::new(input), &mut encryptor)?;270					encryptor.finish()?;271					encrypted272				};273274				if config.has_secret(&machine, &name) && !force {275					bail!("secret already defined");276				}277				config.insert_secret(278					&machine,279					name,280					FleetSecret {281						created_at: Utc::now(),282						expires_at: None,283						secret,284						public: match (public, public_file) {285							(Some(v), None) => Some(v),286							(None, Some(v)) => Some(std::fs::read_to_string(v)?),287							(Some(_), Some(_)) => bail!("only public or public_file should be set"),288							(None, None) => None,289						},290					},291				);292			}293			// TODO: Instead of using sudo, decode secret on remote machine294			#[allow(clippy::await_holding_refcell_ref)]295			Secret::Read {296				name,297				machine,298				plaintext,299			} => {300				let secret = config.host_secret(&machine, &name)?;301				if secret.secret.is_empty() {302					bail!("no secret {name}");303				}304				let host = config.host(&machine).await?;305				let data = host.decrypt(secret.secret).await?;306				if plaintext {307					let s = String::from_utf8(data).context("output is not utf8")?;308					print!("{s}");309				} else {310					println!("{}", z85::encode(&data));311				}312			}313			Secret::UpdateShared {314				name,315				machines,316				mut add_machines,317				mut remove_machines,318				prefer_identities,319			} => {320				if machines.is_none() && add_machines.is_empty() && remove_machines.is_empty() {321					bail!("no operation");322				}323324				let mut secret = config.shared_secret(&name)?;325				if secret.secret.secret.is_empty() {326					bail!("no secret");327				}328329				let initial_machines = secret.owners.clone();330				let mut target_machines = secret.owners.clone();331				info!("Currently encrypted for {initial_machines:?}");332333				// ensure!(machines.is_some() || !add_machines.is_empty() || )334				if let Some(machines) = machines {335					ensure!(336						add_machines.is_empty() && remove_machines.is_empty(),337						"can't combine --machines and --add-machines/--remove-machines"338					);339					let target = initial_machines.iter().collect::<HashSet<_>>();340					let source = machines.iter().collect::<HashSet<_>>();341					for removed in target.difference(&source) {342						remove_machines.push((*removed).clone());343					}344					for added in source.difference(&target) {345						add_machines.push((*added).clone());346					}347				}348349				for machine in &remove_machines {350					let mut removed = false;351					while let Some(pos) = target_machines.iter().position(|m| m == machine) {352						target_machines.swap_remove(pos);353						removed = true;354					}355					if !removed {356						warn!("secret is not enabled for {machine}");357					}358				}359				for machine in &add_machines {360					if target_machines.iter().any(|m| m == machine) {361						warn!("secret is already added to {machine}");362					} else {363						target_machines.push(machine.to_owned());364					}365				}366				if !remove_machines.is_empty() {367					warn!("secret will not be regenerated for removed machines, and until host rebuild, they will still possess the ability to decode secret");368				}369370				if target_machines.is_empty() {371					info!("no machines left for secret, removing it");372					config.remove_shared(&name);373					return Ok(());374				}375376				if target_machines == initial_machines {377					warn!("secret owners are already correct");378					return Ok(());379				}380381				let identity_holder = if !prefer_identities.is_empty() {382					prefer_identities383						.iter()384						.find(|i| initial_machines.iter().any(|s| s == *i))385				} else {386					secret.owners.first()387				};388				let Some(identity_holder) = identity_holder else {389					bail!("no available holder found");390				};391				let target_recipients = futures::stream::iter(&target_machines)392					.then(|m| async { config.key(m).await })393					.collect::<Vec<_>>()394					.await;395				let target_recipients =396					target_recipients.into_iter().collect::<Result<Vec<_>>>()?;397398				let encrypted = config399					.reencrypt_on_host(identity_holder, secret.secret.secret, target_recipients)400					.await?;401402				secret.owners = target_machines;403				secret.secret.secret = encrypted;404				config.replace_shared(name, secret);405			}406			Secret::Regenerate { prefer_identities } => {407				{408					let expected_shared_set = config409						.list_configured_shared()410						.await?411						.into_iter()412						.collect::<HashSet<_>>();413					let shared_set = config.list_shared().into_iter().collect::<HashSet<_>>();414					for removed in expected_shared_set.difference(&shared_set) {415						error!("secret needs to be generated: {removed}")416					}417				}418				let mut to_remove = Vec::new();419				for name in &config.list_shared() {420					info!("updating secret: {name}");421					let mut data = config.shared_secret(name)?;422					let config_field = &config.config_field;423					let expected_owners: Vec<String> =424						nix_go_json!(config_field.sharedSecrets[{ name }].expectedOwners);425					if expected_owners.is_empty() {426						warn!("secret was removed from fleet config: {name}, removing from data");427						to_remove.push(name.to_string());428						continue;429					}430					let set = data.owners.iter().collect::<HashSet<_>>();431					let expected_set = expected_owners.iter().collect::<HashSet<_>>();432					let should_remove = set.difference(&expected_set).next().is_some();433					if set != expected_set {434						let owner_dependent: bool =435							nix_go_json!(config_field.sharedSecrets[{ name }].ownerDependent);436						if !owner_dependent {437							warn!("reencrypting secret '{name}' for new owner set");438							// TODO: force regeneration439							if should_remove {440								warn!("secret will not be regenerated for removed machines, and until host rebuild, they will still possess the ability to decode secret");441							}442443							let identity_holder = if !prefer_identities.is_empty() {444								prefer_identities445									.iter()446									.find(|i| data.owners.iter().any(|s| s == *i))447							} else {448								data.owners.first()449							};450							let Some(identity_holder) = identity_holder else {451								bail!("no available holder found");452							};453454							let target_recipients = futures::stream::iter(&expected_owners)455								.then(|m| async { config.key(m).await })456								.collect::<Vec<_>>()457								.await;458							let target_recipients =459								target_recipients.into_iter().collect::<Result<Vec<_>>>()?;460461							let encrypted = config462								.reencrypt_on_host(463									identity_holder,464									data.secret.secret,465									target_recipients,466								)467								.await?;468469							data.secret.secret = encrypted;470							data.owners = expected_owners;471							config.replace_shared(name.to_owned(), data);472						} else {473							error!("secret '{name}' should be regenerated manually");474						}475					} else {476						info!("secret data is ok")477					}478				}479				for k in to_remove {480					config.remove_shared(&k);481				}482			}483			Secret::List {} => {484				let _span = info_span!("loading secrets").entered();485				let configured = config.list_configured_shared().await?;486				#[derive(Tabled)]487				struct SecretDisplay {488					#[tabled(rename = "Name")]489					name: String,490					#[tabled(rename = "Owners")]491					owners: String,492				}493				let mut table = vec![];494				for name in configured.iter().cloned() {495					let config = config.clone();496					let expected_owners = config.shared_secret_expected_owners(&name).await?;497					let data = config.shared_secret(&name)?;498					let owners = data499						.owners500						.iter()501						.map(|o| {502							if expected_owners.contains(o) {503								o.green().to_string()504							} else {505								o.red().to_string()506							}507						})508						.collect::<Vec<_>>();509					table.push(SecretDisplay {510						owners: owners.join(", "),511						name,512					})513				}514				info!("loaded\n{}", Table::new(table).to_string())515			}516		}517		Ok(())518	}519}