git.delta.rocks / jrsonnet / refs/commits / cc4ecd613a27

1432name = "nix-eval"1432name = "nix-eval"
1433version = "0.1.0"1433version = "0.1.0"
1434dependencies = [1434dependencies = [
1435 "anyhow",
1435 "better-command",1436 "better-command",
1436 "futures",1437 "futures",
1437 "itertools",1438 "itertools",

24      url = "github:CertainLach/fleet";24      url = "github:CertainLach/fleet";
25      inputs.nixpkgs.follows = "nixpkgs";25      inputs.nixpkgs.follows = "nixpkgs";
26    };26    };
27    flake-parts.url = "github:hercules-ci/flake-parts";
27    lanzaboote = {28    lanzaboote = {
28      url = "github:nix-community/lanzaboote/v0.3.0";29      url = "github:nix-community/lanzaboote/v0.3.0";
29      inputs.nixpkgs.follows = "nixpkgs";30      inputs.nixpkgs.follows = "nixpkgs";
30    };31    };
31  };32  };
32  outputs = {33  outputs = inputs: flake-parts.lib.mkFlake { inherit inputs; } {
33    nixpkgs,
34    fleet,
35    lanzaboote,
36    ...
37  }: {
38    # TODO: This section of documentation needs to use flake-utils.
39    formatter.x86_64-linux = let
40      pkgs = import nixpkgs {system = "x86_64-linux";};
41    in
42      pkgs.alejandra;34    imports = [inputs.fleet.flakeModules.default];
4335
44    devShell.x86_64-linux = let36    perSystem = {pkgs, system, ...}: {
45      pkgs = import nixpkgs {37      _module.args.pkgs = import nixpkgs { inherit system; };
46        system = "x86_64-linux";38
47      };39      formatter = pkgs.alejandra;
48    in40      devShells.default = pkgs.mkShell {
49      pkgs.mkShell {
50        buildInputs = with pkgs; [41        packages = [
51          fleet.packages.x86_64-linux.fleet42          inputs.fleet.packages.${system}.fleet
52        ];43        ];
53      };44      };
45    };
5446
55    # Single flake may contain multiple fleet configurations, default one is called... `default`47    # Single flake may contain multiple fleet configurations, default one is called... `default`
56    fleetConfigurations.default = fleet.lib.fleetConfiguration {48    fleetConfigurations.default = {
57      # nixpkgs used to build the systems49      # nixpkgs used to build the systems
58      inherit nixpkgs;50      nixpkgs.buildUsing = nixpkgs;
59      # fleet wants to pass some data, like secrets, to do that - fleet writes all the encrypted secrets to fleet.nix
60      # treat the contents of this file as implementation detail
61      data = import ./fleet.nix;
62      51      
63      # nixosModules section of fleet config declares modules, which are used for all configured nixos hosts.52      # nixos option section of fleet config declares module, which is used for all configured nixos hosts.
64      nixosModules = [53      nixos.imports = [
65        lanzaboote.nixosModules.lanzaboote54        lanzaboote.nixosModules.lanzaboote
66        {55        {
67          # Make `nix shell nixpkgs#thing` use the same nixpkgs, as used to build the system.56          # Make `nix shell nixpkgs#thing` use the same nixpkgs, as used to build the system.
77      # Is I.e wiring up the mesh VPN, or deploying kubernetes, or other things.66      # Is I.e wiring up the mesh VPN, or deploying kubernetes, or other things.
78      #67      #
79      # Modules use the same semantics as standard nixos module system, they are just configuring all the hosts at once.68      # Modules use the same semantics as standard nixos module system, they are just configuring all the hosts at once.
80      fleetModules = [69      imports = [
81        ./wireguard70        ./wireguard
82        # Multi-instancible modules example71        # Multi-instancible modules example
83        (import ./kubernetes {hosts = ["a" "b"];})72        (import ./kubernetes {hosts = ["a" "b"];})
89        # Every host has some system, for which the system configuration needs to be built78        # Every host has some system, for which the system configuration needs to be built
90        system = "x86_64-linux";79        system = "x86_64-linux";
91        # And nixos modules80        # And nixos modules
92        nixosModules = [81        nixos.imports = [
93          ./controlplane-1/hardware-configuration.nix82          ./controlplane-1/hardware-configuration.nix
94          ./controlplane-1/configuration.nix83          ./controlplane-1/configuration.nix
95          # Configuration may also be specified inline, as in any nixos config.84          # Configuration may also be specified inline, as in any nixos config.

254	let host = config.host(&host).await?;254	let host = config.host(&host).await?;
255	// let action = Action::from(self.subcommand.clone());255	// let action = Action::from(self.subcommand.clone());
256	let fleet_config = &config.config_field;256	let fleet_config = &config.config_field;
257	let nixos = host.nixos_config().await?;
257	let drv = nix_go!(258	let drv = nix_go!(nixos.system.build[{ build_attr }]);
258		fleet_config.hosts[{ &host.name }]
259			.nixosSystem
260			.config
335			let config = config.clone();330			let config = config.clone();
336			let span = info_span!("deploy", host = field::display(&host.name));331			let span = info_span!("deploy", host = field::display(&host.name));
337			let hostname = host.name.clone();332			let hostname = host.name.clone();
333			let local_host = config.local_host();
338			// FIXME: Fix repl concurrency (see build-systems)334			// FIXME: Fix repl concurrency (see build-systems)
339			set.spawn_local(335			set.spawn_local(
340				(async move {336				(async move {
354							// at least for the first deployment, to provide trusted store key.350							// at least for the first deployment, to provide trusted store key.
355							//351							//
356							// It is much slower, yet doesn't require root on the deployer machine.352							// It is much slower, yet doesn't require root on the deployer machine.
357							let mut sign = MyCommand::new("nix");353							let Ok(mut sign) = local_host.cmd("nix").await else {
354								error!("failed to setup local");
355								return;
356							};
358							// Private key for host machine is registered in nix-sign.nix357							// Private key for host machine is registered in nix-sign.nix
359							sign.arg("store")358							sign.arg("store")
360								.arg("sign")359								.arg("sign")
361								.comparg("--key-file", "/etc/nix/private-key")360								.comparg("--key-file", "/etc/nix/private-key")
362								.arg("-r")361								.arg("-r")
363								.arg(&built);362								.arg(&built);
364							if let Err(e) = sign.sudo().run_nix().await {363							if let Err(e) = sign.sudo().run_nix().await {
365								warn!("Failed to sign store paths: {e}");364								warn!("failed to sign store paths: {e}");
366							};365							};
367						}366						}
368						let mut tries = 0;367						let mut tries = 0;

38			InfoCmd::ListHosts { ref tagged } => {38			InfoCmd::ListHosts { ref tagged } => {
39				'host: for host in config.list_hosts().await? {39				'host: for host in config.list_hosts().await? {
40					if !tagged.is_empty() {40					if !tagged.is_empty() {
41						let config = &config.config_unchecked_field;41						let config = &config.config_field;
42						let tags: Vec<String> =42						let tags: Vec<String> =
43							nix_go_json!(config.hosts[{ host.name }].nixosSystem.config.tags);43							nix_go_json!(config.hosts[{ host.name }].tags);
44						for tag in tagged {44						for tag in tagged {
45							if !tags.contains(tag) {45							if !tags.contains(tag) {
46								continue 'host;46								continue 'host;

598					return Ok(());598					return Ok(());
599				}599				}
600600
601				let config_field = &config.config_unchecked_field;601				let config_field = &config.config_field;
602				let field = nix_go!(config_field.sharedSecrets[{ name }]);602				let field = nix_go!(config_field.sharedSecrets[{ name }]);
603603
604				let updated = update_owner_set(604				let updated = update_owner_set(
623						.collect::<HashSet<_>>();623						.collect::<HashSet<_>>();
624					let shared_set = config.list_shared().into_iter().collect::<HashSet<_>>();624					let shared_set = config.list_shared().into_iter().collect::<HashSet<_>>();
625					for missing in expected_shared_set.difference(&shared_set) {625					for missing in expected_shared_set.difference(&shared_set) {
626						let config_field = &config.config_unchecked_field;626						let config_field = &config.config_field;
627						let secret = nix_go!(config_field.sharedSecrets[{ missing }]);627						let secret = nix_go!(config_field.sharedSecrets[{ missing }]);
628						let expected_owners: Option<Vec<String>> =628						let expected_owners: Option<Vec<String>> =
629							nix_go_json!(secret.expectedOwners);629							nix_go_json!(secret.expectedOwners);
675				for name in &config.list_shared() {675				for name in &config.list_shared() {
676					info!("updating secret: {name}");676					info!("updating secret: {name}");
677					let data = config.shared_secret(name)?;677					let data = config.shared_secret(name)?;
678					let config_field = &config.config_unchecked_field;678					let config_field = &config.config_field;
679					let expected_owners: Vec<String> =679					let expected_owners: Vec<String> =
680						nix_go_json!(config_field.sharedSecrets[{ name }].expectedOwners);680						nix_go_json!(config_field.sharedSecrets[{ name }].expectedOwners);
681					if expected_owners.is_empty() {681					if expected_owners.is_empty() {

9use tokio_util::codec::{BytesCodec, FramedRead, LinesCodec};9use tokio_util::codec::{BytesCodec, FramedRead, LinesCodec};
10use tracing::debug;10use tracing::debug;
11
12use crate::host::EscalationStrategy;
1113
12fn escape_bash(input: &str, out: &mut String) {14fn escape_bash(input: &str, out: &mut String) {
13	const TO_ESCAPE: &str = "$ !\"#&'()*,;<>?[\\]^`{|}";15	const TO_ESCAPE: &str = "$ !\"#&'()*,;<>?[\\]^`{|}";
28	os.as_ref().to_str().expect("non-utf8 data").to_owned()30	os.as_ref().to_str().expect("non-utf8 data").to_owned()
29}31}
32
30#[derive(Clone)]33#[derive(Clone, Debug)]
31pub struct MyCommand {34pub struct MyCommand {
32	command: String,35	command: String,
33	args: Vec<String>,36	args: Vec<String>,
34	env: Vec<(String, String)>,37	env: Vec<(String, String)>,
35	ssh_session: Option<Arc<Session>>,38	ssh_session: Option<Arc<Session>>,
39	escalation: EscalationStrategy,
40	escalate: bool,
36}41}
37impl MyCommand {42impl MyCommand {
38	pub fn new_on(cmd: impl AsRef<OsStr>, session: Arc<Session>) -> Self {43	pub fn new_on(
44		escalation: EscalationStrategy,
45		cmd: impl AsRef<OsStr>,
46		session: Arc<Session>,
47	) -> Self {
39		assert!(!cmd.as_ref().is_empty());48		assert!(!cmd.as_ref().is_empty());
40		Self {49		Self {
41			command: ostoutf8(cmd),50			command: ostoutf8(cmd),
42			args: vec![],51			args: vec![],
43			env: vec![],52			env: vec![],
44			ssh_session: Some(session),53			ssh_session: Some(session),
54			escalation,
55			escalate: false,
45		}56		}
46	}57	}
47	pub fn new(cmd: impl AsRef<OsStr>) -> Self {58	pub fn new(escalation: EscalationStrategy, cmd: impl AsRef<OsStr>) -> Self {
48		assert!(!cmd.as_ref().is_empty());59		assert!(!cmd.as_ref().is_empty());
49		Self {60		Self {
50			command: ostoutf8(cmd),61			command: ostoutf8(cmd),
51			args: vec![],62			args: vec![],
52			env: vec![],63			env: vec![],
53			ssh_session: None,64			ssh_session: None,
65			escalation,
66			escalate: false,
54		}67		}
55	}68	}
69	fn new_here(&self, cmd: impl AsRef<OsStr>) -> Self {
70		if let Some(ssh_session) = self.ssh_session.clone() {
71			Self::new_on(self.escalation, cmd, ssh_session)
72		} else {
73			Self::new(self.escalation, cmd)
74		}
75	}
76
56	fn into_args(self) -> Vec<String> {77	fn into_args(self) -> Vec<String> {
57		let mut out = Vec::new();78		let mut out = Vec::new();
76		if self.env.is_empty() {97		if self.env.is_empty() {
77			return self;98			return self;
78		}99		}
79		let mut out = Self::new("env");100		let mut out = self.new_here("env");
80		out.ssh_session = self.ssh_session;
81		for (k, v) in self.env {101		for (k, v) in self.env {
82			assert!(!k.contains('='));102			assert!(!k.contains('='));
83			out.arg(format!("{k}={v}"));103			out.arg(format!("{k}={v}"));
159		}179		}
160		self180		self
161	}181	}
162	pub fn sudo(mut self) -> Self {182	pub fn sudo(mut self) -> Self {
163		// TODO: Multiple escalation strategies.183		self.escalate = true;
164		// Maybe escalation should be moved to ConfigHost, to also support cases184		self
165		// when there is no sudo on remote machine, but instead we can reconnect185	}
166		// as root using ssh?
167		if std::env::var_os("NO_SUDO").is_some() {186	fn wrap_sudo_if_needed(self) -> Self {
168			let mut out = Self::new("su");
169			out.ssh_session = self.ssh_session.take();187		if !self.escalate {
188			return self;
189		}
190		match self.escalation {
191			EscalationStrategy::Su => {
192				let mut out = self.new_here("su");
170			out.arg("-c").arg(self.into_string());193				out.arg("-c").arg(self.into_string());
171			out194				out
195			}
196			EscalationStrategy::Sudo => {
197				let mut out = self.new_here("sudo");
198				out.args(self.into_args());
199				out
200			}
172		} else {201			EscalationStrategy::Run0 => {
202				// run0 wants interactive authentication by default.
173			let mut out = Self::new("sudo");203				let mut run0 = self.new_here("run0");
174			out.ssh_session = self.ssh_session.take();204				let mut out = self.new_here("script");
205
206				// Red backgrounds messes with fleet formatting
207				run0.arg("--background=");
175			out.args(self.into_args());208				run0.args(self.into_args());
209
210				out.arg("-q");
211				out.arg("/dev/null");
212				out.arg("-c");
213				out.arg(run0.into_string());
214				dbg!(&out);
176			out215				out
177		}216			}
178	}217		}
218	}
179219
180	pub async fn run(self) -> Result<()> {220	pub async fn run(self) -> Result<()> {
181		let str = self.clone().into_string();221		let str = self.clone().into_string();
182		let cmd = self.into_command_new()?;222		let cmd = self.wrap_sudo_if_needed().into_command_new()?;
183		match cmd {223		match cmd {
184			Either::Left(cmd) => run_nix_inner(str, cmd, &mut PlainHandler).await?,224			Either::Left(cmd) => run_nix_inner(str, cmd, &mut PlainHandler).await?,
185			Either::Right(cmd) => run_nix_inner_ssh(str, cmd, &mut PlainHandler).await?,225			Either::Right(cmd) => run_nix_inner_ssh(str, cmd, &mut PlainHandler).await?,
192	}232	}
193	pub async fn run_bytes(self) -> Result<Vec<u8>> {233	pub async fn run_bytes(self) -> Result<Vec<u8>> {
194		let str = self.clone().into_string();234		let str = self.clone().into_string();
195		let cmd = self.into_command_new()?;235		let cmd = self.wrap_sudo_if_needed().into_command_new()?;
196		let v = match cmd {236		let v = match cmd {
197			Either::Left(cmd) => run_nix_inner_stdout(str, cmd, &mut PlainHandler).await?,237			Either::Left(cmd) => run_nix_inner_stdout(str, cmd, &mut PlainHandler).await?,
198			Either::Right(cmd) => run_nix_inner_stdout_ssh(str, cmd, &mut PlainHandler).await?,238			Either::Right(cmd) => run_nix_inner_stdout_ssh(str, cmd, &mut PlainHandler).await?,
199		};239		};
200		Ok(v)240		Ok(v)
201	}241	}
202242
203	pub async fn run_nix_string(self) -> Result<String> {243	pub async fn run_nix_string(mut self) -> Result<String> {
204		let str = self.clone().into_string();244		let str = self.clone().into_string();
205		let mut cmd = self.into_command();245		self.arg("--log-format").arg("internal-json");
206		cmd.arg("--log-format").arg("internal-json");246		let mut cmd = self.wrap_sudo_if_needed().into_command();
207		let bytes = run_nix_inner_stdout(str, cmd, &mut NixHandler::default()).await?;247		let bytes = run_nix_inner_stdout(str, cmd, &mut NixHandler::default()).await?;
208		Ok(String::from_utf8(bytes)?)248		Ok(String::from_utf8(bytes)?)
209	}249	}
210	pub async fn run_nix(self) -> Result<()> {250	pub async fn run_nix(mut self) -> Result<()> {
211		let str = self.clone().into_string();251		let str = self.clone().into_string();
212		let mut cmd = self.into_command();252		self.arg("--log-format").arg("internal-json");
213		cmd.arg("--log-format").arg("internal-json");253		let mut cmd = self.wrap_sudo_if_needed().into_command();
214		cmd.stdout(Stdio::inherit());254		cmd.stdout(Stdio::inherit());
215		run_nix_inner(str, cmd, &mut NixHandler::default()).await255		run_nix_inner(str, cmd, &mut NixHandler::default()).await
216	}256	}

1use std::{1use std::{
2	cell::OnceCell,2	cell::{LazyCell, OnceCell},
3	collections::BTreeMap,3	collections::BTreeMap,
4	env::current_dir,4	env::current_dir,
5	ffi::{OsStr, OsString},5	ffi::{OsStr, OsString},
14use anyhow::{anyhow, bail, ensure, Context, Result};14use anyhow::{anyhow, bail, ensure, Context, Result};
15use clap::Parser;15use clap::Parser;
16use fleet_shared::SecretData;16use fleet_shared::SecretData;
17use nix_eval::{nix_go, nix_go_json, NixSessionPool, Value};17use nix_eval::{nix_go, nix_go_json, util::assert_warn, NixSessionPool, Value};
18use nom::{18use nom::{
19	bytes::complete::take_while1,19	bytes::complete::take_while1,
20	character::complete::char,20	character::complete::char,
25use openssh::SessionBuilder;25use openssh::SessionBuilder;
26use serde::de::DeserializeOwned;26use serde::de::DeserializeOwned;
27use tempfile::NamedTempFile;27use tempfile::NamedTempFile;
28use tracing::error;
2829
29use crate::{30use crate::{
30	command::MyCommand,31	command::MyCommand,
39	pub nix_args: Vec<OsString>,40	pub nix_args: Vec<OsString>,
40	/// fleet_config.config41	/// fleet_config.config
41	pub config_field: Value,42	pub config_field: Value,
42	/// fleet_config.unchecked.config
43	pub config_unchecked_field: Value,
4443
45	/// import nixpkgs {system = local};44	/// import nixpkgs {system = local};
46	pub default_pkgs: Value,45	pub default_pkgs: Value,
57	}56	}
58}57}
58
59#[derive(Clone, Copy, Debug)]
60pub enum EscalationStrategy {
61	Sudo,
62	Run0,
63	Su,
64}
5965
60pub struct ConfigHost {66pub struct ConfigHost {
61	config: Config,67	config: Config,
64	pub session: OnceLock<Arc<openssh::Session>>,70	pub session: OnceLock<Arc<openssh::Session>>,
65	groups: OnceCell<Vec<String>>,71	groups: OnceCell<Vec<String>>,
6672
67	pub nixos_config: Option<Value>,73	pub host_config: Option<Value>,
74	pub nixos_config: OnceCell<Value>,
68}75}
69impl ConfigHost {76impl ConfigHost {
77	pub async fn escalation_strategy(&self) -> Result<EscalationStrategy> {
78		// Prefer sudo, as run0 has some gotchas with polkit
79		// and too many repeating prompts.
80		if let Ok(_) = self.find_in_path("sudo").await {
81			return Ok(EscalationStrategy::Sudo);
82		}
83		if let Ok(_) = self.find_in_path("run0").await {
84			return Ok(EscalationStrategy::Run0);
85		}
86		Ok(EscalationStrategy::Su)
87	}
88	// TOCTOU is possible here in case if config is changed, but this case is not handled anywhere anyway,
89	// assuming getting tags always returns the same value.
70	pub async fn tags(&self) -> Result<Vec<String>> {90	pub async fn tags(&self) -> Result<Vec<String>> {
71		if let Some(v) = self.groups.get() {91		if let Some(v) = self.groups.get() {
72			return Ok(v.clone());92			return Ok(v.clone());
73		}93		}
74		// TOCTOU is possible here in case if config is changed, but this case is not handled anywhere anyway,
75		// assuming getting tags always returns the same value.
76		let Some(nixos_config) = &self.nixos_config else {94		let Some(host_config) = &self.host_config else {
77			return Ok(vec![]);95			return Ok(vec![]);
78		};96		};
79		let tags: Vec<String> = nix_go_json!(nixos_config.tags);97		let tags: Vec<String> = nix_go_json!(host_config.tags);
8098
81		let _ = self.groups.set(tags.clone());99		let _ = self.groups.set(tags.clone());
82100
83		Ok(tags)101		Ok(tags)
84	}102	}
103	pub async fn nixos_config(&self) -> Result<Value> {
104		if let Some(v) = self.nixos_config.get() {
105			return Ok(v.clone());
106		}
107		let Some(host_config) = &self.host_config else {
108			bail!("local host has no nixos_config");
109		};
110		let nixos_config = nix_go!(host_config.nixos.config);
111		assert_warn("nixos config evaluation", &nixos_config).await?;
112
113		let _ = self.nixos_config.set(nixos_config.clone());
114
115		Ok(nixos_config)
116	}
85	async fn open_session(&self) -> Result<Arc<openssh::Session>> {117	async fn open_session(&self) -> Result<Arc<openssh::Session>> {
86		assert!(!self.local, "do not open ssh connection to local session");118		assert!(!self.local, "do not open ssh connection to local session");
87		// FIXME: TOCTOU119		// FIXME: TOCTOU
88		if let Some(session) = &self.session.get() {120		if let Some(session) = &self.session.get() {
89			return Ok((*session).clone());121			return Ok((*session).clone());
90		};122		};
91		let session = SessionBuilder::default();123		let mut session = SessionBuilder::default();
92
93		let session = session124		let session = session
94			.connect(&self.name)125			.connect(&self.name)
129		let text = self.read_file_text(path).await?;160		let text = self.read_file_text(path).await?;
130		Ok(serde_json::from_str(&text)?)161		Ok(serde_json::from_str(&text)?)
131	}162	}
163	pub async fn read_env(&self, env: &str) -> Result<String> {
164		let mut cmd = self.cmd("printenv").await?;
165		cmd.arg(env);
166		Ok(cmd.run_string().await?)
167	}
168	pub async fn find_in_path(&self, command: &str) -> Result<String> {
169		// // `which` is not a part of coreutils, and it might not exist on machine.
170		// let path = self.read_env("PATH").await?;
171		// // Assuming delimiter is :, we don't work with windows host, this check will be much
172		// // more sophisticated in remowt backend (and quicker, since actual PATH search will be done on remote machine)
173		// for ele in path.split(':') {
174		// 	let test_path = format!("{ele}/{cmd}");
175		// 	test -x etc
176		// }
177		// let mut cmd = self.cmd("printenv").await?;
178		// cmd.arg(env);
179		// Ok(cmd.run_string().await?)
180		// Assuming this is an environment issue if which doesn't exist, will be fixed with remowt.
181		let mut cmd = self
182			.cmd_escalation(
183				// Not used
184				EscalationStrategy::Su,
185				"which",
186			)
187			.await?;
188		cmd.arg(command);
189		cmd.run_string().await
190	}
132	pub async fn read_file_value<D: FromStr>(&self, path: impl AsRef<OsStr>) -> Result<D>191	pub async fn read_file_value<D: FromStr>(&self, path: impl AsRef<OsStr>) -> Result<D>
133	where192	where
134		<D as FromStr>::Err: Display,193		<D as FromStr>::Err: Display,
135	{194	{
136		let text = self.read_file_text(path).await?;195		let text = self.read_file_text(path).await?;
137		D::from_str(&text).map_err(|e| anyhow!("failed to parse value: {e}"))196		D::from_str(&text).map_err(|e| anyhow!("failed to parse value: {e}"))
138	}197	}
139	pub async fn cmd(&self, cmd: impl AsRef<OsStr>) -> Result<MyCommand> {198	pub async fn cmd(&self, cmd: impl AsRef<OsStr>) -> Result<MyCommand> {
199		self.cmd_escalation(self.escalation_strategy().await?, cmd)
200			.await
201	}
202	pub async fn cmd_escalation(
203		&self,
204		escalation: EscalationStrategy,
205		cmd: impl AsRef<OsStr>,
206	) -> Result<MyCommand> {
140		if self.local {207		if self.local {
141			Ok(MyCommand::new(cmd))208			Ok(MyCommand::new(escalation, cmd))
142		} else {209		} else {
143			let session = self.open_session().await?;210			let session = self.open_session().await?;
144			Ok(MyCommand::new_on(cmd, session))211			Ok(MyCommand::new_on(escalation, cmd, session))
145		}212		}
146	}213	}
147214
182			return Ok(path.to_owned());249			return Ok(path.to_owned());
183		}250		}
184		let mut nix = MyCommand::new("nix");251		let mut nix = MyCommand::new(
252			// Not used
253			EscalationStrategy::Su,
254			"nix",
255		);
185		nix.arg("copy")256		nix.arg("copy")
186			.arg("--substitute-on-destination")257			.arg("--substitute-on-destination")
210	}281	}
211282
212	pub async fn list_configured_secrets(&self) -> Result<Vec<String>> {283	pub async fn list_configured_secrets(&self) -> Result<Vec<String>> {
213		let Some(nixos) = &self.nixos_config else {284		let nixos = self.nixos_config().await?;
214			return Ok(vec![]);
215		};
216		let secrets = nix_go!(nixos.secrets);285		let secrets = nix_go!(nixos.secrets);
217		let mut out = Vec::new();286		let mut out = Vec::new();
218		for name in secrets.list_fields().await? {287		for name in secrets.list_fields().await? {
226		Ok(out)295		Ok(out)
227	}296	}
228	pub async fn secret_field(&self, name: &str) -> Result<Value> {297	pub async fn secret_field(&self, name: &str) -> Result<Value> {
229		let Some(nixos) = &self.nixos_config else {298		let nixos = self.nixos_config().await?;
230			bail!("host is virtual and has no secrets");
231		};
232		Ok(nix_go!(nixos.secrets[{ name }]))299		Ok(nix_go!(nixos.secrets[{ name }]))
233	}300	}
234301
235	/// Packages for this host, resolved with nixpkgs overlays302	/// Packages for this host, resolved with nixpkgs overlays
236	pub async fn pkgs(&self) -> Result<Value> {303	pub async fn pkgs(&self) -> Result<Value> {
237		let Some(nixos) = &self.nixos_config else {304		let nixos = self.nixos_config().await?;
238			return Ok(self.config.default_pkgs.clone());
239		};
240		Ok(nix_go!(nixos.nixpkgs.resolvedPkgs))305		Ok(nix_go!(nixos._resolvedPkgs))
241	}306	}
242}307}
243308
317			name: "<virtual localhost>".to_owned(),382			name: "<virtual localhost>".to_owned(),
318			local: true,383			local: true,
319			session: OnceLock::new(),384			session: OnceLock::new(),
320			nixos_config: None,385			host_config: None,
386			nixos_config: OnceCell::new(),
321			groups: {387			groups: {
322				let cell = OnceCell::new();388				let cell = OnceCell::new();
323				let _ = cell.set(vec![]);389				let _ = cell.set(vec![]);
327	}393	}
328394
329	pub async fn host(&self, name: &str) -> Result<ConfigHost> {395	pub async fn host(&self, name: &str) -> Result<ConfigHost> {
330		let config = &self.config_unchecked_field;396		let config = &self.config_field;
331		let nixos_config = nix_go!(config.hosts[{ name }].nixosSystem.config);397		let host_config = nix_go!(config.hosts[{ name }]);
398
399
332		Ok(ConfigHost {400		Ok(ConfigHost {
333			config: self.clone(),401			config: self.clone(),
334			name: name.to_owned(),402			name: name.to_owned(),
335			local: self.is_local(name),403			local: self.is_local(name),
336			session: OnceLock::new(),404			session: OnceLock::new(),
337			nixos_config: Some(nixos_config),405			host_config: Some(host_config),
406			nixos_config: OnceCell::new(),
338			groups: OnceCell::new(),407			groups: OnceCell::new(),
339		})408		})
340	}409	}
341	pub async fn list_hosts(&self) -> Result<Vec<ConfigHost>> {410	pub async fn list_hosts(&self) -> Result<Vec<ConfigHost>> {
342		let config = &self.config_unchecked_field;411		let config = &self.config_field;
343		let names = nix_go!(config.hosts).list_fields().await?;412		let names = nix_go!(config.hosts).list_fields().await?;
344		let mut out = vec![];413		let mut out = vec![];
345		for name in names {414		for name in names {
348		Ok(out)417		Ok(out)
349	}418	}
350	pub async fn system_config(&self, host: &str) -> Result<Value> {419	pub async fn system_config(&self, host: &str) -> Result<Value> {
351		let fleet_field = &self.config_unchecked_field;420		let fleet_field = &self.config_field;
352		Ok(nix_go!(fleet_field.hosts[{ host }].nixosSystem.config))421		Ok(nix_go!(fleet_field.hosts[{ host }].nixos.config))
353	}422	}
354423
355	pub(super) fn data(&self) -> MutexGuard<FleetData> {424	pub(super) fn data(&self) -> MutexGuard<FleetData> {
360	}429	}
361	/// Shared secrets configured in fleet.nix or in flake430	/// Shared secrets configured in fleet.nix or in flake
362	pub async fn list_configured_shared(&self) -> Result<Vec<String>> {431	pub async fn list_configured_shared(&self) -> Result<Vec<String>> {
363		let config_field = &self.config_unchecked_field;432		let config_field = &self.config_field;
364		Ok(nix_go!(config_field.sharedSecrets).list_fields().await?)433		Ok(nix_go!(config_field.sharedSecrets).list_fields().await?)
365	}434	}
366	/// Shared secrets configured in fleet.nix435	/// Shared secrets configured in fleet.nix
420		Ok(secret.clone())489		Ok(secret.clone())
421	}490	}
422	pub async fn shared_secret_expected_owners(&self, secret: &str) -> Result<Vec<String>> {491	pub async fn shared_secret_expected_owners(&self, secret: &str) -> Result<Vec<String>> {
423		let config_field = &self.config_unchecked_field;492		let config_field = &self.config_field;
424		Ok(nix_go_json!(493		Ok(nix_go_json!(
425			config_field.sharedSecrets[{ secret }].expectedOwners494			config_field.sharedSecrets[{ secret }].expectedOwners
426		))495		))
525		}594		}
526		let local_system = self.local_system.clone();595		let local_system = self.local_system.clone();
596
597		let mut fleet_data_path = directory.clone();
598		fleet_data_path.push("fleet.nix");
599		let bytes = std::fs::read_to_string(fleet_data_path)?;
600		let data: Mutex<FleetData> = nixlike::parse_str(&bytes)?;
527601
528		let fleet_root = Value::binding(root_field, "fleetConfigurations").await?;602		let fleet_root = Value::binding(root_field, "fleetConfigurations").await?;
529		let fleet_field = nix_go!(fleet_root.default);603		let fleet_field = nix_go!(fleet_root.default({ data }));
530604
531		let config_field = nix_go!(fleet_field.config);605		let config_field = nix_go!(fleet_field.config);
606
532		let config_unchecked_field = nix_go!(fleet_field.unchecked.config);607		assert_warn("fleet config evaluation", &config_field).await?;
533608
534		let import = nix_go!(builtins_field.import);609		let import = nix_go!(builtins_field.import);
535		let overlays = nix_go!(config_unchecked_field.overlays);610		let overlays = nix_go!(config_field.nixpkgs.overlays);
536		let nixpkgs = nix_go!(fleet_field.nixpkgs | import);611		let nixpkgs = nix_go!(fleet_field.nixpkgs.buildUsing | import);
537612
538		let default_pkgs = nix_go!(nixpkgs(Obj {613		let default_pkgs = nix_go!(nixpkgs(Obj {
539			overlays,614			overlays,
540			system: { self.local_system.clone() },615			system: { self.local_system.clone() },
541		}));616		}));
542
543		let mut fleet_data_path = directory.clone();
544		fleet_data_path.push("fleet.nix");
545		let bytes = std::fs::read_to_string(fleet_data_path)?;
546		let data = nixlike::parse_str(&bytes)?;
547617
548		Ok(Config(Arc::new(FleetConfigInternals {618		Ok(Config(Arc::new(FleetConfigInternals {
549			opts: self,619			opts: self,
552			local_system,622			local_system,
553			nix_args,623			nix_args,
554			config_field,624			config_field,
555			config_unchecked_field,
556			default_pkgs,625			default_pkgs,
557		})))626		})))
558	}627	}