git.delta.rocks / jrsonnet / refs/commits / e89ca39c2450

--- a/Cargo.toml
+++ b/Cargo.toml
@@ -23,3 +23,8 @@
 tokio = { version = "1.45.1", features = ["fs", "macros", "rt", "rt-multi-thread", "sync", "time"] }
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt"] }
+
+[profile.dev]
+panic = "abort"
+[profile.release]
+panic = "abort"

--- a/crates/fleet-base/src/fleetdata.rs
+++ b/crates/fleet-base/src/fleetdata.rs
@@ -121,12 +121,12 @@
 	})
 }
 
-#[derive(Serialize, Deserialize, Clone)]
+#[derive(Serialize, Deserialize, Clone, Debug)]
 pub struct FleetSecretPart {
 	pub raw: SecretData,
 }
 
-#[derive(Serialize, Deserialize, Clone)]
+#[derive(Serialize, Deserialize, Clone, Debug)]
 #[serde(rename_all = "camelCase")]
 #[must_use]
 pub struct FleetSecretData {
@@ -144,7 +144,7 @@
 	pub generation_data: Value,
 }
 
-#[derive(Serialize, Deserialize, Clone)]
+#[derive(Serialize, Deserialize, Clone, Debug)]
 #[serde(rename_all = "camelCase")]
 #[must_use]
 pub struct FleetSecretDistribution {

--- a/crates/fleet-base/src/opts.rs
+++ b/crates/fleet-base/src/opts.rs
@@ -22,7 +22,8 @@
 
 use crate::{
 	fleetdata::FleetData,
-	host::{Config, ConfigHost, FleetConfigInternals}, primops::init_primops,
+	host::{Config, ConfigHost, FleetConfigInternals},
+	primops::{PRIMOPS_DATA, init_primops},
 };
 
 #[derive(Clone)]
@@ -213,7 +214,7 @@
 			std::fs::read_to_string(&fleet_data_path).context("reading fleet state (fleet.nix)")?;
 		let data = Arc::new(Mutex::new(FleetData::from_str(&bytes)?));
 
-		init_primops(data.clone());
+		init_primops();
 
 		let mut fetch_settings = FetchSettings::new();
 		fetch_settings.set(c"warn-dirty", c"false");
@@ -264,8 +265,7 @@
 		if cfg!(debug_assertions) {
 			gc_now();
 		}
-
-		Ok(Config(Arc::new(FleetConfigInternals {
+		let config = Config(Arc::new(FleetConfigInternals {
 			directory,
 			data,
 			flake_outputs: flake,
@@ -275,6 +275,12 @@
 			default_pkgs,
 			nixpkgs,
 			localhost: self.localhost.to_owned(),
-		})))
+		}));
+
+		PRIMOPS_DATA
+			.set(config.clone())
+			.map_err(|_| ())
+			.expect("only one fleet config may exist per process");
+		Ok(config)
 	}
 }

--- a/crates/fleet-base/src/primops.rs
+++ b/crates/fleet-base/src/primops.rs
@@ -1,10 +1,15 @@
-use std::collections::HashMap;
-use std::sync::{Arc, Mutex};
+use std::cell::OnceCell;
+use std::collections::{BTreeMap, HashMap};
+use std::sync::{Arc, Mutex, OnceLock};
 
-use nix_eval::{NativeFn, Value};
-use tracing::info;
+use anyhow::{Context, bail};
+use itertools::Itertools;
+use nix_eval::{NativeFn, Value, nix_go, nix_go_json};
+use serde::Deserialize;
+use tracing::{info, warn};
 
 use crate::fleetdata::{FleetData, FleetSecrets};
+use crate::host::Config;
 
 #[derive(thiserror::Error, Debug)]
 enum Error {}
@@ -23,18 +28,76 @@
 
 struct FsSecretsBackend {}
 
-pub fn init_primops(secrets: Arc<Mutex<FleetData>>) {
+pub static PRIMOPS_DATA: OnceLock<Config> = OnceLock::new();
+
+#[derive(Deserialize, Debug)]
+struct GeneratorPart {
+	encrypted: bool,
+}
+
+pub fn init_primops() {
 	info!("initializing primops");
 	NativeFn::new(
 		c"__fleetEnsureHostSecret",
 		c"Ensure secret existence for a host, regenerating it in case of some mismatch",
 		[c"host", c"secret", c"generator"],
-		|[host, secret, generator]| {
-			todo!("ensure secret");
-			Ok(Value::new_attrs(HashMap::from_iter([(
-				"raw",
-				Value::new_str("rawData"),
-			)])))
+		|es, [host, secret, generator]| {
+			info!("get host");
+			let host = host.to_string()?;
+			info!("get secret");
+			let secret = secret.to_string()?;
+
+			info!("get config");
+			let config = PRIMOPS_DATA
+				.get()
+				.expect("primops data should be set on init");
+
+			info!("get pkgs");
+			let nixpkgs = &config.nixpkgs;
+			let default_pkgs = &config.default_pkgs;
+			let default_mk_secret_generators = nix_go!(default_pkgs.mkSecretGenerators);
+			let generators = nix_go!(default_mk_secret_generators(Obj {
+				recipients: <Vec<String>>::new(),
+			}));
+			let pkgs_and_generators = default_pkgs.clone().attrs_update(generators)?;
+
+			info!("call package");
+			let call_package = nix_go!(nixpkgs.lib.callPackageWith(pkgs_and_generators));
+			let default_generator = call_package
+				.call(generator.clone())
+				.context("calling callPackage with generator")?
+				.call(Value::new_attrs(HashMap::new()))
+				.context("providing extra callPackage args")?;
+
+			info!("get parts");
+			let mut parts: BTreeMap<String, GeneratorPart> = nix_go_json!(default_generator.parts);
+			info!("got parts: {parts:?}");
+
+			let Some(existing) = config
+				.host_secret(&host, &secret) else {
+				bail!("missing secret {secret} for host {host}; secret needs regeneration")
+			};
+
+			info!("got existing: {existing:?}");
+
+			let mut out = HashMap::new();
+
+			for (part_name, part) in &existing.secret.parts {
+				let Some(definition) = parts.remove(part_name) else {
+					warn!("secret {secret} part {part_name} is stored, but not defined in nixos config, it will not be passed to nix");
+					continue;
+				};
+				if definition.encrypted != part.raw.encrypted {
+					bail!("secret {secret} part {part_name} is supposed to be {}, but it is {}; secret needs regeneration", if definition.encrypted {"encrypted"} else {"unencrypted"}, if part.raw.encrypted {"encrypted"} else {"unencrypted"});
+				}
+				out.insert(part_name.as_str(), Value::new_attrs(HashMap::from_iter([("raw", Value::new_str(&part.raw.to_string()))])));
+			}
+			if !parts.is_empty(){
+				let defs = parts.keys().collect_vec();
+				bail!("secret parts are defined, but not stored: {defs:?}, secret needs regeneration")
+			}
+
+			Ok(Value::new_attrs(out))
 		},
 	)
 	.register();

12use serde::de::DeserializeOwned;12use serde::de::DeserializeOwned;
1313
14pub use anyhow::Result;14pub use anyhow::Result;
15use tracing::instrument;15use tracing::{info, instrument, warn};
1616
17use self::logging::{ErrorInfoBuilder, nix_logging_cxx};17use self::logging::{ErrorInfoBuilder, nix_logging_cxx};
18use self::nix_cxx::set_fetcher_setting;18use self::nix_cxx::set_fetcher_setting;
22	GC_thread_is_registered, GC_unregister_my_thread, ListBuilder as c_list_builder, PrimOp,22	GC_thread_is_registered, GC_unregister_my_thread, ListBuilder as c_list_builder, PrimOp,
23	PrimOpFun, Store as c_store, StorePath as c_store_path, alloc_primop, alloc_value,23	PrimOpFun, Store as c_store, StorePath as c_store_path, alloc_primop, alloc_value,
24	bindings_builder_free, bindings_builder_insert, c_context, c_context_create, c_context_free,24	bindings_builder_free, bindings_builder_insert, c_context, c_context_create, c_context_free,
25	clear_err, copy_value, err_code, err_info_msg, err_msg, eval_state_build,25	clear_err, copy_value, err_NIX_ERR_KEY, err_NIX_ERR_NIX_ERROR, err_NIX_ERR_OVERFLOW,
26	err_NIX_ERR_UNKNOWN, err_code, err_info_msg, err_msg, eval_state_build,
26	eval_state_builder_load, eval_state_builder_new, eval_state_builder_set_eval_setting,27	eval_state_builder_load, eval_state_builder_new, eval_state_builder_set_eval_setting,
27	expr_eval_from_string, fetchers_settings, fetchers_settings_free, fetchers_settings_new,28	expr_eval_from_string, fetchers_settings, fetchers_settings_free, fetchers_settings_new,
28	flake_lock, flake_lock_flags, flake_lock_flags_free, flake_lock_flags_new, flake_reference,29	flake_lock, flake_lock_flags, flake_lock_flags_free, flake_lock_flags_new, flake_reference,
36	make_attrs, make_bindings_builder, make_list, make_list_builder, realised_string,37	make_attrs, make_bindings_builder, make_list, make_list_builder, realised_string,
37	realised_string_free, realised_string_get_buffer_size, realised_string_get_buffer_start,38	realised_string_free, realised_string_get_buffer_size, realised_string_get_buffer_start,
38	realised_string_get_store_path, realised_string_get_store_path_count, register_primop,39	realised_string_get_store_path, realised_string_get_store_path_count, register_primop,
39	set_err_msg, setting_set, state_free, store_copy_closure, store_get_fs_closure, store_open,40	set_err_msg, setting_set, state_free, store_open, store_parse_path, store_path_free,
40	store_parse_path, store_path_free, store_path_name, string_realise, value, value_call,41	store_path_name, string_realise, value, value_call, value_decref, value_force, value_incref,
41	value_decref, value_incref,
42};42};
4343
62		type nix_fetchers_settings;62		type nix_fetchers_settings;
63		include!("nix-eval/src/lib.hh");63		include!("nix-eval/src/lib.hh");
6464
65		#[allow(clippy::missing_safety_doc)]
65		unsafe fn set_fetcher_setting(66		unsafe fn set_fetcher_setting(
66			settings: *mut nix_fetchers_settings,67			settings: *mut nix_fetchers_settings,
67			setting: *const c_char,68			setting: *const c_char,
111#[derive(Debug)]112#[derive(Debug)]
112#[repr(i32)]113#[repr(i32)]
113pub enum NixErrorKind {114pub enum NixErrorKind {
114	Unknown = 1,115	Unknown = err_NIX_ERR_UNKNOWN,
115	Overflow = 2,116	Overflow = err_NIX_ERR_OVERFLOW,
116	Key = 3,117	Key = err_NIX_ERR_KEY,
117	Generic = 4,118	Generic = err_NIX_ERR_NIX_ERROR,
118}119}
119impl NixErrorKind {120impl NixErrorKind {
120	fn from_int(v: c_int) -> Option<Self> {121	fn from_int(v: c_int) -> Option<Self> {
121		Some(match v {122		Some(match v {
122			0 => return None,123			0 => return None,
123			-1 => Self::Unknown,124			nix_raw::err_NIX_ERR_UNKNOWN => Self::Unknown,
124			-2 => Self::Overflow,125			nix_raw::err_NIX_ERR_OVERFLOW => Self::Overflow,
125			-3 => Self::Key,126			nix_raw::err_NIX_ERR_KEY => Self::Key,
126			-4 => Self::Generic,127			nix_raw::err_NIX_ERR_NIX_ERROR => Self::Generic,
127			_ => {128			_ => {
128				debug_assert!(false, "unexpected nix error kind: {v}");129				debug_assert!(false, "unexpected nix error kind: {v}");
129				Self::Unknown130				Self::Unknown
298	}299	}
299}300}
300301
301static GLOBAL_STATE: LazyLock<GlobalState> =302static GLOBAL_STATE: LazyLock<GlobalState> = LazyLock::new(|| {
303	info!("initializing nix global state");
302	LazyLock::new(|| GlobalState::new().expect("global state init shouldn't fail"));304	GlobalState::new().expect("global state init shouldn't fail")
305});
303306
304thread_local! {307thread_local! {
305	static THREAD_STATE: RefCell<ThreadState> = RefCell::new(ThreadState::new().expect("thread state init shouldn't fail"));308	static THREAD_STATE: RefCell<ThreadState> = RefCell::new(ThreadState::new().expect("thread state init shouldn't fail"));
424	}427	}
425}428}
426429
430#[repr(transparent)]
427struct EvalState(*mut c_eval_state);431pub struct EvalState(*mut c_eval_state);
428unsafe impl Send for EvalState {}432unsafe impl Send for EvalState {}
429unsafe impl Sync for EvalState {}433unsafe impl Sync for EvalState {}
430434
697		let builtin = Self::eval("builtins.toString")?;701		let builtin = Self::eval("builtins.toString")?;
698		builtin.call(self.clone())702		builtin.call(self.clone())
699	}703	}
704	fn force(&mut self, s: *mut nix_raw::EvalState) -> Result<()> {
705		with_default_context(|c, _| unsafe { value_force(c, s, self.0) })?;
706		Ok(())
707	}
700	pub fn to_string(&self) -> Result<String> {708	pub fn to_string(&self) -> Result<String> {
709		let ty = self.type_of();
710		if !matches!(ty, NixType::String) {
711			bail!("unexpected type: {ty:?}, expected string");
712		}
701		let mut str_out = String::new();713		let mut str_out = String::new();
702		with_default_context(|c, _| unsafe {714		with_default_context(|c, _| unsafe {
703			get_string(c, self.0, Some(copy_nix_str), (&raw mut str_out).cast())715			get_string(c, self.0, Some(copy_nix_str), (&raw mut str_out).cast())
931	ret: *mut value,943	ret: *mut value,
932) {944) {
933	let user_closure: &UserClosure<N> = unsafe { &*user_data.cast_const().cast() };945	let user_closure: &UserClosure<N> = unsafe { &*user_data.cast_const().cast() };
946	let mut e = None;
934	let args: [&Value; N] = array::from_fn(|i| {947	let args: [&Value; N] = array::from_fn(|i| {
935		let v: &Value = unsafe { &*args.add(i).cast_const().cast() };948		let v: &mut Value = unsafe { &mut *args.add(i).cast() };
949
950		info!("forcing arg");
951		if matches!(v.type_of(), NixType::Thunk)
952			&& let Err(err) = v.force(state)
953		{
954			e = Some(err);
955		};
936		v956		v as &Value
937	});957	});
958	info!("args forced");
938	let ctx: &mut NixContext = unsafe { &mut *context.cast() };959	let ctx: &mut NixContext = unsafe { &mut *context.cast() };
960
961	if let Some(e) = e {
962		warn!("set err = {e}");
963		unsafe { init_int(context, ret, 0) };
964		return ctx.set_err(
965			NixErrorKind::Unknown,
966			&CString::new(e.to_string()).expect("forcing argument value failed"),
967		);
968	}
969
970	let state: &EvalState = unsafe { std::mem::transmute(&state) };
939971
940	match user_closure(args) {972	match user_closure(state, args) {
941		Ok(v) => {973		Ok(v) => {
942			unsafe { copy_value(context, ret, v.0) };974			unsafe { copy_value(context, ret, v.0) };
943		}975		}
944		Err(e) => {976		Err(e) => {
977			unsafe { init_int(context, ret, 0) };
978			warn!("set err = {e:#?}");
945			ctx.set_err(979			ctx.set_err(
946				NixErrorKind::Unknown,980				NixErrorKind::Unknown,
947				&CString::new(e.to_string()).expect("error should not contain internal nuls"),981				&CString::new(e.to_string()).expect("error should not contain internal nuls"),
950	}984	}
951}985}
952986
953type UserClosure<const N: usize> = Box<dyn Fn([&Value; N]) -> Result<Value>>;987type UserClosure<const N: usize> = Box<dyn Fn(&EvalState, [&Value; N]) -> Result<Value>>;
954988
955pub struct NativeFn(*mut PrimOp);989pub struct NativeFn(*mut PrimOp);
956impl NativeFn {990impl NativeFn {
957	pub fn new<const N: usize>(991	pub fn new<const N: usize>(
958		name: &'static CStr,992		name: &'static CStr,
959		doc: &'static CStr,993		doc: &'static CStr,
960		args: [&'static CStr; N],994		args: [&'static CStr; N],
961		f: impl Fn([&Value; N]) -> Result<Value> + 'static,995		f: impl Fn(&EvalState, [&Value; N]) -> Result<Value> + 'static,
962	) -> Self {996	) -> Self {
963		// Double-boxing to make it thin pointer, as vtable gets outside of first Box997		// Double-boxing to make it thin pointer, as vtable gets outside of first Box
964		let closure: Box<UserClosure<N>> = Box::new(Box::new(f));998		let closure: Box<UserClosure<N>> = Box::new(Box::new(f));
1003		c"__uppercaseSuffix2",1037		c"__uppercaseSuffix2",
1004		c"make string uppercase and add suffix",1038		c"make string uppercase and add suffix",
1005		[c"str", c"suffix"],1039		[c"str", c"suffix"],
1006		|[str, suffix]: [&Value; 2]| {1040		|_, [str, suffix]: [&Value; 2]| {
1007			let str = str.to_string()?;1041			let str = str.to_string()?;
1008			let suffix = suffix.to_string()?;1042			let suffix = suffix.to_string()?;
1009			Ok(Value::new_str(&format!("{}{suffix}", str.to_uppercase())))1043			Ok(Value::new_str(&format!("{}{suffix}", str.to_uppercase())))
1038		c"uppercase_suffix",1072		c"uppercase_suffix",
1039		c"make string uppercase and add suffix",1073		c"make string uppercase and add suffix",
1040		[c"str", c"suffix"],1074		[c"str", c"suffix"],
1041		|[str, suffix]: [&Value; 2]| {1075		|es, [str, suffix]: [&Value; 2]| {
1042			let str = str.to_string()?;1076			let str = str.to_string()?;
1043			let suffix = suffix.to_string()?;1077			let suffix = suffix.to_string()?;
1044			Ok(Value::new_str(&format!("{}{suffix}", str.to_uppercase())))1078			Ok(Value::new_str(&format!("{}{suffix}", str.to_uppercase())))

--- a/crates/nix-eval/src/macros.rs
+++ b/crates/nix-eval/src/macros.rs
@@ -16,7 +16,12 @@
 		$(nix_expr_inner!(@obj($o) $($tt)*);)?
 	}};
 	(@obj($o:ident)) => {{}};
-	(Obj { $($tt:tt)* }) => {{
+	(Obj { }) => {{
+		use $crate::{nix_expr_inner};
+		let out = std::collections::hash_map::HashMap::new();
+		Value::new_attrs(out)
+	}};
+	(Obj { $($tt:tt)+ }) => {{
 		use $crate::{nix_expr_inner};
 		let mut out = std::collections::hash_map::HashMap::new();
 		nix_expr_inner!(@obj(out) $($tt)*);

--- a/lib/default.nix
+++ b/lib/default.nix
@@ -149,6 +149,23 @@
         }
       );
 
+    mkAskPass =
+      { prompt ? "Secret value", part ? "secret" }:
+      (
+        {
+          kdePackages,
+          mkImpureSecretGenerator,
+        }:
+        mkImpureSecretGenerator {
+          # TODO: Escape prompt?
+          script = ''
+            ${kdePackages.kdialog}/bin/kdialog --inputbox "${prompt}" | gh private -o $out/${part}
+          '';
+
+          parts.${part}.encrypted = true;
+        }
+      );
+
     /**
       Generate a random RSA keypair
 
@@ -251,6 +268,7 @@
     mkBytes
     mkHexBytes
     mkBase64Bytes
+    mkAskPass
     ;
 
   strings =

--- a/modules/nixos/secrets.nix
+++ b/modules/nixos/secrets.nix
@@ -19,7 +19,6 @@
     submodule
     str
     attrsOf
-    nullOr
     unspecified
     uniq
     functionTo
@@ -77,13 +76,12 @@
     {
       options = {
         parts = mkOption {
-          type = attrsOf (secretPartType secretName);
+          type = uniq (attrsOf (secretPartType secretName));
           description = "Definition of secret parts";
         };
         generator = mkOption {
-          type = uniq (nullOr (functionTo package));
+          type = uniq (functionTo package);
           description = "Derivation to evaluate for secret generation";
-          default = null;
         };
         mode = mkOption {
           type = str;
@@ -103,14 +101,25 @@
         };
       };
       config = {
-        parts = builtins.fleetEnsureHostSecret sysConfig.networking.hostName secretName config.generator;
+        # C api is broken in regard to thunks
+        # https://github.com/NixOS/nix/issues/12800
+        parts = let 
+          hostName = sysConfig.networking.hostName;
+          generator = config.generator;
+        in builtins.deepSeq [
+          hostName
+          secretName
+          generator
+        ] (builtins.fleetEnsureHostSecret
+          hostName
+          secretName
+          generator);
       };
     }
   );
-  secretsData = (mapAttrs (_: s: s.definition) config.secrets);
   secretsFile = pkgs.writeTextFile {
     name = "secrets.json";
-    text = toJSON secretsData;
+    text = toJSON config.system.secretsData;
   };
   useSysusers =
     (config.systemd ? sysusers && config.systemd.sysusers.enable)
@@ -121,17 +130,20 @@
     secrets = mkOption {
       type = attrsOf secretType;
       default = { };
-      apply = v: (mapAttrs (_: secret: secret.parts // { definition = secret; }) v);
+      apply = mapAttrs (_: secret: secret.parts // {definition = secret;});
       description = "Host-local secrets";
     };
     system.secretsData = mkOption {
       type = unspecified;
-      default = { };
+      default = mapAttrs (_: s:
+        (removeAttrs s.definition ["generator"]) // {
+          parts = mapAttrs (_: part: removeAttrs part ["data"]) s.definition.parts;
+        }
+      ) config.secrets;
       description = "secrets.json contents";
     };
   };
   config = {
-    system = { inherit secretsData; };
     environment.systemPackages = [ pkgs.fleet-install-secrets ];
 
     systemd.services.fleet-install-secrets = mkIf useSysusers {