git.delta.rocks / jrsonnet / refs/commits / eee08d567ee4

--- a/cmds/fleet/src/cmds/build_systems.rs
+++ b/cmds/fleet/src/cmds/build_systems.rs
@@ -1,9 +1,10 @@
-use std::{env::current_dir, process::Stdio, time::Duration};
+use std::{env::current_dir, time::Duration};
 
-use crate::{command::CommandExt, host::Config};
+use crate::command::MyCommand;
+use crate::host::Config;
 use anyhow::Result;
 use clap::Parser;
-use tokio::{process::Command, task::LocalSet, time::sleep};
+use tokio::{task::LocalSet, time::sleep};
 use tracing::{error, field, info, info_span, warn, Instrument};
 
 #[derive(Parser, Clone)]
@@ -33,6 +34,9 @@
 	}
 
 	pub(crate) fn should_switch_profile(&self) -> bool {
+		matches!(self, Self::Switch | Self::Boot)
+	}
+	pub(crate) fn should_activate(&self) -> bool {
 		matches!(self, Self::Switch | Self::Test)
 	}
 }
@@ -108,13 +112,7 @@
 			dir.path().to_owned()
 		};
 
-		let mut nix_build = if self.privileged_build {
-			let mut out = Command::new("sudo");
-			out.arg("nix");
-			out
-		} else {
-			Command::new("nix")
-		};
+		let mut nix_build = MyCommand::new("nix");
 		nix_build
 			.args([
 				"build",
@@ -122,9 +120,8 @@
 				"--json",
 				// "--show-trace",
 				"--no-link",
-				"--out-link",
 			])
-			.arg(&built)
+			.comparg("--out-link", &built)
 			.arg(
 				config.configuration_attr_name(&format!(
 					"buildSystems.{}.{host}",
@@ -133,6 +130,10 @@
 			)
 			.args(&config.nix_args);
 
+		if self.privileged_build {
+			nix_build = nix_build.sudo();
+		}
+
 		nix_build.run_nix().await.map_err(|e| {
 			if action.build_attr() == "sdImage" {
 				info!("sd-image build failed");
@@ -149,14 +150,11 @@
 					info!("uploading system closure");
 					let mut tries = 0;
 					loop {
-						match Command::new("nix")
-							.args(["copy", "--to"])
-							.arg(format!("ssh://root@{}", host))
-							.arg(&built)
-							.inherit_stdio()
-							.run_nix()
-							.await
-						{
+						let mut nix = MyCommand::new("nix");
+						nix.arg("copy")
+							.comparg("--to", format!("ssh://root@{host}"))
+							.arg(&built);
+						match nix.run_nix().await {
 							Ok(()) => break,
 							Err(e) if tries < 3 => {
 								tries += 1;
@@ -170,24 +168,20 @@
 				if let Some(action) = action {
 					if action.should_switch_profile() {
 						info!("switching generation");
-						config
-							.command_on(&host, "nix-env", true)
-							.args(["-p", "/nix/var/nix/profiles/system", "--set"])
-							.arg(&built)
-							.inherit_stdio()
-							.run()
-							.await?;
+						let mut cmd = MyCommand::new("nix-env");
+						cmd.comparg("--profile", "/nix/var/nix/profiles/system")
+							.comparg("--set", &built);
+						config.run_on(&host, cmd, true).await?;
+					}
+					if action.should_activate() {
+						info!("executing activation script");
+						let mut switch_script = built.clone();
+						switch_script.push("bin");
+						switch_script.push("switch-to-configuration");
+						let mut cmd = MyCommand::new(switch_script);
+						cmd.arg(action.name());
+						config.run_on(&host, cmd, true).await?;
 					}
-					info!("executing activation script");
-					let mut switch_script = built.clone();
-					switch_script.push("bin");
-					switch_script.push("switch-to-configuration");
-					config
-						.command_on(&host, switch_script, true)
-						.arg(action.name())
-						.stdout(Stdio::inherit())
-						.run()
-						.await?;
 				}
 			}
 			Action::Package(PackageAction::SdImage) => {
@@ -195,39 +189,30 @@
 				out.push(format!("sd-image-{}", host));
 
 				info!("building sd image to {:?}", out);
-				let mut nix_build = if self.privileged_build {
-					let mut out = Command::new("sudo");
-					out.arg("nix");
-					out
-				} else {
-					Command::new("nix")
-				};
+				let mut nix_build = MyCommand::new("nix");
 				nix_build
-					.args(["build", "--impure", "--no-link", "--out-link"])
-					.arg(&out)
+					.args(["build", "--impure", "--no-link"])
+					.comparg("--out-link", &out)
 					.arg(config.configuration_attr_name(&format!("buildSystems.sdImage.{}", host,)))
 					.args(&config.nix_args);
 				if !self.fail_fast {
 					nix_build.arg("--keep-going");
 				}
+				if self.privileged_build {
+					nix_build = nix_build.sudo();
+				}
 
-				nix_build.inherit_stdio().run_nix().await?;
+				nix_build.run_nix().await?;
 			}
 			Action::Package(PackageAction::InstallationCd) => {
 				let mut out = current_dir()?;
 				out.push(format!("installation-cd-{}", host));
 
 				info!("building sd image to {:?}", out);
-				let mut nix_build = if self.privileged_build {
-					let mut out = Command::new("sudo");
-					out.arg("nix");
-					out
-				} else {
-					Command::new("nix")
-				};
+				let mut nix_build = MyCommand::new("nix");
 				nix_build
-					.args(["build", "--impure", "--no-link", "--out-link"])
-					.arg(&out)
+					.args(["build", "--impure", "--no-link"])
+					.comparg("--out-link", &out)
 					.arg(
 						config.configuration_attr_name(&format!(
 							"buildSystems.installationCd.{}",
@@ -238,8 +223,11 @@
 				if !self.fail_fast {
 					nix_build.arg("--keep-going");
 				}
+				if self.privileged_build {
+					nix_build = nix_build.sudo();
+				}
 
-				nix_build.inherit_stdio().run_nix().await?;
+				nix_build.run_nix().await?;
 			}
 		};
 		Ok(())

--- a/cmds/fleet/src/cmds/secrets/mod.rs
+++ b/cmds/fleet/src/cmds/secrets/mod.rs
@@ -2,18 +2,16 @@
 	fleetdata::{FleetSecret, FleetSharedSecret},
 	host::Config,
 };
-use age::{Decryptor, Encryptor};
 use anyhow::{bail, ensure, Context, Result};
 use clap::Parser;
 use futures::{StreamExt, TryStreamExt};
 use std::{
 	collections::HashSet,
-	io::{self, Cursor, Read, Write},
-	iter,
+	io::{self, Cursor, Read},
 	path::PathBuf,
 };
 use tokio::fs::read_to_string;
-use tracing::{info, warn};
+use tracing::{info, warn, error};
 
 #[derive(Parser)]
 pub enum Secrets {
@@ -313,6 +311,7 @@
 				}
 				let mut to_remove = Vec::new();
 				for name in &config.list_shared() {
+					info!("updating secret: {name}");
 					let mut data = config.shared_secret(name)?;
 					let expected_owners: Vec<String> = config
 						.shared_config_attr(&format!("sharedSecrets.\"{name}\".expectedOwners"))
@@ -326,14 +325,12 @@
 					let expected_set = expected_owners.iter().collect::<HashSet<_>>();
 					let should_remove = set.difference(&expected_set).next().is_some();
 					if set != expected_set {
-						warn!("reconfiguring owners for {name}");
-						let generator: Option<String> = config
-							.shared_config_attr(&format!("sharedSecrets.\"{name}\".generator"))
+						let owner_dependent: bool = config
+							.shared_config_attr(&format!("sharedSecrets.\"{name}\".ownerDependent"))
 							.await?;
-						// TODO: if !.owner_dependent
-						if let Some(str) = generator {
-							todo!("regenerate")
-						} else {
+						if !owner_dependent {
+							warn!("reencrypting secret '{name}' for new owner set");
+							// TODO: force regeneration
 							if should_remove {
 								warn!("secret will not be regenerated for removed machines, and until host rebuild, they will still possess the ability to decode secret");
 							}
@@ -367,7 +364,16 @@
 							data.secret.secret = encrypted;
 							data.owners = expected_owners;
 							config.replace_shared(name.to_owned(), data);
+						} else if let Some(generator) = config
+							.shared_config_attr::<Option<String>>(&format!("sharedSecrets.\"{name}\".generator"))
+							.await?
+						{
+							todo!("regenerate secret {name} with {generator}");
+						} else {
+							error!("secret '{name}' should be regenerated manually");
 						}
+					} else {
+						info!("secret data is ok")
 					}
 				}
 				for k in to_remove {

--- a/cmds/fleet/src/host.rs
+++ b/cmds/fleet/src/host.rs
@@ -1,7 +1,7 @@
 use std::{
 	cell::{Ref, RefCell, RefMut},
 	env::current_dir,
-	ffi::{OsStr, OsString},
+	ffi::OsString,
 	io::Write,
 	ops::Deref,
 	path::PathBuf,
@@ -12,10 +12,9 @@
 use clap::{ArgGroup, Parser};
 use serde::de::DeserializeOwned;
 use tempfile::NamedTempFile;
-use tokio::process::Command;
 
 use crate::{
-	command::CommandExt,
+	command::MyCommand,
 	fleetdata::{FleetData, FleetSecret, FleetSharedSecret},
 };
 
@@ -52,24 +51,24 @@
 		self.opts.localhost.as_ref().map(|s| s as &str) == Some(host)
 	}
 
-	pub fn command_on(&self, host: &str, program: impl AsRef<OsStr>, sudo: bool) -> Command {
-		if self.is_local(host) {
-			if sudo {
-				let mut cmd = Command::new("sudo");
-				cmd.arg(program);
-				cmd
-			} else {
-				Command::new(program)
-			}
-		} else {
-			let mut cmd = Command::new("ssh");
-			cmd.arg(host).arg("--");
-			if sudo {
-				cmd.arg("sudo");
-			}
-			cmd.arg(program);
-			cmd
+	pub async fn run_on(&self, host: &str, mut command: MyCommand, sudo: bool) -> Result<()> {
+		if sudo {
+			command = command.sudo();
+		}
+		if !self.is_local(host) {
+			command = command.ssh(host);
+		}
+		command.run().await
+	}
+	#[must_use]
+	pub async fn run_string_on(&self, host: &str, mut command: MyCommand, sudo: bool) -> Result<String> {
+		if sudo {
+			command = command.sudo();
+		}
+		if !self.is_local(host) {
+			command = command.ssh(host);
 		}
+		command.run_string().await
 	}
 
 	pub fn configuration_attr_name(&self, name: &str) -> OsString {
@@ -83,36 +82,36 @@
 	}
 
 	pub async fn list_hosts(&self) -> Result<Vec<String>> {
-		Command::new("nix")
-			.arg("eval")
+		let mut cmd = MyCommand::new("nix");
+		cmd.arg("eval")
 			.arg(self.configuration_attr_name("configuredHosts"))
 			.args(["--apply", "builtins.attrNames", "--json", "--show-trace"])
-			.args(&self.nix_args)
-			.run_nix_json()
+			.args(&self.nix_args);
+		cmd.run_nix_json()
 			.await
 	}
 	pub async fn shared_config_attr<T: DeserializeOwned>(&self, attr: &str) -> Result<T> {
-		Command::new("nix")
-			.arg("eval")
+		let mut cmd = MyCommand::new("nix");
+		cmd.arg("eval")
 			.arg(self.configuration_attr_name(&format!("configUnchecked.{}", attr)))
 			.args(["--json", "--show-trace"])
-			.args(&self.nix_args)
-			.run_nix_json()
+			.args(&self.nix_args);
+		cmd.run_nix_json()
 			.await
 	}
 	pub async fn shared_config_attr_names(&self, attr: &str) -> Result<Vec<String>> {
-		Command::new("nix")
-			.arg("eval")
+		let mut cmd = MyCommand::new("nix");
+		cmd.arg("eval")
 			.arg(self.configuration_attr_name(&format!("configUnchecked.{}", attr)))
 			.args(["--apply", "builtins.attrNames"])
 			.args(["--json", "--show-trace"])
-			.args(&self.nix_args)
-			.run_nix_json()
+			.args(&self.nix_args);
+		cmd.run_nix_json()
 			.await
 	}
 	pub async fn config_attr<T: DeserializeOwned>(&self, host: &str, attr: &str) -> Result<T> {
-		Command::new("nix")
-			.arg("eval")
+		let mut cmd = MyCommand::new("nix");
+		cmd.arg("eval")
 			.arg(
 				self.configuration_attr_name(&format!(
 					"configuredSystems.{}.config.{}",
@@ -120,8 +119,8 @@
 				)),
 			)
 			.args(["--json", "--show-trace"])
-			.args(&self.nix_args)
-			.run_nix_json()
+			.args(&self.nix_args);
+		cmd.run_nix_json()
 			.await
 	}
 
@@ -171,23 +170,20 @@
 
 	pub async fn decrypt_on_host(&self, host: &str, data: Vec<u8>) -> Result<Vec<u8>>{
 		let data = z85::encode(&data);
-		let encoded = self.command_on(host, "fleet-install-secrets", true)
-			.arg("decrypt")
-			.arg("--secret")
-			.arg(data).run_string().await.context("failed to call remote host for decrypt")?.trim().to_owned();
+		let mut cmd = MyCommand::new("fleet-install-secrets");
+		cmd.arg("decrypt").eqarg("--secret", data);
+		cmd = cmd.sudo().ssh(host);
+		let encoded = cmd.run_string().await.context("failed to call remote host for decrypt")?.trim().to_owned();
 		Ok(z85::decode(encoded).context("bad encoded data? outdated host?")?)
 	}
 	pub async fn reencrypt_on_host(&self, host: &str, data: Vec<u8>, targets: Vec<String>) -> Result<Vec<u8>>{
 		let data = z85::encode(&data);
-		let mut recmd = self.command_on(host, "fleet-install-secrets", true);
-		recmd
-			.arg("reencrypt")
-			.arg("--secret")
-			.arg(format!("\"{}\"", data.replace('$', "\\$")));
+		let mut recmd = MyCommand::new("fleet-install-secrets");
+		recmd.arg("reencrypt").eqarg("--secret",data);
 		for target in targets {
-			recmd.arg("--targets");
-			recmd.arg(format!("\"{target}\""));
+			recmd.eqarg("--targets", target);
 		}
+		recmd = recmd.sudo().ssh(host);
 		let encoded = recmd.run_string().await.context("failed to call remote host for decrypt")?.trim().to_owned();
 		Ok(z85::decode(encoded).context("bad encoded data? outdated host?")?)
 	}

--- a/cmds/fleet/src/keys.rs
+++ b/cmds/fleet/src/keys.rs
@@ -1,6 +1,7 @@
 use std::str::FromStr;
 
-use crate::{command::CommandExt, host::Config};
+use crate::command::MyCommand;
+use crate::host::Config;
 use anyhow::{anyhow, Result};
 use tracing::warn;
 
@@ -26,11 +27,9 @@
 			Ok(key)
 		} else {
 			warn!("Loading key for {}", host);
-			let key = self
-				.command_on(host, "cat", false)
-				.arg("/etc/ssh/ssh_host_ed25519_key.pub")
-				.run_string()
-				.await?;
+			let mut cmd = MyCommand::new("cat");
+			cmd.arg("/etc/ssh/ssh_host_ed25519_key.pub");
+			let key = self.run_string_on(host, cmd, false).await?;
 			self.update_key(host, key.clone());
 			Ok(key)
 		}

--- a/cmds/install-secrets/src/main.rs
+++ b/cmds/install-secrets/src/main.rs
@@ -250,7 +250,7 @@
 
 			if plaintext {
 				let s = String::from_utf8(decrypted).context("output is not utf8")?;
-				print!("{}", s);
+				print!("{s}");
 			} else {
 				println!("{}", SecretWrapper(decrypted));
 			}

--- a/modules/fleet/secrets.nix
+++ b/modules/fleet/secrets.nix
@@ -2,15 +2,6 @@
 let
   sharedSecret = with types; {
     options = {
-      owners = mkOption {
-        type = listOf str;
-        description = ''
-          For which owners this secret is currently encrypted,
-          if not matches expectedOwners - then this secret is considered outdated, and
-          should be regenerated/reencrypted
-        '';
-        default = [ ];
-      };
       expectedOwners = mkOption {
         type = listOf str;
         description = ''
@@ -25,12 +16,38 @@
         description = "Is this secret owner-dependent, and needs to be regenerated on ownership set change, or it may be just reencrypted";
       };
       generator = mkOption {
-        type = nullOr package;
-        description = ''
-          Derivation to execute for secret generation
+        type = nullOr (submodule {
+          packages = mkOption {
+            type = attrsOf package;
+            description = ''
+              Derivation to execute for shared secret generation (key = system).
+              This derivation should produce directory, with exactly two files:
+                - publicData
+                - encryptedSecretData
+
+              If null - secret value may only be created manually.
+            '';
+          };
+          expectedData = mkOption {
+            type = types.unspecified;
+            description = "Data expected to be used for secret generation, if doesn't match specified - secret should be regenerated";
+          };
+          dependencies = mkOption {
+            type = listOf str;
+            description = ''
+              List of secrets, on which this secret depends.
 
-          If null - may only be created manually
-        '';
+              During generation, generator command will be ran on host, which already has specified secrets generated.
+            '';
+            default = [];
+          };
+          data = mkOption {
+            type = types.unspecified;
+            description = "Data used for secret generation. Imported from fleet.nix";
+            default = null;
+            internal = true;
+          };
+        });
         default = null;
       };
       expireIn = mkOption {
@@ -38,15 +55,28 @@
         description = "Time in hours, in which this secret should be regenerated";
         default = null;
       };
+
+      owners = mkOption {
+        type = listOf str;
+        description = ''
+          For which owners this secret is currently encrypted,
+          if not matches expectedOwners - then this secret is considered outdated, and
+          should be regenerated/reencrypted.
+
+          Imported from fleet.nix
+        '';
+        default = [ ];
+      };
       public = mkOption {
         type = nullOr str;
-        description = "Secret public data";
+        description = "Secret public data. Imported from fleet.nix";
         default = null;
       };
       secret = mkOption {
         type = nullOr str;
-        description = "Encrypted secret data";
+        description = "Encrypted secret data. Imported from fleet.nix";
         default = null;
+        internal = true;
       };
     };
   };

--- a/nixos/secrets.nix
+++ b/nixos/secrets.nix
@@ -5,14 +5,14 @@
 let
   sysConfig = config;
   secretType = types.submodule ({ config, ... }: {
-    config = rec {
-      stableSecretPath = mkOptionDefault "/run/secrets/secret-stable-${config._module.args.name}";
-      secretPath = mkOptionDefault "/run/secrets/secret-${config.secretHash}-${config._module.args.name}";
-      secretHash = mkOptionDefault (if config.secret != null then (builtins.hashString "sha1" config.secret) else "<missingno>");
+    config = let secretName = config._module.args.name; in rec {
+      stableSecretPath = mkOptionDefault "/run/secrets/secret-stable-${secretName}";
+      secretPath = mkOptionDefault "/run/secrets/secret-${config.secretHash}-${secretName}";
+      secretHash = mkOptionDefault (if config.secret != null then (builtins.hashString "sha1" config.secret) else throw "secret is not defined for secret ${secretName}");
 
-      stablePublicPath = mkOptionDefault "/run/secrets/public-stable-${config._module.args.name}";
-      publicPath = mkOptionDefault "/run/secrets/public-${config.publicHash}-${config._module.args.name}";
-      publicHash = mkOptionDefault (if config.public != null then (builtins.hashString "sha1" config.public) else "<missingno>");
+      stablePublicPath = mkOptionDefault "/run/secrets/public-stable-${secretName}";
+      publicPath = mkOptionDefault "/run/secrets/public-${config.publicHash}-${secretName}";
+      publicHash = mkOptionDefault (if config.public != null then (builtins.hashString "sha1" config.public) else throw "public is not defined for secret ${secretName}");
     };
     options = {
       public = mkOption {
@@ -77,7 +77,13 @@
   });
   secretsFile = pkgs.writeTextFile {
     name = "secrets.json";
-    text = builtins.toJSON config.secrets;
+    text = builtins.toJSON (mapAttrs (_: value: rec {
+      inherit (value) group mode owner secret public;
+      publicPath = if public != null then value.publicPath else "/missingno";
+      stablePublicPath = if public != null then value.stablePublicPath else "/missingno";
+      secretPath = if secret != null then value.secretPath else "/missingno";
+      stableSecretPath = if secret != null then value.stableSecretPath else "/missingno";
+    }) config.secrets);
   };
 in
 {