git.delta.rocks / jrsonnet / refs/commits / f31248fac9ac

1use std::{2	collections::{BTreeMap, BTreeSet, HashSet},3	io::{self, Read, Write, stdin, stdout},4	path::PathBuf,5};67use anyhow::{Context, Result, anyhow, bail, ensure};8use chrono::{DateTime, Utc};9use clap::Parser;10use fleet_base::{11	fleetdata::{FleetSecretData, FleetSecretDistribution, FleetSecretPart, encrypt_secret_data},12	host::Config,13	opts::FleetOpts,14	secret::{Expectations, RegenerationReason, SharedSecretDefinition, secret_needs_regeneration},15};16use fleet_shared::SecretData;17use nix_eval::{NixType, Value, nix_go, nix_go_json};18use owo_colors::OwoColorize;19use serde::Deserialize;20use tabled::{Table, Tabled};21use tokio::{fs::read, task::spawn_blocking};22use tracing::{Instrument, error, info, info_span, warn};2324#[derive(Parser)]25pub enum Secret {26	AddManager,27	/// Force load host keys for all defined hosts28	ForceKeys,29	/// Read secret from remote host, requires sudo on one of the owning hosts30	Read {31		/// Secret name to read32		name: String,3334		/// Distribution with what machine to read35		/// If not shared between multiple - defaults to single owner36		#[clap(short = 'm', long)]37		machine: Option<String>,3839		/// Which private secret part to read40		#[clap(short = 'p', long, default_value = "secret")]41		part: String,4243		/// Which host should we use to decrypt, in case if reencryption is required, without44		/// regeneration45		#[clap(long)]46		prefer_identities: Vec<String>,47	},48	Regenerate {49		/// Which host should we use to decrypt, in case if reencryption is required, without50		/// regeneration51		#[clap(long)]52		prefer_identities: Vec<String>,53		/// Only regenerate shared secrets54		#[clap(long)]55		skip_hosts: bool,56	},57	List {},58	Edit {59		name: String,60		#[clap(short = 'm', long)]61		machine: String,6263		#[clap(long)]64		add: bool,6566		/// Which private secret part to read67		#[clap(short = 'p', long, default_value = "secret")]68		part: String,69	},70}7172#[allow(clippy::too_many_arguments)]73#[tracing::instrument(skip(config, secret, definition, prefer_identities))]74async fn maybe_regenerate_shared_secret(75	secret_name: &str,76	config: &Config,77	mut secret: FleetSecretDistribution,78	definition: SharedSecretDefinition,79	prefer_identities: &[String],80	expectations: &Expectations,81) -> Result<FleetSecretDistribution> {82	let reason = secret_needs_regeneration(&secret.secret, &secret.owners, expectations);83	let value = definition.definition_value();8485	let (should_reencrypt, reason) = match reason {86		Some(RegenerationReason::OwnersAdded(_)) => {87			// Secret always needs to be reencrypted for new owners to be able to read it88			(89				true,90				if nix_go_json!(value.regenerateOnOwnerAdded) {91					reason92				} else {93					None94				},95			)96		}97		Some(RegenerationReason::OwnersRemoved(_)) => {98			// No need to reencrypt, we can just leave stanzas in place.99			if nix_go_json!(value.regenerateOnOwnerRemoved) {100				(true, reason)101			} else {102				(false, None)103			}104		}105		Some(_) => (true, reason),106		None => (false, None),107	};108109	if let Some(reason) = reason {110		info!("secret needs to be regenerated: {reason}");111		let generated = generate_shared(config, secret_name, definition, expectations).await?;112		Ok(generated)113	} else if should_reencrypt {114		info!("secret needs to be reencrypted");115		let identity_holder = if !prefer_identities.is_empty() {116			prefer_identities117				.iter()118				.find(|i| secret.owners.iter().any(|s| s == *i))119		} else {120			secret.owners.first()121		};122		let Some(identity_holder) = identity_holder else {123			bail!("no available holder found");124		};125126		for (part_name, part) in secret.secret.parts.iter_mut() {127			let _span = info_span!("part reencryption", part_name);128			if !part.raw.encrypted {129				continue;130			}131			let host = config.host(identity_holder).await?;132			let encrypted = host133				.reencrypt(134					part.raw.clone(),135					expectations.owners.iter().cloned().collect(),136				)137				.await?;138			part.raw = encrypted;139		}140		secret.owners = expectations.owners.clone();141		Ok(secret)142	} else {143		Ok(secret)144	}145}146147#[derive(Deserialize)]148#[serde(rename_all = "camelCase")]149enum GeneratorKind {150	Impure,151	Pure,152}153154async fn generate_pure(155	_config: &Config,156	_display_name: &str,157	_secret: Value,158	_default_generator: Value,159	_expectations: &Expectations,160) -> Result<FleetSecretData> {161	bail!("pure generators are broken for now")162}163async fn generate_impure(164	config: &Config,165	_display_name: &str,166	secret: Value,167	default_generator: Value,168	expectations: &Expectations,169) -> Result<FleetSecretData> {170	let generator = nix_go!(secret.generator);171	let on: Option<String> = nix_go_json!(default_generator.impureOn);172173	let nixpkgs = &config.nixpkgs;174175	let host = if let Some(on) = &on {176		config.host(on).await?177	} else {178		config.local_host()179	};180	let on_pkgs = host.pkgs().await?;181	let mk_secret_generators = nix_go!(on_pkgs.mkSecretGenerators);182183	let mut recipients = Vec::new();184	for owner in &expectations.owners {185		let key = config.key(owner).await?;186		recipients.push(key);187	}188	let generators = nix_go!(mk_secret_generators(Obj { recipients }));189	let pkgs_and_generators = on_pkgs.attrs_update(generators)?;190191	let call_package = nix_go!(nixpkgs.lib.callPackageWith(pkgs_and_generators));192193	let generator = nix_go!(call_package(generator)(Obj {}));194195	let generator = spawn_blocking(move || generator.build("out"))196		.await197		.expect("nix build shouldn't fail")?;198	let generator = host.remote_derivation(&generator).await?;199200	let out_parent = host.mktemp_dir().await?;201	let out = format!("{out_parent}/out");202203	let mut r#gen = host.cmd(generator).await?;204	r#gen.env("out", &out);205	if on.is_none() {206		// This path is local, thus we can feed `OsString` directly to env var... But I don't think that's necessary to handle.207		let project_path: String = config208			.directory209			.clone()210			.into_os_string()211			.into_string()212			.map_err(|s| anyhow!("fleet project path is not utf-8: {s:?}"))?;213		r#gen.env("FLEET_PROJECT", project_path);214	}215	r#gen.run().await.context("impure generator")?;216217	{218		let marker = host.read_file_text(format!("{out}/marker")).await?;219		ensure!(marker == "SUCCESS", "generation not succeeded");220	}221222	let mut parts = BTreeMap::new();223	for part in host.read_dir(&out).await? {224		if part == "created_at" || part == "expires_at" || part == "marker" {225			continue;226		}227		let contents: SecretData = host228			.read_file_text(format!("{out}/{part}"))229			.await?230			.parse()231			.map_err(|e| anyhow!("failed to decode secret {out:?} part {part:?}: {e}"))?;232		parts.insert(part.to_owned(), FleetSecretPart { raw: contents });233	}234235	let created_at = host.read_file_value(format!("{out}/created_at")).await?;236	let expires_at = host.read_file_value(format!("{out}/expires_at")).await.ok();237238	let new_data = FleetSecretData {239		created_at,240		expires_at,241		parts,242		generation_data: expectations.generation_data.clone(),243	};244245	if let Some(reason) = secret_needs_regeneration(&new_data, &expectations.owners, expectations) {246		bail!("newly generated secret needs to be regenerated: {reason}")247	}248249	Ok(new_data)250}251252async fn generate(253	config: &Config,254	display_name: &str,255	secret: Value,256	expectations: &Expectations,257) -> Result<FleetSecretData> {258	let generator = nix_go!(secret.generator);259	// Can't properly check on nix module system level260	{261		let gen_ty = generator.type_of();262		if matches!(gen_ty, NixType::Null) {263			bail!("secret has no generator defined, can't automatically generate it.");264		}265		if matches!(gen_ty, NixType::Attrs) {266			if !generator.has_field("__functor")? {267				bail!("generator should be functor, got {gen_ty:?}");268			}269		} else if matches!(gen_ty, NixType::Function) {270			bail!("generator should be functor, got {gen_ty:?}");271		}272	}273	let nixpkgs = &config.nixpkgs;274	let default_pkgs = &config.default_pkgs;275	let default_mk_secret_generators = nix_go!(default_pkgs.mkSecretGenerators);276	// Generators provide additional information in passthru, to access277	// passthru we should call generator, but information about where this generator is supposed to build278	// is located in passthru... Thus evaluating generator on host.279	//280	// Maybe it is also possible to do some magic with __functor?281	//282	// I don't want to make modules always responsible for additional secret data anyway,283	// so it should be in derivation, and not in the secret data itself.284	let generators = nix_go!(default_mk_secret_generators(Obj {285		recipients: <Vec<String>>::new(),286	}));287	let pkgs_and_generators = default_pkgs.clone().attrs_update(generators)?;288289	let call_package = nix_go!(nixpkgs.lib.callPackageWith(pkgs_and_generators));290	let default_generator = nix_go!(call_package(generator)(Obj {}));291292	let kind: GeneratorKind = nix_go_json!(default_generator.generatorKind);293294	match kind {295		GeneratorKind::Impure => {296			generate_impure(297				config,298				display_name,299				secret,300				default_generator,301				expectations,302			)303			.await304		}305		GeneratorKind::Pure => {306			generate_pure(307				config,308				display_name,309				secret,310				default_generator,311				expectations,312			)313			.await314		}315	}316}317async fn generate_shared(318	config: &Config,319	display_name: &str,320	secret: SharedSecretDefinition,321	expectations: &Expectations,322) -> Result<FleetSecretDistribution> {323	// let owners: Vec<String> = nix_go_json!(secret.expectedOwners);324	Ok(FleetSecretDistribution {325		managed: Some(true),326		secret: generate(327			config,328			display_name,329			secret.definition_value(),330			expectations,331		)332		.await?,333		owners: expectations.owners.clone(),334	})335}336337async fn parse_public(338	public: Option<String>,339	public_file: Option<PathBuf>,340) -> Result<Option<SecretData>> {341	Ok(match (public, public_file) {342		(Some(v), None) => Some(SecretData {343			data: v.into(),344			encrypted: false,345		}),346		(None, Some(v)) => Some(SecretData {347			data: read(v).await?,348			encrypted: false,349		}),350		(Some(_), Some(_)) => {351			bail!("only public or public_file should be set")352		}353		(None, None) => None,354	})355}356357async fn parse_secret() -> Result<Option<Vec<u8>>> {358	let mut input = vec![];359	stdin().read_to_end(&mut input)?;360	if input.is_empty() {361		Ok(None)362	} else {363		Ok(Some(input))364	}365}366367fn parse_machines(368	initial: BTreeSet<String>,369	machines: Option<Vec<String>>,370	mut add_machines: Vec<String>,371	mut remove_machines: Vec<String>,372) -> Result<BTreeSet<String>> {373	if machines.is_none() && add_machines.is_empty() && remove_machines.is_empty() {374		bail!("no operation");375	}376377	let initial_machines = initial.clone();378	let mut target_machines = initial;379	info!("Currently encrypted for {initial_machines:?}");380381	if let Some(machines) = machines {382		ensure!(383			add_machines.is_empty() && remove_machines.is_empty(),384			"can't combine --machines and --add-machines/--remove-machines"385		);386		let target = initial_machines.iter().collect::<HashSet<_>>();387		let source = machines.iter().collect::<HashSet<_>>();388		for removed in target.difference(&source) {389			remove_machines.push((*removed).clone());390		}391		for added in source.difference(&target) {392			add_machines.push((*added).clone());393		}394	}395396	for machine in &remove_machines {397		if !target_machines.remove(machine) {398			warn!("secret is not enabled for {machine}");399		}400	}401	for machine in &add_machines {402		if !target_machines.insert(machine.to_owned()) {403			warn!("secret is already added to {machine}");404		}405	}406	if !remove_machines.is_empty() {407		// TODO: maybe force secret regeneration?408		// Not that useful without revokation.409		warn!(410			"secret will not be regenerated for removed machines, and until host rebuild, they will still possess the ability to decode secret"411		);412	}413	Ok(target_machines)414}415impl Secret {416	pub async fn run(self, config: &Config, opts: &FleetOpts) -> Result<()> {417		match self {418			Secret::AddManager => {419				todo!("part of fleet-pusher")420			}421			Secret::ForceKeys => {422				for host in config.list_hosts().await? {423					if opts.should_skip(&host).await? {424						continue;425					}426					config.key(&host.name).await?;427				}428			}429			Secret::Read {430				name,431				machine,432				part: part_name,433				mut prefer_identities,434			} => {435				let Some(secret) = config.shared_secret(&name) else {436					bail!("secret doesn't exists");437				};438439				let dist = if secret.len() == 1 {440					&secret[0]441				} else if let Some(machine) = machine {442					let dist = secret.get(&machine);443					let Some(dist) = dist else {444						bail!("machine {machine} has no distribution of secret {name}");445					};446					prefer_identities.push(machine);447					dist448				} else {449					bail!(450						"secret {name} has shares, but no --machine specified for specifing which do you need"451					)452				};453454				let Some(part) = dist.secret.parts.get(&part_name) else {455					bail!("no part {part_name} in secret {name}");456				};457				let data = if part.raw.encrypted {458					let identity_holder = if !prefer_identities.is_empty() {459						prefer_identities460							.iter()461							.find(|i| dist.owners.iter().any(|s| s == *i))462					} else {463						dist.owners.first()464					};465					let Some(identity_holder) = identity_holder else {466						bail!("no available holder found");467					};468					let host = config.host(identity_holder).await?;469					host.decrypt(part.raw.clone()).await?470				} else {471					part.raw.data.clone()472				};473				stdout().write_all(&data)?;474			}475			Secret::Regenerate {476				prefer_identities,477				skip_hosts,478			} => {479				/*480								info!("checking for secrets to regenerate");481								let expected_shared_set = config482									.list_configured_shared()483									.await?484									.into_iter()485									.collect::<HashSet<_>>();486								let stored_shared_set = config.list_secrets().into_iter().collect::<HashSet<_>>();487								{488									// Generate missing shared489									let _span = info_span!("shared").entered();490									for missing in expected_shared_set.difference(&stored_shared_set) {491										let definition = config.shared_secret_definition(missing)?;492										if !definition.is_managed()? {493											info!("skipping unmanaged secret: {missing}");494											continue;495										}496										let expectations = definition497											.expectations()498											.with_context(|| format!("expectations for shared {missing:?}"))?;499										info!("generating secret: {missing}");500										let shared = generate_shared(config, missing, definition, &expectations)501											.in_current_span()502											.await?;503										config.replace_shared(missing.to_string(), shared)504									}505								}506								if !skip_hosts {507									for host in config.list_hosts().await? {508										if opts.should_skip(&host).await? {509											continue;510										}511512										let _span = info_span!("host", host = host.name).entered();513										let expected_set = host514											.list_defined_secrets()?515											.into_iter()516											.collect::<HashSet<_>>();517										let stored_set = config518											.list_secrets_for_owner(&host.name)519											.into_iter()520											.collect::<HashSet<_>>();521										for missing_secret in expected_set.difference(&stored_set) {522											let secret = host.secret_definition(missing_secret)?;523											if secret.is_shared()? {524												continue;525											}526											info!("generating missing secret: {missing_secret}");527											let expectations = secret.expectations().with_context(|| {528												format!("expectations for {missing_secret:?} of {:?}", host.name)529											})?;530											let generated = match generate(531												config,532												missing_secret,533												secret.definition_value()?,534												&expectations,535											)536											.in_current_span()537											.await538											{539												Ok(v) => v,540												Err(e) => {541													error!("{e:?}");542													continue;543												}544											};545											config.insert_secret(host.name, missing_secret.to_string(), generated)546										}547										for known_secret in stored_set.intersection(&expected_set) {548											let secret = host.secret_definition(known_secret)?;549											if secret.is_shared()? {550												continue;551											}552											info!("updating secret: {known_secret}");553											let data = config.host_secret(&host.name, known_secret)?;554											let expectations = secret.expectations()?;555											if let Some(regen_reason) = data.needs_regeneration(&expectations) {556												info!("needs regeneration: {regen_reason}");557												let generated = match generate(558													config,559													known_secret,560													secret.definition_value()?,561													&expectations,562												)563												.in_current_span()564												.await565												{566													Ok(v) => v,567													Err(e) => {568														error!("{e:?}");569														continue;570													}571												};572												config.insert_secret(573													&host.name,574													known_secret.to_string(),575													FleetLegacyHostSecret {576														managed: Some(true),577														secret: generated,578													},579												)580											}581										}582										for removed_secret in stored_set.difference(&expected_set) {583											let definition = host.secret_definition(removed_secret)?;584											if definition.is_shared()? {585												continue;586											}587											info!("removing secret: {removed_secret}");588											config.remove_secret(&host.name, removed_secret);589										}590									}591								}592								for known_secret in stored_shared_set.intersection(&expected_shared_set) {593									info!("updating shared secret: {known_secret}");594									let data = config.shared_secret(known_secret)?.expect("exists");595596									let definition = config.shared_secret_definition(known_secret)?;597									let expectations = definition.expectations()?;598									config.replace_shared(599										known_secret.to_owned(),600										maybe_regenerate_shared_secret(601											known_secret,602											config,603											data,604											definition,605											&prefer_identities,606											&expectations,607										)608										.await?,609									);610								}611								for removed_secret in stored_shared_set.difference(&expected_shared_set) {612									info!("removing shared secret: {removed_secret}");613									config.remove_shared(removed_secret);614								}615				*/616				todo!()617			}618			Secret::List {} => {619				let _span = info_span!("loading secrets").entered();620				let configured = config.list_configured_shared().await?;621				#[derive(Tabled)]622				struct SecretDisplay {623					#[tabled(rename = "Name")]624					name: String,625					#[tabled(rename = "Owners")]626					owners: String,627				}628				let mut table = vec![];629				for name in configured.iter().cloned() {630					let config = config.clone();631					let data = config.shared_secret(&name).expect("exists");632					let definition = config.shared_secret_definition(&name)?;633					let expectations = definition.expectations()?;634					let owners = data635						.owners()636						.map(|o| {637							if expectations.owners.contains(o) {638								o.green().to_string()639							} else {640								o.red().to_string()641							}642						})643						.collect::<Vec<_>>();644					table.push(SecretDisplay {645						owners: owners.join(", "),646						name,647					})648				}649				info!("loaded\n{}", Table::new(table).to_string())650			}651			Secret::Edit {652				name,653				machine,654				part,655				add,656			} => {657				let secret = config658					.host_secret(&machine, &name)659					.context("secret not found")?;660				if let Some(data) = secret.secret.parts.get(&part) {661					let host = config.host(&machine).await?;662					let secret = host.decrypt(data.raw.clone()).await?;663					String::from_utf8(secret).context("secret is not utf8")?664				} else if add {665					String::new()666				} else {667					bail!("part {part} not found in secret {name}. Did you mean to `--add` it?");668				};669			}670		}671		Ok(())672	}673}674675/*676async fn edit_temp_file(677	builder: tempfile::Builder<'_, '_>,678	r: Vec<u8>,679	header: &str,680	comment: &str,681) -> Result<(Vec<u8>, Option<String>), anyhow::Error> {682	if !stdin().is_tty() {683		// TODO: Also try to open /dev/tty directly?684		bail!("stdin is not tty, can't open editor");685	}686687	use std::fmt::Write;688	let mut file = builder.tempfile()?;689690	let mut full_header = String::new();691	let mut had = false;692	for line in header.trim_end().lines() {693		had = true;694		writeln!(&mut full_header, "{comment}{line}")?;695	}696	if had {697		writeln!(&mut full_header, "{}", comment.trim_end())?;698	}699	writeln!(700		&mut full_header,701		"{comment}Do not touch this header! It will be removed automatically"702	)?;703704	file.write_all(full_header.as_bytes())?;705	file.write_all(&r)?;706707	let abs_path = file.into_temp_path();708	let editor = std::env::var_os("VISUAL")709		.or_else(|| std::env::var_os("EDITOR"))710		.unwrap_or_else(|| "vi".into());711	let editor_args = shlex::bytes::split(editor.as_encoded_bytes())712		.ok_or_else(|| anyhow!("EDITOR env var has wrong syntax"))?;713	let editor_args = editor_args714		.into_iter()715		.map(|v| {716			// Only ASCII subsequences are replaced717			unsafe { OsString::from_encoded_bytes_unchecked(v) }718		})719		.collect_vec();720	let Some((editor, args)) = editor_args.split_first() else {721		bail!("EDITOR env var has no command");722	};723	let mut command = Command::new(editor);724	command.args(args);725726	let path_arg = abs_path.canonicalize()?;727728	// TODO: Save full state, using tcget/_getmode/_setmode729	let was_raw = terminal::is_raw_mode_enabled()?;730	terminal::enable_raw_mode()?;731732	let status = command.arg(path_arg).status().await;733734	if !was_raw {735		terminal::disable_raw_mode()?;736	}737738	let success = match status {739		Ok(s) => s.success(),740		Err(e) if e.kind() == io::ErrorKind::NotFound => {741			bail!("editor not found")742		}743		Err(e) => bail!("editor spawn error: {e}"),744	};745746	let mut file = std::fs::read(&abs_path).context("read editor output")?;747	let Some(v) = file.strip_prefix(full_header.as_bytes()) else {748		todo!();749	};750	todo!();751752	// Ok((success, abs_path))753}754*/