git.delta.rocks / jrsonnet / refs/commits / f31248fac9ac

1use std::{2	cell::OnceCell,3	collections::BTreeSet,4	ffi::{OsStr, OsString},5	fmt::Display,6	io::Write,7	ops::Deref,8	path::PathBuf,9	str::FromStr,10	sync::{Arc, Mutex, MutexGuard, OnceLock},11};1213use anyhow::{Context, Result, anyhow, bail, ensure};14use fleet_shared::SecretData;15use nix_eval::{Value, nix_go, nix_go_json, util::assert_warn};16use openssh::{ControlPersist, SessionBuilder};17use serde::de::DeserializeOwned;18use tabled::Tabled;19use tempfile::NamedTempFile;20use time::{UtcDateTime, format_description};21use tracing::warn;2223use crate::{24	command::MyCommand,25	fleetdata::{FleetData, FleetSecretData, FleetSecretDistribution, FleetSecretDistributions},26	secret::{HostSecretDefinition, SharedSecretDefinition},27};2829pub struct FleetConfigInternals {30	/// Fleet project directory, containing fleet.nix file.31	pub directory: PathBuf,32	/// builtins.currentSystem33	pub local_system: String,34	pub data: Mutex<FleetData>,35	pub nix_args: Vec<OsString>,36	/// fleet_config.config37	pub config_field: Value,38	/// flake.output39	pub flake_outputs: Value,40	// TODO: Remove with connectivity refactor41	pub localhost: String,4243	/// import nixpkgs {system = local};44	pub default_pkgs: Value,45	/// inputs.nixpkgs46	pub nixpkgs: Value,47}4849// TODO: Make field not pub50#[derive(Clone)]51pub struct Config(pub Arc<FleetConfigInternals>);5253impl Deref for Config {54	type Target = FleetConfigInternals;5556	fn deref(&self) -> &Self::Target {57		&self.058	}59}6061#[derive(Clone, Copy, Debug)]62pub enum EscalationStrategy {63	Sudo,64	Run0,65	Su,66}6768#[derive(Clone, PartialEq, Copy, Debug)]69pub enum DeployKind {70	/// NixOS => NixOS managed by fleet71	UpgradeToFleet,72	/// NixOS managed by fleet => NixOS managed by fleet73	Fleet,74	/// Remote host has /mnt, /mnt/boot mounted,75	/// generated config is added to fleet configuration.76	NixosInstall,77	/// Remote host has some system and nix installed in multi-user mode (/nix is owned by root),78	/// generated config is added to fleet configuration,79	/// and /etc/NIXOS_LUSTRATE exists, fleet will perform the rest.80	NixosLustrate,81}8283impl FromStr for DeployKind {84	type Err = anyhow::Error;85	fn from_str(s: &str) -> std::result::Result<Self, Self::Err> {86		match s {87			"upgrade-to-fleet" => Ok(Self::UpgradeToFleet),88			"fleet" => Ok(Self::Fleet),89			"nixos-install" => Ok(Self::NixosInstall),90			"nixos-lustrate" => Ok(Self::NixosLustrate),91			v => bail!(92				"unknown deploy_kind: {v}; expected on of \"upgrade-to-fleet\", \"fleet\", \"nixos-install\", \"nixos-lustrate\""93			),94		}95	}96}97pub struct ConfigHost {98	config: Config,99	pub name: String,100	groups: OnceCell<Vec<String>>,101102	// TODO: Both of those values are taken from host opts, there should be a cleaner way to specify it103	deploy_kind: OnceCell<DeployKind>,104	session_destination: OnceCell<String>,105	legacy_ssh_store: OnceCell<bool>,106107	pub host_config: Option<Value>,108	pub nixos_config: OnceCell<Value>,109	pub nixos_unchecked_config: OnceCell<Value>,110	pub pkgs_override: Option<Value>,111112	// TODO: Move command helpers away with connectivity refactor113	pub local: bool,114	pub session: OnceLock<Arc<openssh::Session>>,115}116117#[derive(Debug, Clone, Copy)]118pub enum GenerationStorage {119	Deployer,120	Machine,121	Pusher,122}123impl GenerationStorage {124	fn prefix(&self) -> &'static str {125		match self {126			GenerationStorage::Deployer => "deployer.",127			GenerationStorage::Machine => "",128			GenerationStorage::Pusher => "pusher.",129		}130	}131}132133#[derive(Tabled, Debug)]134pub struct Generation {135	#[tabled(rename = "ID", format("{}", self.rollback_id()))]136	pub id: u32,137	#[tabled(rename = "Current")]138	pub current: bool,139	#[tabled(rename = "Created at")]140	pub datetime: UtcDateTime,141	#[tabled(format = "{:?}")]142	pub store_path: PathBuf,143	#[tabled(skip)]144	pub location: GenerationStorage,145}146impl Generation {147	pub fn rollback_id(&self) -> String {148		format!("{}{}", self.location.prefix(), self.id)149	}150}151152fn parse_generation_line(g: &str) -> Option<Generation> {153	let mut parts = g.split_whitespace();154	let id = parts.next()?;155	let id: u32 = id.parse().ok()?;156	let date = parts.next()?;157	let time = parts.next()?;158	let current = if let Some(current) = parts.next() {159		if current == "(current)" {160			Some(true)161		} else {162			None163		}164	} else {165		Some(false)166	};167	let current = current?;168	if parts.next().is_some() {169		warn!("unexpected text after generation: {g}");170	}171172	let format = format_description::parse("[year]-[month]-[day] [hour]:[minute]:[second]")173		.expect("valid format");174	let datetime = UtcDateTime::parse(&format!("{date} {time}"), &format).ok()?;175176	Some(Generation {177		id,178		current,179		datetime,180		store_path: PathBuf::new(),181		location: GenerationStorage::Machine,182	})183}184// TODO: Move command helpers away with connectivity refactor185impl ConfigHost {186	pub async fn list_generations(&self, profile: &str) -> Result<Vec<Generation>> {187		let mut cmd = self.cmd("nix-env").await?;188		cmd.comparg("--profile", format!("/nix/var/nix/profiles/{profile}"))189			.arg("--list-generations")190			.env("TZ", "UTC");191		// Sudo is required because --list-generations tries to acquire profile lock192		let data = cmd.sudo().run_string().await?;193		let mut generations = data194			.split('\n')195			.map(|e| e.trim())196			.filter(|&l| !l.is_empty())197			.filter_map(|g| {198				let generation = parse_generation_line(g);199				if generation.is_none() {200					warn!("bad generation: {g}");201				};202				generation203			})204			.collect::<Vec<_>>();205		for ele in generations.iter_mut() {206			let mut cmd = self.cmd("readlink").await?;207			cmd.arg("--")208				.arg(format!("/nix/var/nix/profiles/{profile}-{}-link", ele.id));209			let path = cmd.run_string().await?;210			ele.store_path = PathBuf::from(path.trim_end_matches("\n"));211		}212213		Ok(generations)214	}215216	pub fn set_session_destination(&self, dest: String) {217		self.session_destination218			.set(dest)219			.expect("session destination is already set")220	}221	pub fn set_deploy_kind(&self, kind: DeployKind) {222		self.deploy_kind223			.set(kind)224			.expect("deploy kind is already set");225	}226	pub fn set_legacy_ssh_store(&self, legacy: bool) {227		self.legacy_ssh_store228			.set(legacy)229			.expect("legacy ssh store is already set")230	}231	pub async fn deploy_kind(&self) -> Result<DeployKind> {232		if let Some(kind) = self.deploy_kind.get() {233			return Ok(*kind);234		}235		let is_fleet_managed = match self.file_exists("/etc/FLEET_HOST").await {236			Ok(v) => v,237			Err(e) => {238				bail!("failed to query remote system kind: {e}");239			}240		};241		if !is_fleet_managed {242			bail!(243				"{}",244				indoc::indoc! {"245				host is not marked as managed by fleet246				if you're not trying to lustrate/install system from scratch,247				you should either248					1. manually create /etc/FLEET_HOST file on the target host,249					2. use ?deploy_kind=fleet host argument if you're upgrading from older version of fleet250					3. use ?deploy_kind=upgrade_to_fleet if you're upgrading from plain nixos to fleet-managed nixos251			"}252			);253		}254		// TOCTOU is possible255		let _ = self.deploy_kind.set(DeployKind::Fleet);256		Ok(*self.deploy_kind.get().expect("deploy kind is just set"))257	}258	pub async fn escalation_strategy(&self) -> Result<EscalationStrategy> {259		// Prefer sudo, as run0 has some gotchas with polkit260		// and too many repeating prompts.261		if (self.find_in_path("sudo").await).is_ok() {262			return Ok(EscalationStrategy::Sudo);263		}264		if (self.find_in_path("run0").await).is_ok() {265			return Ok(EscalationStrategy::Run0);266		}267		Ok(EscalationStrategy::Su)268	}269	async fn open_session(&self) -> Result<Arc<openssh::Session>> {270		assert!(!self.local, "do not open ssh connection to local session");271		// FIXME: TOCTOU272		if let Some(session) = &self.session.get() {273			return Ok((*session).clone());274		};275		let mut session = SessionBuilder::default();276		session.control_persist(ControlPersist::ClosedAfterInitialConnection);277278		let dest = self.session_destination.get().unwrap_or(&self.name);279		let session = session280			.connect(&dest)281			.await282			.map_err(|e| anyhow!("ssh error while connecting to {}: {e:#?}", self.name))?;283		let session = Arc::new(session);284		self.session.set(session.clone()).expect("TOCTOU happened");285		Ok(session)286	}287	pub async fn mktemp_dir(&self) -> Result<String> {288		let mut cmd = self.cmd("mktemp").await?;289		cmd.arg("-d");290		let path = cmd.run_string().await?;291		Ok(path.trim_end().to_owned())292	}293	pub async fn file_exists(&self, path: impl AsRef<OsStr>) -> Result<bool> {294		let mut cmd = self.cmd("sh").await?;295		cmd.arg("-c")296			.arg("test -e \"$1\" && echo true || echo false")297			.arg("_")298			.arg(path);299		cmd.run_value().await300	}301	pub async fn read_file_bin(&self, path: impl AsRef<OsStr>) -> Result<Vec<u8>> {302		let mut cmd = self.cmd("cat").await?;303		cmd.arg(path);304		cmd.run_bytes().await305	}306	pub async fn read_file_text(&self, path: impl AsRef<OsStr>) -> Result<String> {307		let mut cmd = self.cmd("cat").await?;308		cmd.arg(path);309		cmd.run_string().await310	}311	pub async fn read_dir(&self, path: impl AsRef<OsStr>) -> Result<Vec<String>> {312		let mut cmd = self.cmd("ls").await?;313		cmd.arg(path);314		let out = cmd.run_string().await?;315		let mut lines = out.split('\n');316		if let Some(last) = lines.next_back() {317			ensure!(last.is_empty(), "output of ls should end with newline");318		}319		Ok(lines.map(ToOwned::to_owned).collect())320	}321	#[allow(dead_code)]322	pub async fn read_file_json<D: DeserializeOwned>(&self, path: impl AsRef<OsStr>) -> Result<D> {323		let text = self.read_file_text(path).await?;324		Ok(serde_json::from_str(&text)?)325	}326	pub async fn read_env(&self, env: &str) -> Result<String> {327		let mut cmd = self.cmd("printenv").await?;328		cmd.arg(env);329		cmd.run_string().await330	}331	pub async fn find_in_path(&self, command: &str) -> Result<String> {332		// // `which` is not a part of coreutils, and it might not exist on machine.333		// let path = self.read_env("PATH").await?;334		// // Assuming delimiter is :, we don't work with windows host, this check will be much335		// // more sophisticated in remowt backend (and quicker, since actual PATH search will be done on remote machine)336		// for ele in path.split(':') {337		// 	let test_path = format!("{ele}/{cmd}");338		// 	test -x etc339		// }340		// let mut cmd = self.cmd("printenv").await?;341		// cmd.arg(env);342		// Ok(cmd.run_string().await?)343		// Assuming this is an environment issue if which doesn't exist, will be fixed with remowt.344		let mut cmd = self345			.cmd_escalation(346				// Not used347				EscalationStrategy::Su,348				"which",349			)350			.await?;351		cmd.arg(command);352		cmd.run_string().await353	}354	pub async fn read_file_value<D: FromStr>(&self, path: impl AsRef<OsStr>) -> Result<D>355	where356		<D as FromStr>::Err: Display,357	{358		let text = self.read_file_text(path).await?;359		D::from_str(&text).map_err(|e| anyhow!("failed to parse value: {e}"))360	}361	pub async fn cmd(&self, cmd: impl AsRef<OsStr>) -> Result<MyCommand> {362		self.cmd_escalation(self.escalation_strategy().await?, cmd)363			.await364	}365	pub async fn cmd_escalation(366		&self,367		escalation: EscalationStrategy,368		cmd: impl AsRef<OsStr>,369	) -> Result<MyCommand> {370		if self.local {371			Ok(MyCommand::new(escalation, cmd))372		} else {373			let session = self.open_session().await?;374			Ok(MyCommand::new_on(escalation, cmd, session))375		}376	}377	pub async fn nix_cmd(&self) -> Result<MyCommand> {378		let mut nix = self.cmd("nix").await?;379		nix.args([380			"--extra-experimental-features",381			"nix-command",382			"--extra-experimental-features",383			"flakes",384		]);385		Ok(nix)386	}387388	pub async fn decrypt(&self, data: SecretData) -> Result<Vec<u8>> {389		ensure!(data.encrypted, "secret is not encrypted");390		let mut cmd = self.cmd("fleet-install-secrets").await?;391		cmd.arg("decrypt").eqarg("--secret", data.to_string());392		let encoded = cmd393			.sudo()394			.run_string()395			.await396			.context("failed to call remote host for decrypt")?;397		let data: SecretData = encoded.parse().map_err(|e| anyhow!("{e}"))?;398		ensure!(!data.encrypted, "secret came out encrypted");399		Ok(data.data)400	}401	pub async fn reencrypt(&self, data: SecretData, targets: Vec<String>) -> Result<SecretData> {402		ensure!(data.encrypted, "secret is not encrypted");403		let mut cmd = self.cmd("fleet-install-secrets").await?;404		cmd.arg("reencrypt").eqarg("--secret", data.to_string());405		for target in targets {406			let key = self.config.key(&target).await?;407			cmd.eqarg("--targets", key);408		}409		let encoded = cmd410			.sudo()411			.run_string()412			.await413			.context("failed to call remote host for decrypt")?;414		let data: SecretData = encoded.parse().map_err(|e| anyhow!("{e}"))?;415		ensure!(data.encrypted, "secret came out not encrypted");416		Ok(data)417	}418	/// Returns path for futureproofing, as path might change i.e on conversion to CA419	pub async fn remote_derivation(&self, path: &PathBuf) -> Result<PathBuf> {420		if self.local {421			// Path is located locally, thus already trusted.422			return Ok(path.to_owned());423		}424		let mut nix = MyCommand::new(425			// Not used426			EscalationStrategy::Su,427			"nix",428		);429		nix.arg("copy").arg("--substitute-on-destination");430431		let proto = if self.legacy_ssh_store.get().cloned().unwrap_or(false) {432			"ssh"433		} else {434			"ssh-ng"435		};436437		match self.deploy_kind().await? {438			DeployKind::Fleet | DeployKind::UpgradeToFleet | DeployKind::NixosLustrate => {439				nix.comparg("--to", format!("{proto}://{}", self.name));440			}441			DeployKind::NixosInstall => {442				nix443					// Signature checking makes no sense with remote-store store argument set, as we're not even interacting with remote nix daemon444					.arg("--no-check-sigs")445					.comparg(446						"--to",447						format!("{proto}://root@{}?remote-store=/mnt", self.name),448					);449			}450		}451		nix.arg(path);452		nix.run_nix().await.context("nix copy")?;453		Ok(path.to_owned())454	}455	pub async fn systemctl_stop(&self, name: &str) -> Result<()> {456		let mut cmd = self.cmd("systemctl").await?;457		cmd.arg("stop").arg(name);458		cmd.sudo().run().await459	}460	pub async fn systemctl_start(&self, name: &str) -> Result<()> {461		let mut cmd = self.cmd("systemctl").await?;462		cmd.arg("start").arg(name);463		cmd.sudo().run().await464	}465466	pub async fn rm_file(&self, path: impl AsRef<OsStr>, sudo: bool) -> Result<()> {467		let mut cmd = self.cmd("rm").await?;468		cmd.arg("-f").arg(path);469		if sudo {470			cmd = cmd.sudo()471		}472		cmd.run().await473	}474}475impl ConfigHost {476	// TOCTOU is possible here in case if config is changed, but this case is not handled anywhere anyway,477	// assuming getting tags always returns the same value.478	pub async fn tags(&self) -> Result<Vec<String>> {479		if let Some(v) = self.groups.get() {480			return Ok(v.clone());481		}482		let Some(host_config) = &self.host_config else {483			return Ok(vec![]);484		};485		let tags: Vec<String> = nix_go_json!(host_config.tags);486487		let _ = self.groups.set(tags.clone());488489		Ok(tags)490	}491	pub async fn nixos_config(&self) -> Result<Value> {492		if let Some(v) = self.nixos_config.get() {493			return Ok(v.clone());494		}495		let Some(host_config) = &self.host_config else {496			bail!("local host has no nixos_config");497		};498		let nixos_config = nix_go!(host_config.nixos.config);499		assert_warn("nixos config evaluation", &nixos_config).await?;500501		let _ = self.nixos_config.set(nixos_config.clone());502503		Ok(nixos_config)504	}505	pub fn nixos_unchecked_config(&self) -> Result<Value> {506		if let Some(v) = self.nixos_unchecked_config.get() {507			return Ok(v.clone());508		}509		let Some(host_config) = &self.host_config else {510			bail!("local host has no nixos_config");511		};512		let nixos_config = nix_go!(host_config.nixos_unchecked.config);513514		let _ = self.nixos_unchecked_config.set(nixos_config.clone());515516		Ok(nixos_config)517	}518519	pub fn list_defined_secrets(&self) -> Result<Vec<String>> {520		let nixos = self.nixos_unchecked_config()?;521		let secrets = nix_go!(nixos.secrets);522		secrets.list_fields()523	}524	pub fn secret_definition(&self, name: &str) -> Result<HostSecretDefinition> {525		let nixos = self.nixos_unchecked_config()?;526		Ok(HostSecretDefinition(527			self.name.clone(),528			nix_go!(nixos.secrets[{ name }]),529		))530	}531532	/// Packages for this host, resolved with nixpkgs overlays533	pub async fn pkgs(&self) -> Result<Value> {534		if let Some(value) = &self.pkgs_override {535			return Ok(value.clone());536		}537		let Some(host_config) = &self.host_config else {538			bail!("local host has no host_config");539		};540		// TODO: Should nixos.options be cached?541		Ok(nix_go!(host_config.nixos.options._module.args.value.pkgs))542	}543}544545impl Config {546	pub async fn tagged_hostnames(&self, tag: &str) -> Result<Vec<String>> {547		let config = &self.config_field;548		let tagged: Vec<String> = nix_go_json!(config.taggedWith[{ tag }]);549		Ok(tagged)550	}551	pub async fn expand_owner_set(&self, owners: Vec<String>) -> Result<BTreeSet<String>> {552		let mut out = BTreeSet::new();553		for owner in owners {554			if let Some(tag) = owner.strip_prefix('@') {555				let hosts = self.tagged_hostnames(tag).await?;556				out.extend(hosts);557			} else {558				out.insert(owner);559			}560		}561		Ok(out)562	}563	pub fn local_host(&self) -> ConfigHost {564		ConfigHost {565			config: self.clone(),566			name: "<virtual localhost>".to_owned(),567			host_config: None,568			nixos_config: OnceCell::new(),569			nixos_unchecked_config: OnceCell::new(),570			groups: {571				let cell = OnceCell::new();572				let _ = cell.set(vec![]);573				cell574			},575			pkgs_override: Some(self.default_pkgs.clone()),576577			local: true,578			session: OnceLock::new(),579			deploy_kind: OnceCell::new(),580			session_destination: OnceCell::new(),581			legacy_ssh_store: OnceCell::new(),582		}583	}584585	pub async fn host(&self, name: &str) -> Result<ConfigHost> {586		let config = &self.config_field;587		let host_config = nix_go!(config.hosts[{ name }]);588589		Ok(ConfigHost {590			config: self.clone(),591			name: name.to_owned(),592			host_config: Some(host_config),593			nixos_config: OnceCell::new(),594			nixos_unchecked_config: OnceCell::new(),595			groups: OnceCell::new(),596			pkgs_override: None,597598			// TODO: Remove with connectivit refactor599			local: self.localhost == name,600			session: OnceLock::new(),601			deploy_kind: OnceCell::new(),602			session_destination: OnceCell::new(),603			legacy_ssh_store: OnceCell::new(),604		})605	}606	pub async fn list_hosts(&self) -> Result<Vec<ConfigHost>> {607		let config = &self.config_field;608		let names = nix_go!(config.hosts).list_fields()?;609		let mut out = vec![];610		for name in names {611			out.push(self.host(&name).await?);612		}613		Ok(out)614	}615	// TODO: Replace usages with .host().nixos_config616	pub async fn system_config(&self, host: &str) -> Result<Value> {617		let fleet_field = &self.config_field;618		Ok(nix_go!(fleet_field.hosts[{ host }].nixos.config))619	}620621	/// Shared secrets configured in fleet.nix or in flake622	pub async fn list_configured_shared(&self) -> Result<Vec<String>> {623		let config_field = &self.config_field;624		nix_go!(config_field.sharedSecrets).list_fields()625	}626	pub fn has_shared(&self, name: &str) -> bool {627		let data = self.data();628		data.secrets.contains(name)629	}630	pub fn replace_shared(&self, name: String, shared: FleetSecretDistribution) {631		let mut data = self.data_mut();632		data.secrets.set_data(name, shared);633	}634	pub fn remove_shared(&self, secret: &str) {635		let mut data = self.data_mut();636		data.secrets.remove(secret);637	}638639	pub fn list_secrets_for_owner(&self, host: &str) -> Vec<String> {640		let data = self.data_mut();641		data.secrets.keys_for_owner(host).cloned().collect()642	}643	pub fn list_secrets(&self) -> Vec<String> {644		let data = self.data_mut();645		data.secrets.keys().cloned().collect()646	}647648	pub fn has_secret(&self, host: &str, secret: &str) -> bool {649		let data = self.data();650		data.secrets.contains_for_owner(secret, host)651	}652	pub fn insert_secret(&self, host: String, secret: String, value: FleetSecretData) {653		let mut data = self.data_mut();654		data.secrets.set_single_data(secret, host, value);655	}656	pub fn remove_secret(&self, host: &str, secret: &str) {657		let mut data = self.data_mut();658		data.secrets.drop_owner_no_reencrypt(secret, host);659	}660661	pub fn host_secret(&self, host: &str, secret: &str) -> Option<FleetSecretDistribution> {662		let data = self.data();663		data.secrets.get_single(secret, host).cloned()664	}665	pub fn shared_secret(&self, secret: &str) -> Option<FleetSecretDistributions> {666		let data = self.data();667		data.secrets.get(secret).cloned()668	}669	pub fn shared_secret_definition(&self, secret: &str) -> Result<SharedSecretDefinition> {670		let config_field = &self.config_field;671		Ok(SharedSecretDefinition(nix_go!(672			config_field.sharedSecrets[{ secret }]673		)))674	}675676	// TODO: Should this be something modifiable from other processes?677	// E.g terraform provider might want to update FleetData (e.g secrets),678	// and current implementation assumes only one process holds current fleet.nix679	// Given that it is no longer needs to be a file for nix evaluation,680	// maybe it can be a .nix file for persistence, but accessible only681	// thru some shared state controller? Might it be stored in terraform682	// state provider?683	pub fn data(&'_ self) -> MutexGuard<'_, FleetData> {684		self.data.lock().unwrap()685	}686	pub fn data_mut(&'_ self) -> MutexGuard<'_, FleetData> {687		self.data.lock().unwrap()688	}689	pub fn save(&self) -> Result<()> {690		let mut tempfile = NamedTempFile::new_in(self.directory.clone()).context("failed to create updated version of fleet.nix in the same directory as original.\nDo you have write access to it? Access only to the fleet.nix won't be enough, the directory is used for atomic overwrite operation.\nIt is not recommended to use fleet by root anyway, move fleet project to your home directory.")?;691		let data = nixlike::serialize(&self.data() as &FleetData)?;692		tempfile.write_all(693			format!(694				"# This file contains fleet state and shouldn't be edited by hand\n\n{data}\n\n# vim: ts=2 et nowrap\n"695			)696			.as_bytes(),697		)?;698		let mut fleet_data_path = self.directory.clone();699		fleet_data_path.push("fleet.nix");700		tempfile.persist(fleet_data_path)?;701		Ok(())702	}703}