difftreelog
feat expected secret parts
in: trunk
16 files changed
Cargo.lockdiffbeforeafterboth--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1055,6 +1055,7 @@
"shlex",
"tabled",
"tempfile",
+ "thiserror 2.0.17",
"time",
"tokio",
"tokio-util",
@@ -1087,6 +1088,7 @@
"serde_json",
"tabled",
"tempfile",
+ "thiserror 2.0.17",
"time",
"tokio",
"tokio-util",
cmds/fleet/Cargo.tomldiffbeforeafterboth--- a/cmds/fleet/Cargo.toml
+++ b/cmds/fleet/Cargo.toml
@@ -47,6 +47,7 @@
nom = "8.0.0"
opentelemetry = "0.30.0"
opentelemetry_sdk = "0.30.0"
+thiserror.workspace = true
tracing-indicatif = { version = "0.3", optional = true }
tracing-opentelemetry = "0.31.0"
cmds/fleet/src/cmds/secrets/mod.rsdiffbeforeafterboth2 collections::{BTreeMap, BTreeSet, HashSet},2 collections::{BTreeMap, BTreeSet, HashSet},3 io::{self, Read, Write, stdin, stdout},3 io::{self, Read, Write, stdin, stdout},4 path::PathBuf,4 path::PathBuf,5 slice,6};5};768use age::Recipient;9use anyhow::{Context, Result, anyhow, bail, ensure};7use anyhow::{Context, Result, anyhow, bail, ensure};10use chrono::{DateTime, Utc};8use chrono::{DateTime, Utc};11use clap::Parser;9use clap::Parser;12use fleet_base::{10use fleet_base::{13 fleetdata::{FleetSecret, FleetSecretPart, FleetSharedSecret, encrypt_secret_data},11 fleetdata::{12 FleetHostSecret, FleetSecretData, FleetSecretPart, FleetSharedSecret, encrypt_secret_data,13 },14 host::Config,14 host::Config,15 opts::FleetOpts,15 opts::FleetOpts,16 secret::{Expectations, RegenerationReason, SharedSecretDefinition, secret_needs_regeneration},16};17};17use fleet_shared::SecretData;18use fleet_shared::SecretData;18use nix_eval::{NixType, Value, nix_go, nix_go_json};19use nix_eval::{NixType, Value, nix_go, nix_go_json};146 },147 },147}148}148149149fn secret_needs_regeneration(150 secret: &FleetSecret,151 expected_generation_data: &serde_json::Value,152) -> bool {153 let data_is_expected = secret.generation_data == *expected_generation_data;154 // TODO: Leeway?155 let expired = secret156 .expires_at157 .map(|expiration| expiration < Utc::now())158 .unwrap_or(false);159 expired || !data_is_expected160}161162#[allow(clippy::too_many_arguments)]150#[allow(clippy::too_many_arguments)]163#[tracing::instrument(skip(config, secret, field, prefer_identities))]151#[tracing::instrument(skip(config, secret, definition, prefer_identities))]164async fn maybe_regenerate_shared_secret(152async fn maybe_regenerate_shared_secret(165 secret_name: &str,153 secret_name: &str,166 config: &Config,154 config: &Config,167 mut secret: FleetSharedSecret,155 mut secret: FleetSharedSecret,168 field: Value,156 definition: SharedSecretDefinition,169 expected_owners: &[String],170 expected_generation_data: serde_json::Value,171 prefer_identities: &[String],157 prefer_identities: &[String],158 expectations: &Expectations,172) -> Result<FleetSharedSecret> {159) -> Result<FleetSharedSecret> {173 let original_set = secret.owners.clone();160 let reason = secret_needs_regeneration(&secret.secret, &secret.owners, expectations);161 let value = definition.inner();174162175 let set = original_set.iter().collect::<BTreeSet<_>>();163 let (should_reencrypt, reason) = match reason {176 let expected_set = expected_owners.iter().collect::<BTreeSet<_>>();164 Some(RegenerationReason::OwnersAdded(_)) => {177178 let regeneration_required =179 secret_needs_regeneration(&secret.secret, &expected_generation_data);165 // Secret always needs to be reencrypted for new owners to be able to read it180181 if set == expected_set && !regeneration_required {182 info!("no need to update owner list, it is already correct");183 return Ok(secret);166 (184 }167 true,185186 let should_regenerate = if regeneration_required {168 if nix_go_json!(value.regenerateOnOwnerAdded) {187 info!("secret has its generation data changed, regeneration is required");169 reason188 true189 } else if set.difference(&expected_set).next().is_some() {170 } else {190 // TODO: Remove this warning for revokable secrets.171 None191 warn!(172 },192 "host was removed from secret owners, but until this host rebuild, the secret will still be stored on it."173 )174 }175 Some(RegenerationReason::OwnersRemoved(_)) => {176 // No need to reencrypt, we can just leave stanzas in place.193 );177 if nix_go_json!(value.regenerateOnOwnerRemoved) {194 nix_go_json!(field.regenerateOnOwnerRemoved)195 } else if expected_set.difference(&set).next().is_some() {178 (true, reason)179 } else {196 nix_go_json!(field.regenerateOnOwnerAdded)180 (false, None)197 } else {181 }182 }183 Some(_) => (true, reason),198 false184 None => (false, None),199 };185 };200186201 if should_regenerate {187 if let Some(reason) = reason {202 info!("secret needs to be regenerated");188 info!("secret needs to be regenerated: {reason}");203 let generated = generate_shared(189 let generated = generate_shared(config, secret_name, definition, expectations).await?;204 config,205 secret_name,206 field,207 expected_owners.to_vec(),208 expected_generation_data,209 )210 .await?;211 Ok(generated)190 Ok(generated)212 } else {191 } else if should_reencrypt {192 info!("secret needs to be reencrypted");213 let identity_holder = if !prefer_identities.is_empty() {193 let identity_holder = if !prefer_identities.is_empty() {214 prefer_identities194 prefer_identities215 .iter()195 .iter()216 .find(|i| original_set.iter().any(|s| s == *i))196 .find(|i| secret.owners.iter().any(|s| s == *i))217 } else {197 } else {218 secret.owners.first()198 secret.owners.first()219 };199 };228 }208 }229 let host = config.host(identity_holder).await?;209 let host = config.host(identity_holder).await?;230 let encrypted = host210 let encrypted = host231 .reencrypt(part.raw.clone(), expected_owners.to_vec())211 .reencrypt(212 part.raw.clone(),213 expectations.owners.iter().cloned().collect(),214 )232 .await?;215 .await?;233 part.raw = encrypted;216 part.raw = encrypted;234 }217 }235236 secret.owners = expected_owners.to_vec();218 secret.owners = expectations.owners.clone();237 Ok(secret)219 Ok(secret)220 } else {221 Ok(secret)238 }222 }239}223}240224250 _display_name: &str,234 _display_name: &str,251 _secret: Value,235 _secret: Value,252 _default_generator: Value,236 _default_generator: Value,253 _owners: &[String],237 _expectations: &Expectations,254) -> Result<FleetSecret> {238) -> Result<FleetSecretData> {255 bail!("pure generators are broken for now")239 bail!("pure generators are broken for now")256}240}257async fn generate_impure(241async fn generate_impure(258 config: &Config,242 config: &Config,259 _display_name: &str,243 _display_name: &str,260 secret: Value,244 secret: Value,261 default_generator: Value,245 default_generator: Value,262 expected_owners: &[String],246 expectations: &Expectations,263 expected_generation_data: serde_json::Value,264) -> Result<FleetSecret> {247) -> Result<FleetSecretData> {265 let generator = nix_go!(secret.generator);248 let generator = nix_go!(secret.generator);266 let on: Option<String> = nix_go_json!(default_generator.impureOn);249 let on: Option<String> = nix_go_json!(default_generator.impureOn);267250276 let mk_secret_generators = nix_go!(on_pkgs.mkSecretGenerators);259 let mk_secret_generators = nix_go!(on_pkgs.mkSecretGenerators);277260278 let mut recipients = Vec::new();261 let mut recipients = Vec::new();279 for owner in expected_owners {262 for owner in &expectations.owners {280 let key = config.key(owner).await?;263 let key = config.key(owner).await?;281 recipients.push(key);264 recipients.push(key);282 }265 }283 let generators = nix_go!(mk_secret_generators(Obj { recipients }));266 let generators = nix_go!(mk_secret_generators(Obj { recipients }));284 // FIXME: Apparently, // operator is slow in nix285 let pkgs_and_generators = on_pkgs.attrs_update(generators)?;267 let pkgs_and_generators = on_pkgs.attrs_update(generators)?;286268287 let call_package = nix_go!(nixpkgs.lib.callPackageWith(pkgs_and_generators));269 let call_package = nix_go!(nixpkgs.lib.callPackageWith(pkgs_and_generators));331 let created_at = host.read_file_value(format!("{out}/created_at")).await?;313 let created_at = host.read_file_value(format!("{out}/created_at")).await?;332 let expires_at = host.read_file_value(format!("{out}/expires_at")).await.ok();314 let expires_at = host.read_file_value(format!("{out}/expires_at")).await.ok();333315334 Ok(FleetSecret {316 let new_data = FleetSecretData {335 created_at,317 created_at,336 expires_at,318 expires_at,337 parts,319 parts,338 generation_data: expected_generation_data,320 generation_data: expectations.generation_data.clone(),339 })321 };322323 if let Some(reason) = secret_needs_regeneration(&new_data, &expectations.owners, expectations) {324 bail!("newly generated secret needs to be regenerated: {reason}")325 }326327 Ok(new_data)340}328}329341async fn generate(330async fn generate(342 config: &Config,331 config: &Config,343 display_name: &str,332 display_name: &str,344 secret: Value,333 secret: Value,345 expected_owners: &[String],334 expectations: &Expectations,346 expected_generation_data: serde_json::Value,347) -> Result<FleetSecret> {335) -> Result<FleetSecretData> {348 let generator = nix_go!(secret.generator);336 let generator = nix_go!(secret.generator);349 // Can't properly check on nix module system level337 // Can't properly check on nix module system level350 {338 {388 display_name,376 display_name,389 secret,377 secret,390 default_generator,378 default_generator,391 expected_owners,379 expectations,392 expected_generation_data,393 )380 )394 .await381 .await395 }382 }399 display_name,386 display_name,400 secret,387 secret,401 default_generator,388 default_generator,402 expected_owners,389 expectations,403 )390 )404 .await391 .await405 }392 }408async fn generate_shared(395async fn generate_shared(409 config: &Config,396 config: &Config,410 display_name: &str,397 display_name: &str,411 secret: Value,398 secret: SharedSecretDefinition,412 expected_owners: Vec<String>,399 expectations: &Expectations,413 expected_generation_data: serde_json::Value,414) -> Result<FleetSharedSecret> {400) -> Result<FleetSharedSecret> {415 // let owners: Vec<String> = nix_go_json!(secret.expectedOwners);401 // let owners: Vec<String> = nix_go_json!(secret.expectedOwners);416 Ok(FleetSharedSecret {402 Ok(FleetSharedSecret {417 secret: generate(403 managed: Some(true),418 config,404 secret: generate(config, display_name, secret.inner(), expectations).await?,419 display_name,420 secret,421 &expected_owners,422 expected_generation_data,423 )424 .await?,425 owners: expected_owners,405 owners: expectations.owners.clone(),426 })406 })427}407}428408457}437}458438459fn parse_machines(439fn parse_machines(460 initial: Vec<String>,440 initial: BTreeSet<String>,461 machines: Option<Vec<String>>,441 machines: Option<Vec<String>>,462 mut add_machines: Vec<String>,442 mut add_machines: Vec<String>,463 mut remove_machines: Vec<String>,443 mut remove_machines: Vec<String>,464) -> Result<Vec<String>> {444) -> Result<BTreeSet<String>> {465 if machines.is_none() && add_machines.is_empty() && remove_machines.is_empty() {445 if machines.is_none() && add_machines.is_empty() && remove_machines.is_empty() {466 bail!("no operation");446 bail!("no operation");467 }447 }470 let mut target_machines = initial;450 let mut target_machines = initial;471 info!("Currently encrypted for {initial_machines:?}");451 info!("Currently encrypted for {initial_machines:?}");472452473 // ensure!(machines.is_some() || !add_machines.is_empty() || )474 if let Some(machines) = machines {453 if let Some(machines) = machines {475 ensure!(454 ensure!(476 add_machines.is_empty() && remove_machines.is_empty(),455 add_machines.is_empty() && remove_machines.is_empty(),487 }466 }488467489 for machine in &remove_machines {468 for machine in &remove_machines {490 let mut removed = false;469 if !target_machines.remove(machine) {491 while let Some(pos) = target_machines.iter().position(|m| m == machine) {492 target_machines.swap_remove(pos);493 removed = true;494 }495 if !removed {496 warn!("secret is not enabled for {machine}");470 warn!("secret is not enabled for {machine}");497 }471 }498 }472 }499 for machine in &add_machines {473 for machine in &add_machines {500 if target_machines.iter().any(|m| m == machine) {474 if !target_machines.insert(machine.to_owned()) {501 warn!("secret is already added to {machine}");475 warn!("secret is already added to {machine}");502 } else {503 target_machines.push(machine.to_owned());504 }476 }505 }477 }506 if !remove_machines.is_empty() {478 if !remove_machines.is_empty() {527 }499 }528 }500 }529 Secret::AddShared {501 Secret::AddShared {530 mut machines,502 machines,531 name,503 name,532 force,504 force,533 public,505 public,537 re_add,509 re_add,538 part: part_name,510 part: part_name,539 } => {511 } => {512 let mut machines: BTreeSet<String> = machines.into_iter().collect();540 // TODO: Forbid updating secrets with set expectedOwners (= not user-managed).513 // TODO: Forbid updating secrets with set expectedOwners (= not user-managed).541514542 let exists = config.has_shared(&name);515 if let Some(old_shared) = config.shared_secret(&name)? {543 if exists && !force && !re_add {516 if !force && !re_add {544 bail!("secret already defined");517 bail!("secret already defined");545 }518 };546 if re_add {519 if old_shared.managed.unwrap_or(false) {520 bail!("secret is marked as managed, should not be updated manually");521 };522 if re_add {547 // Fixme: use clap to limit this usage523 // Fixme: use clap to limit this usage548 ensure!(!force, "--force and --readd are not compatible");524 ensure!(!force, "--force and --readd are not compatible");549 ensure!(exists, "secret doesn't exists");525 ensure!(550 ensure!(526 machines.is_empty(),551 machines.is_empty(),552 "you can't use machines argument for --readd"527 "you can't use machines argument for --readd"553 );528 );554 let shared = config.shared_secret(&name)?;529 machines = old_shared.owners;555 machines = shared.owners;530 }531 } else if re_add {532 bail!("secret doesn't exists");556 }533 };557534558 let recipients = config.recipients(machines.clone()).await?;535 let recipients = config536 .recipients(machines.iter().cloned().collect())537 .await?;559538560 let mut parts = BTreeMap::new();539 let mut parts = BTreeMap::new();561540562 let mut input = vec![];541 let mut input = vec![];563 io::stdin().read_to_end(&mut input)?;542 io::stdin().read_to_end(&mut input)?;564543565 if !input.is_empty() {544 if !input.is_empty() {566 let encrypted =545 let encrypted = encrypt_secret_data(recipients.iter(), input)567 encrypt_secret_data(recipients.iter().map(|r| r as &dyn Recipient), input)568 .ok_or_else(|| anyhow!("no recipients provided"))?;546 .ok_or_else(|| anyhow!("no recipients provided"))?;569 parts.insert(part_name, FleetSecretPart { raw: encrypted });547 parts.insert(part_name, FleetSecretPart { raw: encrypted });570 }548 }571549576 config.replace_shared(554 config.replace_shared(577 name,555 name,578 FleetSharedSecret {556 FleetSharedSecret {557 managed: Some(false),579 owners: machines,558 owners: machines,580 secret: FleetSecret {559 secret: FleetSecretData {581 created_at: Utc::now(),560 created_at: Utc::now(),582 expires_at,561 expires_at,583 parts,562 parts,607 .host_secret(&machine, &name)586 .host_secret(&machine, &name)608 .context("failed to read existing secret for --merge")?587 .context("failed to read existing secret for --merge")?609 } else {588 } else {610 FleetSecret {589 FleetHostSecret {611 created_at: Utc::now(),590 managed: Some(false),591 secret: FleetSecretData {592 created_at: Utc::now(),612 expires_at: None,593 expires_at: None,613 parts: BTreeMap::new(),594 parts: BTreeMap::new(),614 generation_data: serde_json::Value::Null,595 generation_data: serde_json::Value::Null,596 },615 }597 }616 };598 };599 if out.managed.unwrap_or(false) {600 bail!("secret is managed by fleet and should not be updated manually");601 }602 out.managed = Some(false);617603618 if let Some(secret) = parse_secret().await? {604 if let Some(secret) = parse_secret().await? {619 let recipient = config.recipient(&machine).await?;605 let recipient = config.recipient(&machine).await?;620 let encrypted = encrypt_secret_data([&recipient as &dyn Recipient], secret)606 let encrypted =621 .expect("recipient provided");607 encrypt_secret_data([&recipient], secret).expect("recipient provided");622 if out608 if out609 .secret623 .parts610 .parts624 .insert(part_name.clone(), FleetSecretPart { raw: encrypted })611 .insert(part_name.clone(), FleetSecretPart { raw: encrypted })625 .is_some() && !replace612 .is_some() && !replace626 {613 {627 bail!("part {part_name:?} is already defined");614 bail!(615 "part {part_name:?} is already defined, use --replace if you wish to replace it"616 );628 }617 }629 }618 }630619631 if let Some(public) = parse_public(public, public_file).await? {620 if let Some(public) = parse_public(public, public_file).await? {632 if out621 if out622 .secret633 .parts623 .parts634 .insert(public_name.clone(), FleetSecretPart { raw: public })624 .insert(public_name.clone(), FleetSecretPart { raw: public })635 .is_some() && !replace625 .is_some() && !replace636 {626 {637 bail!("part {public_name:?} is already defined");627 bail!(628 "part {public_name:?} is already defined, use --replace if you wish to replace it"629 );638 }630 }639 };631 };640632647 part: part_name,639 part: part_name,648 } => {640 } => {649 let secret = config.host_secret(&machine, &name)?;641 let secret = config.host_secret(&machine, &name)?;650 let Some(secret) = secret.parts.get(&part_name) else {642 let Some(secret) = secret.secret.parts.get(&part_name) else {651 bail!("no part {part_name} in secret {name}");643 bail!("no part {part_name} in secret {name}");652 };644 };653 let data = if secret.raw.encrypted {645 let data = if secret.raw.encrypted {664 part: part_name,656 part: part_name,665 prefer_identities,657 prefer_identities,666 } => {658 } => {667 let secret = config.shared_secret(&name)?;659 let Some(secret) = config.shared_secret(&name)? else {660 bail!("secret doesn't exists");661 };668 let Some(part) = secret.secret.parts.get(&part_name) else {662 let Some(part) = secret.secret.parts.get(&part_name) else {669 bail!("no part {part_name} in secret {name}");663 bail!("no part {part_name} in secret {name}");670 };664 };695 } => {689 } => {696 // TODO: Forbid updating secrets with set expectedOwners (= not user-managed).690 // TODO: Forbid updating secrets with set expectedOwners (= not user-managed).697691698 let secret = config.shared_secret(&name)?;692 let Some(secret) = config.shared_secret(&name)? else {693 bail!("secret doesn't exists");694 };699 if secret.secret.parts.values().all(|v| !v.raw.encrypted) {695 if secret.secret.parts.values().all(|v| !v.raw.encrypted) {700 bail!("no secret");696 bail!("no secret");701 }697 }714 return Ok(());710 return Ok(());715 }711 }716712717 let config_field = &config.config_field;713 let definition = config.shared_secret_definition(&name)?;718 let name_clone = name.clone();719 let field = nix_go!(config_field.sharedSecrets[name_clone]);714 let expectations = definition.expectations()?;720 let expected_generation_data = nix_go_json!(field.expectedGenerationData);721715722 let updated = maybe_regenerate_shared_secret(716 let updated = maybe_regenerate_shared_secret(723 &name,717 &name,724 config,718 config,725 secret,719 secret,726 field,720 definition,727 &target_machines,728 expected_generation_data,729 &prefer_identities,721 &prefer_identities,730 // None,722 &expectations,731 )723 )732 .await?;724 .await?;733 config.replace_shared(name, updated);725 config.replace_shared(name, updated);737 skip_hosts,729 skip_hosts,738 } => {730 } => {739 info!("checking for secrets to regenerate");731 info!("checking for secrets to regenerate");732 let expected_shared_set = config733 .list_configured_shared()734 .await?735 .into_iter()736 .collect::<HashSet<_>>();740 let stored_shared_set = config.list_shared().into_iter().collect::<HashSet<_>>();737 let stored_shared_set = config.list_shared().into_iter().collect::<HashSet<_>>();741 {738 {742 // Generate missing shared739 // Generate missing shared743 let _span = info_span!("shared").entered();740 let _span = info_span!("shared").entered();744 let expected_shared_set = config745 .list_configured_shared()746 .await?747 .into_iter()748 .collect::<HashSet<_>>();749 for missing in expected_shared_set.difference(&stored_shared_set) {741 for missing in expected_shared_set.difference(&stored_shared_set) {750 let config_field = &config.config_field;742 let definition = config.shared_secret_definition(missing)?;751 let secret = nix_go!(config_field.sharedSecrets[{ missing }]);752 let expected_generation_data: serde_json::Value =743 if !definition.is_managed()? {753 nix_go_json!(secret.expectedGenerationData);754 let expected_owners: Option<Vec<String>> =755 nix_go_json!(secret.expectedOwners);744 info!("skipping unmanaged secret: {missing}");756 let Some(expected_owners) = expected_owners else {757 // Can't generate this missing secret, as it has no defined owners.758 continue;745 continue;759 };746 }747 let expectations = definition.expectations()?;760 info!("generating secret: {missing}");748 info!("generating secret: {missing}");761 let shared = generate_shared(749 let shared = generate_shared(config, missing, definition, &expectations)762 config,763 missing,764 secret,765 expected_owners,766 expected_generation_data,767 )768 .in_current_span()750 .in_current_span()769 .await?;751 .await?;770 config.replace_shared(missing.to_string(), shared)752 config.replace_shared(missing.to_string(), shared)771 }753 }772 }754 }778760779 let _span = info_span!("host", host = host.name).entered();761 let _span = info_span!("host", host = host.name).entered();780 let expected_set = host762 let expected_set = host781 .list_configured_secrets()763 .list_defined_secrets()?782 .in_current_span()783 .await?784 .into_iter()764 .into_iter()785 .collect::<HashSet<_>>();765 .collect::<HashSet<_>>();786 let stored_set = config766 let stored_set = config787 .list_secrets(&host.name)767 .list_secrets(&host.name)788 .into_iter()768 .into_iter()789 .collect::<HashSet<_>>();769 .collect::<HashSet<_>>();790 for missing in expected_set.difference(&stored_set) {770 for missing_secret in expected_set.difference(&stored_set) {791 info!("generating secret: {missing}");771 info!("generating missing secret: {missing_secret}");792 let secret = host.secret_field(missing).in_current_span().await?;772 let definition = host.secret_definition(missing_secret)?;793 let expected_generation_data =773 let expectations = definition.expectations()?;794 nix_go_json!(secret.expectedGenerationData);795 let generated = match generate(774 let generated = match generate(796 config,775 config,797 missing,776 missing_secret,798 secret,777 definition.inner(),799 slice::from_ref(&host.name),800 expected_generation_data,778 &expectations,801 )779 )802 .in_current_span()780 .in_current_span()803 .await781 .await808 continue;786 continue;809 }787 }810 };788 };811 config.insert_secret(&host.name, missing.to_string(), generated)789 config.insert_secret(790 &host.name,791 missing_secret.to_string(),792 FleetHostSecret {793 managed: Some(true),794 secret: generated,795 },796 )812 }797 }813 for name in stored_set {798 for known_secret in stored_set.intersection(&expected_set) {814 info!("updating secret: {name}");799 info!("updating secret: {known_secret}");815 let data = config.host_secret(&host.name, &name)?;800 let data = config.host_secret(&host.name, known_secret)?;816 let secret = host.secret_field(&name).in_current_span().await?;801 let definition = host.secret_definition(known_secret)?;817 let expected_generation_data =802 let expectations = definition.expectations()?;818 nix_go_json!(secret.expectedGenerationData);803 if let Some(regen_reason) = data.needs_regeneration(&expectations) {819 if secret_needs_regeneration(&data, &expected_generation_data) {804 info!("needs regeneration: {regen_reason}");820 let generated = match generate(805 let generated = match generate(821 config,806 config,822 &name,807 known_secret,823 secret,808 definition.inner(),824 slice::from_ref(&host.name),825 expected_generation_data,809 &expectations,826 )810 )827 .in_current_span()811 .in_current_span()828 .await812 .await833 continue;817 continue;834 }818 }835 };819 };836 config.insert_secret(&host.name, name.to_string(), generated)820 config.insert_secret(821 &host.name,822 known_secret.to_string(),823 FleetHostSecret {824 managed: Some(true),825 secret: generated,826 },827 )837 }828 }838 }829 }830 for removed_secret in stored_set.difference(&expected_set) {831 info!("removing secret: {removed_secret}");832 config.remove_secret(&host.name, removed_secret);833 }839 }834 }840 }835 }841 let mut to_remove = Vec::new();836 for known_secret in stored_shared_set.intersection(&expected_shared_set) {842 for name in &stored_shared_set {843 info!("updating secret: {name}");837 info!("updating shared secret: {known_secret}");844 let data = config.shared_secret(name)?;838 let data = config.shared_secret(known_secret)?.expect("exists");845 let config_field = &config.config_field;846 let expected_owners: Option<Vec<String>> =847 nix_go_json!(config_field.sharedSecrets[{ name }].expectedOwners);848 let Some(expected_owners) = expected_owners else {849 warn!("secret was removed from fleet config: {name}, removing from data");850 to_remove.push(name.to_string());851 continue;852 };853839854 let secret = nix_go!(config_field.sharedSecrets[{ name }]);840 let definition = config.shared_secret_definition(known_secret)?;855 let expected_generation_data = nix_go_json!(secret.expectedGenerationData);841 let expectations = definition.expectations()?;856 config.replace_shared(842 config.replace_shared(857 name.to_owned(),843 known_secret.to_owned(),858 maybe_regenerate_shared_secret(844 maybe_regenerate_shared_secret(859 name,845 known_secret,860 config,846 config,861 data,847 data,862 secret,848 definition,863 &expected_owners,864 expected_generation_data,865 &prefer_identities,849 &prefer_identities,866 // None,850 &expectations,867 )851 )868 .await?,852 .await?,869 );853 );870 }854 }871 for k in to_remove {855 for removed_secret in stored_shared_set.difference(&expected_shared_set) {872 config.remove_shared(&k);856 info!("removing shared secret: {removed_secret}");857 config.remove_shared(removed_secret);873 }858 }874 }859 }875 Secret::List {} => {860 Secret::List {} => {885 let mut table = vec![];870 let mut table = vec![];886 for name in configured.iter().cloned() {871 for name in configured.iter().cloned() {887 let config = config.clone();872 let config = config.clone();888 let expected_owners = config.shared_secret_expected_owners(&name).await?;873 let data = config.shared_secret(&name)?.expect("exists");889 let data = config.shared_secret(&name)?;874 let definition = config.shared_secret_definition(&name)?;875 let expectations = definition.expectations()?;890 let owners = data876 let owners = data891 .owners877 .owners892 .iter()878 .iter()893 .map(|o| {879 .map(|o| {894 if expected_owners.contains(o) {880 if expectations.owners.contains(o) {895 o.green().to_string()881 o.green().to_string()896 } else {882 } else {897 o.red().to_string()883 o.red().to_string()912 add,898 add,913 } => {899 } => {914 let secret = config.host_secret(&machine, &name)?;900 let secret = config.host_secret(&machine, &name)?;915 if let Some(data) = secret.parts.get(&part) {901 if let Some(data) = secret.secret.parts.get(&part) {916 let host = config.host(&machine).await?;902 let host = config.host(&machine).await?;917 let secret = host.decrypt(data.raw.clone()).await?;903 let secret = host.decrypt(data.raw.clone()).await?;918 String::from_utf8(secret).context("secret is not utf8")?904 String::from_utf8(secret).context("secret is not utf8")?cmds/fleet/src/main.rsdiffbeforeafterboth--- a/cmds/fleet/src/main.rs
+++ b/cmds/fleet/src/main.rs
@@ -27,7 +27,7 @@
use tracing::{Instrument, error, info, info_span};
#[cfg(feature = "indicatif")]
use tracing_indicatif::IndicatifLayer;
-use tracing_subscriber::{EnvFilter, fmt::format::Format, prelude::*};
+use tracing_subscriber::{EnvFilter, prelude::*};
#[derive(Parser)]
struct Prefetch {}
crates/fleet-base/Cargo.tomldiffbeforeafterboth--- a/crates/fleet-base/Cargo.toml
+++ b/crates/fleet-base/Cargo.toml
@@ -24,6 +24,7 @@
serde_json = "1.0.140"
tabled = "0.20.0"
tempfile.workspace = true
+thiserror.workspace = true
time = { version = "0.3.41", features = ["parsing"] }
tokio.workspace = true
tokio-util = "0.7.15"
crates/fleet-base/src/fleetdata.rsdiffbeforeafterboth--- a/crates/fleet-base/src/fleetdata.rs
+++ b/crates/fleet-base/src/fleetdata.rs
@@ -1,5 +1,5 @@
use std::{
- collections::BTreeMap,
+ collections::{BTreeMap, BTreeSet},
io::{self, Cursor},
};
@@ -13,6 +13,8 @@
use serde::{Deserialize, Serialize, de::Error};
use serde_json::Value;
+use crate::secret::{Expectations, RegenerationReason, secret_needs_regeneration};
+
#[derive(Serialize, Deserialize, Default)]
#[serde(rename_all = "camelCase")]
pub struct HostData {
@@ -75,30 +77,21 @@
pub shared_secrets: BTreeMap<String, FleetSharedSecret>,
#[serde(default)]
#[serde(skip_serializing_if = "BTreeMap::is_empty")]
- pub host_secrets: BTreeMap<String, BTreeMap<String, FleetSecret>>,
+ pub host_secrets: BTreeMap<String, BTreeMap<String, FleetHostSecret>>,
// extra_name => anything
#[serde(default)]
#[serde(skip_serializing_if = "BTreeMap::is_empty")]
pub extra: BTreeMap<String, Value>,
-}
-
-#[derive(Serialize, Deserialize, Clone)]
-#[serde(rename_all = "camelCase")]
-#[must_use]
-pub struct FleetSharedSecret {
- pub owners: Vec<String>,
- #[serde(flatten)]
- pub secret: FleetSecret,
}
/// Returns None if recipients.is_empty()
-pub fn encrypt_secret_data<'a>(
- recipients: impl IntoIterator<Item = &'a dyn Recipient>,
+pub fn encrypt_secret_data<'r>(
+ recipients: impl IntoIterator<Item = &'r Box<dyn Recipient>>,
data: Vec<u8>,
) -> Option<SecretData> {
let mut encrypted = vec![];
- let mut encryptor = age::Encryptor::with_recipients(recipients.into_iter())
+ let mut encryptor = age::Encryptor::with_recipients(recipients.into_iter().map(|v| &**v))
.ok()?
.wrap_output(&mut encrypted)
.expect("in memory write");
@@ -118,7 +111,7 @@
#[derive(Serialize, Deserialize, Clone)]
#[serde(rename_all = "camelCase")]
#[must_use]
-pub struct FleetSecret {
+pub struct FleetSecretData {
#[serde(default = "Utc::now")]
pub created_at: DateTime<Utc>,
#[serde(default)]
@@ -132,3 +125,31 @@
#[serde(skip_serializing_if = "Value::is_null")]
pub generation_data: Value,
}
+
+#[derive(Serialize, Deserialize, Clone)]
+#[serde(rename_all = "camelCase")]
+#[must_use]
+pub struct FleetHostSecret {
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub managed: Option<bool>,
+ #[serde(flatten)]
+ pub secret: FleetSecretData,
+}
+impl FleetHostSecret {
+ pub fn needs_regeneration(&self, expectations: &Expectations) -> Option<RegenerationReason> {
+ secret_needs_regeneration(&self.secret, &expectations.owners, expectations)
+ }
+}
+
+#[derive(Serialize, Deserialize, Clone)]
+#[serde(rename_all = "camelCase")]
+#[must_use]
+pub struct FleetSharedSecret {
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub managed: Option<bool>,
+ pub owners: BTreeSet<String>,
+ #[serde(flatten)]
+ pub secret: FleetSecretData,
+}
crates/fleet-base/src/host.rsdiffbeforeafterboth--- a/crates/fleet-base/src/host.rs
+++ b/crates/fleet-base/src/host.rs
@@ -22,7 +22,8 @@
use crate::{
command::MyCommand,
- fleetdata::{FleetData, FleetSecret, FleetSharedSecret},
+ fleetdata::{FleetData, FleetHostSecret, FleetSharedSecret},
+ secret::{HostSecretDefinition, SharedSecretDefinition},
};
pub struct FleetConfigInternals {
@@ -234,7 +235,7 @@
let is_fleet_managed = match self.file_exists("/etc/FLEET_HOST").await {
Ok(v) => v,
Err(e) => {
- bail!("failed to query remote system kind: {}", e);
+ bail!("failed to query remote system kind: {e}");
}
};
if !is_fleet_managed {
@@ -501,7 +502,7 @@
Ok(nixos_config)
}
- pub async fn nixos_unchecked_config(&self) -> Result<Value> {
+ pub fn nixos_unchecked_config(&self) -> Result<Value> {
if let Some(v) = self.nixos_unchecked_config.get() {
return Ok(v.clone());
}
@@ -515,23 +516,17 @@
Ok(nixos_config)
}
- pub async fn list_configured_secrets(&self) -> Result<Vec<String>> {
- let nixos = self.nixos_unchecked_config().await?;
+ pub fn list_defined_secrets(&self) -> Result<Vec<String>> {
+ let nixos = self.nixos_unchecked_config()?;
let secrets = nix_go!(nixos.secrets);
- let mut out = Vec::new();
- for name in secrets.list_fields()? {
- let secret = secrets.get_field(&name).context("getting secret")?;
- let is_shared: bool = nix_go_json!(secret.shared);
- if is_shared {
- continue;
- }
- out.push(name);
- }
- Ok(out)
+ secrets.list_fields()
}
- pub async fn secret_field(&self, name: &str) -> Result<Value> {
- let nixos = self.nixos_unchecked_config().await?;
- Ok(nix_go!(nixos.secrets[{ name }]))
+ pub fn secret_definition(&self, name: &str) -> Result<HostSecretDefinition> {
+ let nixos = self.nixos_unchecked_config()?;
+ Ok(HostSecretDefinition(
+ self.name.clone(),
+ nix_go!(nixos.secrets[{ name }]),
+ ))
}
/// Packages for this host, resolved with nixpkgs overlays
@@ -648,10 +643,19 @@
pub fn list_secrets(&self, host: &str) -> Vec<String> {
let data = self.data();
- let Some(secrets) = data.host_secrets.get(host) else {
- return Vec::new();
- };
- secrets.keys().cloned().collect()
+ let mut out = data
+ .host_secrets
+ .get(host)
+ .map(|s| s.keys().cloned().collect::<Vec<String>>())
+ .unwrap_or_default();
+
+ for (name, shared) in data.shared_secrets.iter() {
+ if shared.owners.contains(host) {
+ out.push(name.clone());
+ }
+ }
+
+ out
}
pub fn has_secret(&self, host: &str, secret: &str) -> bool {
@@ -661,34 +665,44 @@
};
host_secrets.contains_key(secret)
}
- pub fn insert_secret(&self, host: &str, secret: String, value: FleetSecret) {
+ pub fn insert_secret(&self, host: &str, secret: String, value: FleetHostSecret) {
let mut data = self.data_mut();
let host_secrets = data.host_secrets.entry(host.to_owned()).or_default();
host_secrets.insert(secret, value);
}
+ pub fn remove_secret(&self, host: &str, secret: &str) {
+ let mut data = self.data_mut();
+ let host_secrets = data.host_secrets.entry(host.to_owned()).or_default();
+ host_secrets.remove(secret);
+ }
- pub fn host_secret(&self, host: &str, secret: &str) -> Result<FleetSecret> {
+ pub fn host_secret(&self, host: &str, secret: &str) -> Result<FleetHostSecret> {
let data = self.data();
- let Some(host_secrets) = data.host_secrets.get(host) else {
- bail!("no secrets for machine {host}");
+ if let Some(host_secrets) = data.host_secrets.get(host) {
+ if let Some(secret) = host_secrets.get(secret) {
+ return Ok(secret.clone());
+ }
};
- let Some(secret) = host_secrets.get(secret) else {
+ let Some(shared) = data.shared_secrets.get(secret) else {
bail!("machine {host} has no secret {secret}");
};
- Ok(secret.clone())
+ if !shared.owners.contains(host) {
+ bail!("shared secret {secret} is not owned by {host}");
+ };
+ Ok(FleetHostSecret {
+ managed: shared.managed,
+ secret: shared.secret.clone(),
+ })
}
- pub fn shared_secret(&self, secret: &str) -> Result<FleetSharedSecret> {
+ pub fn shared_secret(&self, secret: &str) -> Result<Option<FleetSharedSecret>> {
let data = self.data();
- let Some(secret) = data.shared_secrets.get(secret) else {
- bail!("no shared secret {secret}");
- };
- Ok(secret.clone())
+ Ok(data.shared_secrets.get(secret).cloned())
}
- pub async fn shared_secret_expected_owners(&self, secret: &str) -> Result<Vec<String>> {
+ pub fn shared_secret_definition(&self, secret: &str) -> Result<SharedSecretDefinition> {
let config_field = &self.config_field;
- Ok(nix_go_json!(
- config_field.sharedSecrets[{ secret }].expectedOwners
- ))
+ Ok(SharedSecretDefinition(nix_go!(
+ config_field.sharedSecrets[{ secret }]
+ )))
}
// TODO: Should this be something modifiable from other processes?
crates/fleet-base/src/keys.rsdiffbeforeafterboth--- a/crates/fleet-base/src/keys.rs
+++ b/crates/fleet-base/src/keys.rs
@@ -39,12 +39,14 @@
}
}
/// Insecure, requires root
- pub async fn recipient(&self, host: &str) -> anyhow::Result<impl Recipient + use<>> {
+ pub async fn recipient(&self, host: &str) -> anyhow::Result<Box<dyn Recipient>> {
let key = self.key(host).await?;
- age::ssh::Recipient::from_str(&key).map_err(|e| anyhow!("parse recipient error: {:?}", e))
+ age::ssh::Recipient::from_str(&key)
+ .map_err(|e| anyhow!("parse recipient error: {e:?}"))
+ .map(|v| Box::new(v) as Box<dyn Recipient>)
}
- pub async fn recipients(&self, hosts: Vec<String>) -> Result<Vec<impl Recipient + use<>>> {
+ pub async fn recipients(&self, hosts: Vec<String>) -> Result<Vec<Box<dyn Recipient>>> {
let hosts = self.expand_owner_set(hosts).await?;
futures::stream::iter(hosts.iter())
.then(|m| self.recipient(m.as_ref()))
crates/fleet-base/src/lib.rsdiffbeforeafterboth--- a/crates/fleet-base/src/lib.rs
+++ b/crates/fleet-base/src/lib.rs
@@ -4,3 +4,4 @@
pub mod host;
mod keys;
pub mod opts;
+pub mod secret;
crates/fleet-base/src/secret.rsdiffbeforeafterboth--- /dev/null
+++ b/crates/fleet-base/src/secret.rs
@@ -0,0 +1,136 @@
+use std::collections::BTreeSet;
+
+use anyhow::Result;
+use chrono::{DateTime, Utc};
+use nix_eval::{Value, nix_go, nix_go_json};
+
+use crate::fleetdata::FleetSecretData;
+
+#[derive(Debug)]
+pub struct Expectations {
+ pub owners: BTreeSet<String>,
+ pub generation_data: serde_json::Value,
+ pub public_parts: BTreeSet<String>,
+ pub private_parts: BTreeSet<String>,
+}
+
+pub struct HostSecretDefinition(pub(crate) String, pub(crate) Value);
+impl HostSecretDefinition {
+ pub fn is_managed(&self) -> Result<bool> {
+ let value = &self.1;
+ Ok(!nix_go!(value.generator).is_null())
+ }
+ pub fn expectations(&self) -> Result<Expectations> {
+ let value = &self.1;
+ Ok(Expectations {
+ owners: BTreeSet::from([self.0.clone()]),
+ generation_data: nix_go_json!(value.expectedGenerationData),
+ public_parts: nix_go_json!(value.expectedPublicParts),
+ private_parts: nix_go_json!(value.expectedPrivateParts),
+ })
+ }
+ pub fn inner(&self) -> Value {
+ self.1.clone()
+ }
+}
+
+pub struct SharedSecretDefinition(pub(crate) Value);
+impl SharedSecretDefinition {
+ pub fn is_managed(&self) -> Result<bool> {
+ let value = &self.0;
+ Ok(!nix_go!(value.generator).is_null())
+ }
+ pub fn expectations(&self) -> Result<Expectations> {
+ let value = &self.0;
+ Ok(Expectations {
+ owners: nix_go_json!(value.expectedOwners),
+ generation_data: nix_go_json!(value.expectedGenerationData),
+ public_parts: nix_go_json!(value.expectedPublicParts),
+ private_parts: nix_go_json!(value.expectedPrivateParts),
+ })
+ }
+ pub fn inner(&self) -> Value {
+ self.0.clone()
+ }
+}
+
+#[derive(thiserror::Error, Debug)]
+pub enum RegenerationReason {
+ #[error("owners added: {0:?}")]
+ OwnersAdded(BTreeSet<String>),
+ #[error("owners added: {0:?}")]
+ OwnersRemoved(BTreeSet<String>),
+ #[error("unexpected generation data, expected: {expected:?}, found: {found:?}")]
+ GenerationData {
+ expected: serde_json::Value,
+ found: serde_json::Value,
+ },
+ #[error("unexpected part list, expected: {expected:?}, found: {found:?}")]
+ PartList {
+ expected: BTreeSet<String>,
+ found: BTreeSet<String>,
+ },
+ #[error("part {0} is expected to be encrypted")]
+ ExpectedPrivate(String),
+ #[error("part {0} is not expected to be encrypted")]
+ ExpectedPublic(String),
+ #[error("secret is expired at {0}")]
+ Expired(DateTime<Utc>),
+}
+
+pub fn secret_needs_regeneration(
+ secret: &FleetSecretData,
+ owners: &BTreeSet<String>,
+ expectations: &Expectations,
+) -> Option<RegenerationReason> {
+ if !owners.is_empty() {
+ let added: BTreeSet<String> = expectations.owners.difference(owners).cloned().collect();
+ if !added.is_empty() {
+ return Some(RegenerationReason::OwnersAdded(added));
+ }
+
+ let removed: BTreeSet<String> = owners.difference(&expectations.owners).cloned().collect();
+ if !removed.is_empty() {
+ return Some(RegenerationReason::OwnersRemoved(removed));
+ }
+ }
+
+ if secret.generation_data != expectations.generation_data {
+ return Some(RegenerationReason::GenerationData {
+ expected: expectations.generation_data.clone(),
+ found: secret.generation_data.clone(),
+ });
+ }
+
+ if !expectations.public_parts.is_empty() || !expectations.private_parts.is_empty() {
+ let expected: BTreeSet<String> = expectations
+ .public_parts
+ .union(&expectations.private_parts)
+ .cloned()
+ .collect();
+ let found: BTreeSet<String> = secret.parts.keys().cloned().collect();
+
+ if found != expected {
+ return Some(RegenerationReason::PartList { expected, found });
+ }
+
+ for (name, value) in secret.parts.iter() {
+ if value.raw.encrypted {
+ if !expectations.private_parts.contains(name) {
+ return Some(RegenerationReason::ExpectedPrivate(name.clone()));
+ }
+ } else if !expectations.public_parts.contains(name) {
+ return Some(RegenerationReason::ExpectedPublic(name.clone()));
+ }
+ }
+ }
+
+ if let Some(expiration) = secret.expires_at {
+ // TODO: Leeway?
+ if expiration < Utc::now() {
+ return Some(RegenerationReason::Expired(expiration));
+ }
+ }
+
+ None
+}
crates/nix-eval/src/lib.rsdiffbeforeafterboth--- a/crates/nix-eval/src/lib.rs
+++ b/crates/nix-eval/src/lib.rs
@@ -729,10 +729,13 @@
with_default_context(|c, es| unsafe { get_list_byidx(c, self.0, es, v as u32) }).map(Self)
}
- pub fn attrs_update(self, other: Value/*, ignore_errors: bool*/) -> Result<Self> {
+ pub fn attrs_update(self, other: Value /*, ignore_errors: bool*/) -> Result<Self> {
let attrs_update_fn = Self::eval("a: b: a // b")?;
- attrs_update_fn.call(self)?.call(other).context("attrs update")
+ attrs_update_fn
+ .call(self)?
+ .call(other)
+ .context("attrs update")
}
pub fn get_field(&self, name: impl AsFieldName) -> Result<Self> {
if !matches!(self.type_of(), NixType::Attrs) {
@@ -840,6 +843,9 @@
pub fn is_function(&self) -> bool {
self.functor_kind().is_some()
}
+ pub fn is_null(&self) -> bool {
+ matches!(self.type_of(), NixType::Null)
+ }
}
impl From<String> for Value {
flake.nixdiffbeforeafterboth--- a/flake.nix
+++ b/flake.nix
@@ -181,7 +181,7 @@
inputs'.nix.packages.nix-fetchers-c
inputs'.nix.packages.nix-store-c
- (rage.overrideAttrs {cargoFeatures = ["plugin"];})
+ (rage.overrideAttrs { cargoFeatures = [ "plugin" ]; })
];
environment.PROTOC = "${pkgs.protobuf}/bin/protoc";
};
modules/extras/tf.nixdiffbeforeafterboth--- a/modules/extras/tf.nix
+++ b/modules/extras/tf.nix
@@ -38,17 +38,19 @@
# will be somehow processed by fleet tf.
sensitive = true;
};
- fleetConfigurations.default = {config, ...}: {
- options.data = mkDataOption {
- # host => hostData
- options.extra.terraformHosts = mkOption {
- default = { };
- type = attrsOf (attrsOf unspecified);
- description = "Hosts data provided by fleet tf";
+ fleetConfigurations.default =
+ { config, ... }:
+ {
+ options.data = mkDataOption {
+ # host => hostData
+ options.extra.terraformHosts = mkOption {
+ default = { };
+ type = attrsOf (attrsOf unspecified);
+ description = "Hosts data provided by fleet tf";
+ };
};
+ config.hosts = config.data.extra.terraformHosts;
};
- config.hosts = config.data.extra.terraformHosts;
- };
perSystem.imports = [ ./tf-bootstrap.nix ];
};
modules/nixos/secrets.nixdiffbeforeafterboth--- a/modules/nixos/secrets.nix
+++ b/modules/nixos/secrets.nix
@@ -6,11 +6,11 @@
...
}:
let
- inherit (builtins) hashString;
+ inherit (builtins) hashString elemAt length toJSON filter;
inherit (lib.stringsWithDeps) stringAfter;
inherit (lib.options) mkOption literalExpression;
inherit (lib.lists) optional;
- inherit (lib.attrsets) mapAttrs;
+ inherit (lib.attrsets) mapAttrs mapAttrsToList;
inherit (lib.modules) mkIf;
inherit (lib.types)
submodule
@@ -22,10 +22,29 @@
uniq
functionTo
package
+ listOf
;
inherit (fleetLib.strings) decodeRawSecret;
sysConfig = config;
+ secretPartDataType = submodule {
+ options = {
+ raw = mkOption {
+ type = str;
+ internal = true;
+ description = "Encoded & Encrypted secret part data, passed from fleet.nix";
+ };
+ };
+ };
+ secretDataType = submodule {
+ freeformType = lazyAttrsOf secretPartDataType;
+ options = {
+ shared = mkOption {
+ description = "Is this secret owned by this machine, or propagated from shared secrets";
+ default = false;
+ };
+ };
+ };
secretPartType =
secretName:
submodule (
@@ -35,11 +54,6 @@
in
{
options = {
- raw = mkOption {
- type = str;
- internal = true;
- description = "Encoded & Encrypted secret part data, passed from fleet.nix";
- };
hash = mkOption {
type = str;
description = "Hash of secret in encoded format";
@@ -50,34 +64,50 @@
};
stablePath = mkOption {
type = str;
- description = "Path to secret part, incorporating data hash (thus it will be updated on secret change)";
+ description = "Path to secret part, stable path (users are expected to watch for file changes/re-read secret on demand)";
};
data = mkOption {
type = str;
description = "Secret public data (only available for plaintext)";
};
};
- config = {
- hash = hashString "sha1" config.raw;
- data = decodeRawSecret config.raw;
- path = "/run/secrets/${secretName}/${config.hash}-${partName}";
- stablePath = "/run/secrets/${secretName}/${partName}";
- };
+ config =
+ let
+ raw = sysConfig.data.secrets.${secretName}.${partName}.raw;
+ in
+ {
+ hash = hashString "sha1" raw;
+ data = decodeRawSecret raw;
+ path = "/run/secrets/${secretName}/${config.hash}-${partName}";
+ stablePath = "/run/secrets/${secretName}/${partName}";
+ };
}
);
secretType = submodule (
- { config, ... }:
+ {
+ config,
+ loc,
+ options,
+ ...
+ }:
let
- secretName = config._module.args.name;
+ secretName =
+ # Due to config definition for freeformType, we can't just use _module.args due to infinite recursion, instead
+ # extract the secret name the ugly way...
+ let
+ saLoc = options._module.specialArgs.loc;
+ comp = elemAt saLoc;
+ in
+ assert
+ (length saLoc == 2 ||
+ length saLoc == 4 &&
+ comp 0 == "secrets" && comp 2 == "_module" && comp 3 == "specialArgs") ||
+ throw "Unexpected module structure ${toJSON saLoc}";
+ if length saLoc == 2 then "documentation generator stub" else comp 1;
in
{
freeformType = lazyAttrsOf (secretPartType secretName);
options = {
- shared = mkOption {
- description = "Is this secret owned by this machine, or propagated from shared secrets";
- default = false;
- };
-
generator = mkOption {
type = uniq (nullOr (functionTo package));
description = "Derivation to evaluate for secret generation";
@@ -104,18 +134,30 @@
description = "Data that gets embedded into secret part";
default = null;
};
+ expectedPrivateParts = mkOption {
+ type = listOf str;
+ default = [ ];
+ description = "List of parts that are expected to be encrypted";
+ };
+ expectedPublicParts = mkOption {
+ type = listOf str;
+ default = [ ];
+ description = "List of parts that are expected to be public";
+ };
};
+ config = mapAttrs (_: _: { }) (removeAttrs (sysConfig.data.secrets.${secretName} or {}) [ "shared" ]);
}
);
- processPart = part: {
- inherit (part) raw path stablePath;
+ processPart = secretName: partName: part: {
+ inherit (part) path stablePath;
+ raw = config.data.secrets.${secretName}.${partName}.raw;
};
processSecret =
- secret:
+ secretName: secret:
{
inherit (secret) group mode owner;
}
- // (mapAttrs (_: processPart) (
+ // (mapAttrs (processPart secretName) (
removeAttrs secret [
"shared"
"generator"
@@ -123,11 +165,14 @@
"group"
"owner"
"expectedGenerationData"
+ "expectedPrivateParts"
+ "expectedPublicParts"
]
));
+ secretsData = (mapAttrs (processSecret) config.secrets);
secretsFile = pkgs.writeTextFile {
name = "secrets.json";
- text = builtins.toJSON (mapAttrs (_: processSecret) config.secrets);
+ text = toJSON secretsData;
};
useSysusers =
(config.systemd ? sysusers && config.systemd.sysusers.enable)
@@ -135,15 +180,38 @@
in
{
options = {
+ data.secrets = mkOption {
+ type = attrsOf secretDataType;
+ default = { };
+ description = "Host-local secret data";
+ };
secrets = mkOption {
type = attrsOf secretType;
default = { };
description = "Host-local secrets";
};
+ system.secretsData = mkOption {
+ type = unspecified;
+ default = {};
+ description = "secrets.json contents";
+ };
};
config = {
+ system = {inherit secretsData;};
environment.systemPackages = [ pkgs.fleet-install-secrets ];
+ warnings = filter (v: v!=null) (mapAttrsToList (
+ name: secret:
+ if
+ secret.expectedPrivateParts == [ ]
+ && secret.expectedPublicParts == [ ]
+ && !(config.data.secrets.${name} or { shared = false; }).shared
+ then
+ "Secret ${name} has no expected parts defined, this is deprecated for better visibility"
+ else
+ null
+ ) config.secrets);
+
systemd.services.fleet-install-secrets = mkIf useSysusers {
wantedBy = [ "sysinit.target" ];
after = [ "systemd-sysusers.service" ];
modules/secrets-data.nixdiffbeforeafterboth--- a/modules/secrets-data.nix
+++ b/modules/secrets-data.nix
@@ -151,8 +151,9 @@
toJSON (config.data.sharedSecrets.${name} or { owners = [ ]; }).owners
}. Run fleet secrets regenerate to fix";
}) config.sharedSecrets)
+
++ (mapAttrsToList (name: secret: {
- # TODO: Same aassertion should be in host secrets
+ # TODO: Same assertion should be in host secrets
assertion =
(config.data.sharedSecrets.${name} or { generationData = null; }).generationData
== secret.expectedGenerationData;
@@ -160,6 +161,5 @@
toJSON (config.data.sharedSecrets.${name} or { generationData = null; }).generationData
}. Run fleet secrets regenerate to fix";
}) config.sharedSecrets);
- sharedSecrets = mapAttrs (_: _: { }) config.data.sharedSecrets;
};
}
modules/secrets.nixdiffbeforeafterboth--- a/modules/secrets.nix
+++ b/modules/secrets.nix
@@ -69,6 +69,16 @@
description = "Contextual metadata embedded within the secret part value";
default = null;
};
+ expectedPrivateParts = mkOption {
+ type = listOf str;
+ default = [ ];
+ description = "List of parts that are expected to be encrypted";
+ };
+ expectedPublicParts = mkOption {
+ type = listOf str;
+ default = [ ];
+ description = "List of parts that are expected to be public";
+ };
};
};
in
@@ -81,16 +91,25 @@
};
};
config = {
- hosts = mapAttrs (_: secretMap: {
- nixos.secrets = mapAttrs (
- _: s:
- removeAttrs s [
- "createdAt"
- "expiresAt"
- "generationData"
- ]
- ) secretMap;
- }) config.data.hostSecrets;
+ hosts = mapAttrs (
+ _: secretMap:
+ let
+ partsOf =
+ s:
+ removeAttrs s [
+ "createdAt"
+ "expiresAt"
+ "generationData"
+ ];
+
+ in
+ {
+ nixos.data.secrets = mapAttrs (_: s: partsOf s) secretMap;
+ # nixos.secrets = mapAttrs (
+ # _: s: mapAttrs (_: _: {}) (partsOf s)
+ # ) secretMap;
+ }
+ ) config.data.hostSecrets;
nixpkgs.overlays = [
(final: prev: {
mkSecretGenerators =