git.delta.rocks / jrsonnet / refs/commits / f779c26f9056

1use std::{2	collections::{BTreeMap, BTreeSet, HashSet},3	ffi::OsString,4	io::{self, stdin, stdout, Read, Write},5	path::PathBuf,6};78use anyhow::{anyhow, bail, ensure, Context, Result};9use chrono::{DateTime, Utc};10use clap::Parser;11use crossterm::{terminal, tty::IsTty};12use fleet_shared::SecretData;13use itertools::Itertools;14use nix_eval::{nix_go, nix_go_json, Value};15use owo_colors::OwoColorize;16use serde::Deserialize;17use tabled::{Table, Tabled};18use tokio::{fs::read, process::Command};19use tracing::{error, info, info_span, warn, Instrument};2021use crate::{22	fleetdata::{encrypt_secret_data, FleetSecret, FleetSecretPart, FleetSharedSecret},23	host::Config,24};2526#[derive(Parser)]27pub enum Secret {28	/// Force load host keys for all defined hosts29	ForceKeys,30	/// Add secret, data should be provided in stdin31	AddShared {32		/// Secret name33		name: String,34		/// Secret owners35		#[clap(long, short)]36		machines: Vec<String>,37		/// Override secret if already present38		#[clap(long)]39		force: bool,40		/// Secret public part41		#[clap(long)]42		public: Option<String>,43		/// Load public part from specified file44		#[clap(long)]45		public_file: Option<PathBuf>,4647		/// Create a notification on secret expiration48		#[clap(long)]49		expires_at: Option<DateTime<Utc>>,5051		/// Secret with this name already exists, override its value while keeping the same owners.52		#[clap(long)]53		re_add: bool,5455		/// How to name public secret part56		#[clap(long, short = 'p', default_value = "public")]57		public_part: String,58		/// How to name private secret part59		#[clap(short = 's', long, default_value = "secret")]60		part: String,61	},62	/// Add secret, data should be provided in stdin63	Add {64		/// Secret name65		name: String,66		/// Secret owner67		#[clap(short = 'm', long)]68		machine: String,69		/// Replace secret if already present70		#[clap(long)]71		replace: bool,72		/// Add new parts to existing secret73		#[clap(long)]74		merge: bool,75		/// Secret public part76		#[clap(long)]77		public: Option<String>,78		/// Load public part from specified file79		#[clap(long)]80		public_file: Option<PathBuf>,8182		/// How to name public secret part83		#[clap(short = 'p', long, default_value = "public")]84		public_part: String,85		/// How to name private secret part86		#[clap(short = 's', long, default_value = "secret")]87		part: String,88	},89	/// Read secret from remote host, requires sudo on said host90	Read {91		name: String,92		#[clap(short = 'm', long)]93		machine: String,9495		/// Which private secret part to read96		#[clap(short = 'p', long, default_value = "secret")]97		part: String,98	},99	UpdateShared {100		name: String,101102		#[clap(short = 'm', long)]103		machine: Option<Vec<String>>,104105		#[clap(long)]106		add_machine: Vec<String>,107		#[clap(long)]108		remove_machine: Vec<String>,109110		/// Which host should we use to decrypt111		#[clap(long)]112		prefer_identities: Vec<String>,113	},114	Regenerate {115		/// Which host should we use to decrypt, in case if reencryption is required, without116		/// regeneration117		#[clap(long)]118		prefer_identities: Vec<String>,119	},120	List {},121	Edit {122		name: String,123		#[clap(short = 'm', long)]124		machine: String,125126		#[clap(long)]127		add: bool,128129		/// Which private secret part to read130		#[clap(short = 'p', long, default_value = "secret")]131		part: String,132	},133}134135#[tracing::instrument(skip(config, secret, field, prefer_identities))]136async fn update_owner_set(137	secret_name: &str,138	config: &Config,139	mut secret: FleetSharedSecret,140	field: Value,141	updated_set: &[String],142	prefer_identities: &[String],143) -> Result<FleetSharedSecret> {144	let original_set = secret.owners.clone();145146	let set = original_set.iter().collect::<BTreeSet<_>>();147	let expected_set = updated_set.iter().collect::<BTreeSet<_>>();148149	if set == expected_set {150		info!("no need to update owner list, it is already correct");151		return Ok(secret);152	}153154	let should_regenerate = if set.difference(&expected_set).next().is_some() {155		// TODO: Remove this warning for revokable secrets.156		warn!("host was removed from secret owners, but until this host rebuild, the secret will still be stored on it.");157		nix_go_json!(field.regenerateOnOwnerRemoved)158	} else if expected_set.difference(&set).next().is_some() {159		nix_go_json!(field.regenerateOnOwnerAdded)160	} else {161		false162	};163164	if should_regenerate {165		info!("secret is owner-dependent, will regenerate");166		let generated = generate_shared(config, secret_name, field, updated_set.to_vec()).await?;167		Ok(generated)168	} else {169		let identity_holder = if !prefer_identities.is_empty() {170			prefer_identities171				.iter()172				.find(|i| original_set.iter().any(|s| s == *i))173		} else {174			secret.owners.first()175		};176		let Some(identity_holder) = identity_holder else {177			bail!("no available holder found");178		};179180		for (part_name, part) in secret.secret.parts.iter_mut() {181			let _span = info_span!("part reencryption", part_name);182			if !part.raw.encrypted {183				continue;184			}185			let host = config.host(identity_holder).await?;186			let encrypted = host187				.reencrypt(part.raw.clone(), updated_set.to_vec())188				.await?;189			part.raw = encrypted;190		}191192		secret.owners = updated_set.to_vec();193		Ok(secret)194	}195}196197#[derive(Deserialize)]198#[serde(rename_all = "camelCase")]199enum GeneratorKind {200	Impure,201	Pure,202}203204async fn generate_pure(205	_config: &Config,206	_display_name: &str,207	_secret: Value,208	_default_generator: Value,209	_owners: &[String],210) -> Result<FleetSecret> {211	bail!("pure generators are broken for now")212}213async fn generate_impure(214	config: &Config,215	_display_name: &str,216	secret: Value,217	default_generator: Value,218	owners: &[String],219) -> Result<FleetSecret> {220	let generator = nix_go!(secret.generator);221	let on: Option<String> = nix_go_json!(default_generator.impureOn);222223	let host = if let Some(on) = &on {224		config.host(on).await?225	} else {226		config.local_host()227	};228	let on_pkgs = host.pkgs().await?;229	let call_package = nix_go!(on_pkgs.callPackage);230	let mk_secret_generators = nix_go!(on_pkgs.mkSecretGenerators);231232	let mut recipients = Vec::new();233	for owner in owners {234		let key = config.key(owner).await?;235		recipients.push(key);236	}237	let generators = nix_go!(mk_secret_generators(Obj {238		recipients: { recipients },239	}));240241	let generator = nix_go!(call_package(generator)(generators));242243	let generator = generator.build().await?;244	let generator = generator245		.get("out")246		.ok_or_else(|| anyhow!("missing generateImpure out"))?;247	let generator = host.remote_derivation(generator).await?;248249	let out_parent = host.mktemp_dir().await?;250	let out = format!("{out_parent}/out");251252	let mut gen = host.cmd(generator).await?;253	gen.env("out", &out);254	if on.is_none() {255		// This path is local, thus we can feed `OsString` directly to env var... But I don't think that's necessary to handle.256		let project_path: String = config257			.directory258			.clone()259			.into_os_string()260			.into_string()261			.map_err(|s| anyhow!("fleet project path is not utf-8: {s:?}"))?;262		gen.env("FLEET_PROJECT", project_path);263	}264	gen.run().await.context("impure generator")?;265266	{267		let marker = host.read_file_text(format!("{out}/marker")).await?;268		ensure!(marker == "SUCCESS", "generation not succeeded");269	}270271	let mut parts = BTreeMap::new();272	for part in host.read_dir(&out).await? {273		if part == "created_at" || part == "expired_at" || part == "marker" {274			continue;275		}276		let contents: SecretData = host277			.read_file_text(format!("{out}/{part}"))278			.await?279			.parse()280			.map_err(|e| anyhow!("failed to decode secret {out:?} part {part:?}: {e}"))?;281		parts.insert(part.to_owned(), FleetSecretPart { raw: contents });282	}283284	let created_at = host.read_file_value(format!("{out}/created_at")).await?;285	let expires_at = host.read_file_value(format!("{out}/expires_at")).await.ok();286287	Ok(FleetSecret {288		created_at,289		expires_at,290		parts,291	})292}293async fn generate(294	config: &Config,295	display_name: &str,296	secret: Value,297	owners: &[String],298) -> Result<FleetSecret> {299	let generator = nix_go!(secret.generator);300	// Can't properly check on nix module system level301	{302		let gen_ty = generator.type_of().await?;303		if gen_ty == "null" {304			bail!("secret has no generator defined, can't automatically generate it.");305		}306		if gen_ty != "lambda" {307			bail!("generator should be lambda, got {gen_ty}");308		}309	}310	let default_pkgs = &config.default_pkgs;311	let default_call_package = nix_go!(default_pkgs.callPackage);312	let default_mk_secret_generators = nix_go!(default_pkgs.mkSecretGenerators);313	// Generators provide additional information in passthru, to access314	// passthru we should call generator, but information about where this generator is supposed to build315	// is located in passthru... Thus evaluating generator on host.316	//317	// Maybe it is also possible to do some magic with __functor?318	//319	// I don't want to make modules always responsible for additional secret data anyway,320	// so it should be in derivation, and not in the secret data itself.321	let generators = nix_go!(default_mk_secret_generators(Obj {322		recipients: { <Vec<String>>::new() },323	}));324	let default_generator = nix_go!(default_call_package(generator)(generators));325326	let kind: GeneratorKind = nix_go_json!(default_generator.generatorKind);327328	match kind {329		GeneratorKind::Impure => {330			generate_impure(config, display_name, secret, default_generator, owners).await331		}332		GeneratorKind::Pure => {333			generate_pure(config, display_name, secret, default_generator, owners).await334		}335	}336}337async fn generate_shared(338	config: &Config,339	display_name: &str,340	secret: Value,341	expected_owners: Vec<String>,342) -> Result<FleetSharedSecret> {343	// let owners: Vec<String> = nix_go_json!(secret.expectedOwners);344	Ok(FleetSharedSecret {345		secret: generate(config, display_name, secret, &expected_owners).await?,346		owners: expected_owners,347	})348}349350async fn parse_public(351	public: Option<String>,352	public_file: Option<PathBuf>,353) -> Result<Option<SecretData>> {354	Ok(match (public, public_file) {355		(Some(v), None) => Some(SecretData {356			data: v.into(),357			encrypted: false,358		}),359		(None, Some(v)) => Some(SecretData {360			data: read(v).await?,361			encrypted: false,362		}),363		(Some(_), Some(_)) => {364			bail!("only public or public_file should be set")365		}366		(None, None) => None,367	})368}369370async fn parse_secret() -> Result<Option<Vec<u8>>> {371	let mut input = vec![];372	stdin().read_to_end(&mut input)?;373	if input.is_empty() {374		Ok(None)375	} else {376		Ok(Some(input))377	}378}379380fn parse_machines(381	initial: Vec<String>,382	machines: Option<Vec<String>>,383	mut add_machines: Vec<String>,384	mut remove_machines: Vec<String>,385) -> Result<Vec<String>> {386	if machines.is_none() && add_machines.is_empty() && remove_machines.is_empty() {387		bail!("no operation");388	}389390	let initial_machines = initial.clone();391	let mut target_machines = initial;392	info!("Currently encrypted for {initial_machines:?}");393394	// ensure!(machines.is_some() || !add_machines.is_empty() || )395	if let Some(machines) = machines {396		ensure!(397			add_machines.is_empty() && remove_machines.is_empty(),398			"can't combine --machines and --add-machines/--remove-machines"399		);400		let target = initial_machines.iter().collect::<HashSet<_>>();401		let source = machines.iter().collect::<HashSet<_>>();402		for removed in target.difference(&source) {403			remove_machines.push((*removed).clone());404		}405		for added in source.difference(&target) {406			add_machines.push((*added).clone());407		}408	}409410	for machine in &remove_machines {411		let mut removed = false;412		while let Some(pos) = target_machines.iter().position(|m| m == machine) {413			target_machines.swap_remove(pos);414			removed = true;415		}416		if !removed {417			warn!("secret is not enabled for {machine}");418		}419	}420	for machine in &add_machines {421		if target_machines.iter().any(|m| m == machine) {422			warn!("secret is already added to {machine}");423		} else {424			target_machines.push(machine.to_owned());425		}426	}427	if !remove_machines.is_empty() {428		// TODO: maybe force secret regeneration?429		// Not that useful without revokation.430		warn!("secret will not be regenerated for removed machines, and until host rebuild, they will still possess the ability to decode secret");431	}432	Ok(target_machines)433}434impl Secret {435	pub async fn run(self, config: &Config) -> Result<()> {436		match self {437			Secret::ForceKeys => {438				for host in config.list_hosts().await? {439					if config.should_skip(&host).await? {440						continue;441					}442					config.key(&host.name).await?;443				}444			}445			Secret::AddShared {446				mut machines,447				name,448				force,449				public,450				public_part: public_name,451				public_file,452				expires_at,453				re_add,454				part: part_name,455			} => {456				// TODO: Forbid updating secrets with set expectedOwners (= not user-managed).457458				let exists = config.has_shared(&name);459				if exists && !force && !re_add {460					bail!("secret already defined");461				}462				if re_add {463					// Fixme: use clap to limit this usage464					ensure!(!force, "--force and --readd are not compatible");465					ensure!(exists, "secret doesn't exists");466					ensure!(467						machines.is_empty(),468						"you can't use machines argument for --readd"469					);470					let shared = config.shared_secret(&name)?;471					machines = shared.owners;472				}473474				let recipients = config.recipients(machines.clone()).await?;475476				let mut parts = BTreeMap::new();477478				let mut input = vec![];479				io::stdin().read_to_end(&mut input)?;480481				if !input.is_empty() {482					let encrypted = encrypt_secret_data(recipients, input)483						.ok_or_else(|| anyhow!("no recipients provided"))?;484					parts.insert(part_name, FleetSecretPart { raw: encrypted });485				}486487				if let Some(public) = parse_public(public, public_file).await? {488					parts.insert(public_name, FleetSecretPart { raw: public });489				}490491				config.replace_shared(492					name,493					FleetSharedSecret {494						owners: machines,495						secret: FleetSecret {496							created_at: Utc::now(),497							expires_at,498							parts,499						},500					},501				);502			}503			Secret::Add {504				machine,505				name,506				replace,507				merge,508				public,509				public_part: public_name,510				public_file,511				part: part_name,512			} => {513				if config.has_secret(&machine, &name) && !replace && !merge {514					bail!("secret already defined.\nUse --replace to override, or --merge to add new parts to existing secret");515				}516517				let mut out = if merge && !replace {518					config519						.host_secret(&machine, &name)520						.context("failed to read existing secret for --merge")?521				} else {522					FleetSecret {523						created_at: Utc::now(),524						expires_at: None,525						parts: BTreeMap::new(),526					}527				};528529				if let Some(secret) = parse_secret().await? {530					let recipient = config.recipient(&machine).await?;531					let encrypted =532						encrypt_secret_data(vec![recipient], secret).expect("recipient provided");533					if out534						.parts535						.insert(part_name.clone(), FleetSecretPart { raw: encrypted })536						.is_some() && !replace537					{538						bail!("part {part_name:?} is already defined");539					}540				}541542				if let Some(public) = parse_public(public, public_file).await? {543					if out544						.parts545						.insert(public_name.clone(), FleetSecretPart { raw: public })546						.is_some() && !replace547					{548						bail!("part {public_name:?} is already defined");549					}550				};551552				config.insert_secret(&machine, name, out);553			}554			#[allow(clippy::await_holding_refcell_ref)]555			Secret::Read {556				name,557				machine,558				part: part_name,559			} => {560				let secret = config.host_secret(&machine, &name)?;561				let Some(secret) = secret.parts.get(&part_name) else {562					bail!("no part {part_name} in secret {name}");563				};564				let data = if secret.raw.encrypted {565					let host = config.host(&machine).await?;566					host.decrypt(secret.raw.clone()).await?567				} else {568					secret.raw.data.clone()569				};570571				stdout().write_all(&data)?;572			}573			Secret::UpdateShared {574				name,575				machine,576				add_machine,577				remove_machine,578				prefer_identities,579			} => {580				// TODO: Forbid updating secrets with set expectedOwners (= not user-managed).581582				let secret = config.shared_secret(&name)?;583				if secret.secret.parts.values().all(|v| !v.raw.encrypted) {584					bail!("no secret");585				}586587				let initial_machines = secret.owners.clone();588				let target_machines = parse_machines(589					initial_machines.clone(),590					machine,591					add_machine,592					remove_machine,593				)?;594595				if target_machines.is_empty() {596					info!("no machines left for secret, removing it");597					config.remove_shared(&name);598					return Ok(());599				}600601				let config_field = &config.config_unchecked_field;602				let field = nix_go!(config_field.sharedSecrets[{ name }]);603604				let updated = update_owner_set(605					&name,606					config,607					secret,608					field,609					&target_machines,610					&prefer_identities,611				)612				.await?;613				config.replace_shared(name, updated);614			}615			Secret::Regenerate { prefer_identities } => {616				info!("checking for secrets to regenerate");617				{618					let _span = info_span!("shared").entered();619					let expected_shared_set = config620						.list_configured_shared()621						.await?622						.into_iter()623						.collect::<HashSet<_>>();624					let shared_set = config.list_shared().into_iter().collect::<HashSet<_>>();625					for missing in expected_shared_set.difference(&shared_set) {626						let config_field = &config.config_unchecked_field;627						let secret = nix_go!(config_field.sharedSecrets[{ missing }]);628						let expected_owners: Option<Vec<String>> =629							nix_go_json!(secret.expectedOwners);630						let Some(expected_owners) = expected_owners else {631							// TODO: Might still need to regenerate632							continue;633						};634						info!("generating secret: {missing}");635						let shared = generate_shared(config, missing, secret, expected_owners)636							.in_current_span()637							.await?;638						config.replace_shared(missing.to_string(), shared)639					}640				}641				for host in config.list_hosts().await? {642					if config.should_skip(&host).await? {643						continue;644					}645646					let _span = info_span!("host", host = host.name).entered();647					let expected_set = host648						.list_configured_secrets()649						.in_current_span()650						.await?651						.into_iter()652						.collect::<HashSet<_>>();653					let stored_set = config654						.list_secrets(&host.name)655						.into_iter()656						.collect::<HashSet<_>>();657					for missing in expected_set.difference(&stored_set) {658						info!("generating secret: {missing}");659						let secret = host.secret_field(missing).in_current_span().await?;660						let generated =661							match generate(config, missing, secret, &[host.name.clone()])662								.in_current_span()663								.await664							{665								Ok(v) => v,666								Err(e) => {667									error!("{e:?}");668									continue;669								}670							};671						config.insert_secret(&host.name, missing.to_string(), generated)672					}673				}674				let mut to_remove = Vec::new();675				for name in &config.list_shared() {676					info!("updating secret: {name}");677					let data = config.shared_secret(name)?;678					let config_field = &config.config_unchecked_field;679					let expected_owners: Vec<String> =680						nix_go_json!(config_field.sharedSecrets[{ name }].expectedOwners);681					if expected_owners.is_empty() {682						warn!("secret was removed from fleet config: {name}, removing from data");683						to_remove.push(name.to_string());684						continue;685					}686687					let secret = nix_go!(config_field.sharedSecrets[{ name }]);688					config.replace_shared(689						name.to_owned(),690						update_owner_set(691							name,692							config,693							data,694							secret,695							&expected_owners,696							&prefer_identities,697						)698						.await?,699					);700				}701				for k in to_remove {702					config.remove_shared(&k);703				}704			}705			Secret::List {} => {706				let _span = info_span!("loading secrets").entered();707				let configured = config.list_configured_shared().await?;708				#[derive(Tabled)]709				struct SecretDisplay {710					#[tabled(rename = "Name")]711					name: String,712					#[tabled(rename = "Owners")]713					owners: String,714				}715				let mut table = vec![];716				for name in configured.iter().cloned() {717					let config = config.clone();718					let expected_owners = config.shared_secret_expected_owners(&name).await?;719					let data = config.shared_secret(&name)?;720					let owners = data721						.owners722						.iter()723						.map(|o| {724							if expected_owners.contains(o) {725								o.green().to_string()726							} else {727								o.red().to_string()728							}729						})730						.collect::<Vec<_>>();731					table.push(SecretDisplay {732						owners: owners.join(", "),733						name,734					})735				}736				info!("loaded\n{}", Table::new(table).to_string())737			}738			Secret::Edit {739				name,740				machine,741				part,742				add,743			} => {744				let secret = config.host_secret(&machine, &name)?;745				if let Some(data) = secret.parts.get(&part) {746					let host = config.host(&machine).await?;747					let secret = host.decrypt(data.raw.clone()).await?;748					String::from_utf8(secret).context("secret is not utf8")?749				} else if add {750					String::new()751				} else {752					bail!("part {part} not found in secret {name}. Did you mean to `--add` it?");753				};754			}755		}756		Ok(())757	}758}759760async fn edit_temp_file(761	builder: tempfile::Builder<'_, '_>,762	r: Vec<u8>,763	header: &str,764	comment: &str,765) -> Result<(Vec<u8>, Option<String>), anyhow::Error> {766	if !stdin().is_tty() {767		// TODO: Also try to open /dev/tty directly?768		bail!("stdin is not tty, can't open editor");769	}770771	use std::fmt::Write;772	let mut file = builder.tempfile()?;773774	let mut full_header = String::new();775	let mut had = false;776	for line in header.trim_end().lines() {777		had = true;778		writeln!(&mut full_header, "{comment}{line}")?;779	}780	if had {781		writeln!(&mut full_header, "{}", comment.trim_end())?;782	}783	writeln!(784		&mut full_header,785		"{comment}Do not touch this header! It will be removed automatically"786	)?;787788	file.write_all(full_header.as_bytes())?;789	file.write_all(&r)?;790791	let abs_path = file.into_temp_path();792	let editor = std::env::var_os("VISUAL")793		.or_else(|| std::env::var_os("EDITOR"))794		.unwrap_or_else(|| "vi".into());795	let editor_args = shlex::bytes::split(editor.as_encoded_bytes())796		.ok_or_else(|| anyhow!("EDITOR env var has wrong syntax"))?;797	let editor_args = editor_args798		.into_iter()799		.map(|v| {800			// Only ASCII subsequences are replaced801			unsafe { OsString::from_encoded_bytes_unchecked(v) }802		})803		.collect_vec();804	let Some((editor, args)) = editor_args.split_first() else {805		bail!("EDITOR env var has no command");806	};807	let mut command = Command::new(editor);808	command.args(args);809810	let path_arg = abs_path.canonicalize()?;811812	// TODO: Save full state, using tcget/_getmode/_setmode813	let was_raw = terminal::is_raw_mode_enabled()?;814	terminal::enable_raw_mode()?;815816	let status = command.arg(path_arg).status().await;817818	if !was_raw {819		terminal::disable_raw_mode()?;820	}821822	let success = match status {823		Ok(s) => s.success(),824		Err(e) if e.kind() == io::ErrorKind::NotFound => {825			bail!("editor not found")826		}827		Err(e) => bail!("editor spawn error: {e}"),828	};829830	let mut file = std::fs::read(&abs_path).context("read editor output")?;831	let Some(v) = file.strip_prefix(full_header.as_bytes()) else {832		todo!();833	};834	todo!();835836	// Ok((success, abs_path))837}