git.delta.rocks / jrsonnet / refs/commits / ffbc7e982cb4

1use std::{2	cell::OnceCell,3	collections::BTreeSet,4	ffi::{OsStr, OsString},5	fmt::Display,6	io::Write,7	ops::Deref,8	path::PathBuf,9	str::FromStr,10	sync::{Arc, Mutex, MutexGuard, OnceLock},11};1213use anyhow::{anyhow, bail, ensure, Context, Result};14use fleet_shared::SecretData;15use nix_eval::{nix_go, nix_go_json, util::assert_warn, NixSession, Value};16use openssh::SessionBuilder;17use serde::de::DeserializeOwned;18use tempfile::NamedTempFile;1920use crate::{21	command::MyCommand,22	fleetdata::{FleetData, FleetSecret, FleetSharedSecret},23};2425pub struct FleetConfigInternals {26	pub local_system: String,27	pub directory: PathBuf,28	pub data: Mutex<FleetData>,29	pub nix_args: Vec<OsString>,30	/// fleet_config.config31	pub config_field: Value,32	// TODO: Remove with connectivity refactor33	pub localhost: String,3435	/// import nixpkgs {system = local};36	pub default_pkgs: Value,37	pub nixpkgs: Value,3839	pub nix_session: NixSession,40}4142// TODO: Make field not pub43#[derive(Clone)]44pub struct Config(pub Arc<FleetConfigInternals>);4546impl Deref for Config {47	type Target = FleetConfigInternals;4849	fn deref(&self) -> &Self::Target {50		&self.051	}52}5354#[derive(Clone, Copy, Debug)]55pub enum EscalationStrategy {56	Sudo,57	Run0,58	Su,59}6061pub struct ConfigHost {62	config: Config,63	pub name: String,64	groups: OnceCell<Vec<String>>,6566	pub host_config: Option<Value>,67	pub nixos_config: OnceCell<Value>,68	pub pkgs_override: Option<Value>,6970	// TODO: Move command helpers away with connectivity refactor71	pub local: bool,72	pub session: OnceLock<Arc<openssh::Session>>,73}74// TODO: Move command helpers away with connectivity refactor75impl ConfigHost {76	pub async fn escalation_strategy(&self) -> Result<EscalationStrategy> {77		// Prefer sudo, as run0 has some gotchas with polkit78		// and too many repeating prompts.79		if (self.find_in_path("sudo").await).is_ok() {80			return Ok(EscalationStrategy::Sudo);81		}82		if (self.find_in_path("run0").await).is_ok() {83			return Ok(EscalationStrategy::Run0);84		}85		Ok(EscalationStrategy::Su)86	}87	async fn open_session(&self) -> Result<Arc<openssh::Session>> {88		assert!(!self.local, "do not open ssh connection to local session");89		// FIXME: TOCTOU90		if let Some(session) = &self.session.get() {91			return Ok((*session).clone());92		};93		let session = SessionBuilder::default();94		let session = session95			.connect(&self.name)96			.await97			.map_err(|e| anyhow!("ssh error while connecting to {}: {e}", self.name))?;98		let session = Arc::new(session);99		self.session.set(session.clone()).expect("TOCTOU happened");100		Ok(session)101	}102	pub async fn mktemp_dir(&self) -> Result<String> {103		let mut cmd = self.cmd("mktemp").await?;104		cmd.arg("-d");105		let path = cmd.run_string().await?;106		Ok(path.trim_end().to_owned())107	}108	pub async fn read_file_bin(&self, path: impl AsRef<OsStr>) -> Result<Vec<u8>> {109		let mut cmd = self.cmd("cat").await?;110		cmd.arg(path);111		cmd.run_bytes().await112	}113	pub async fn read_file_text(&self, path: impl AsRef<OsStr>) -> Result<String> {114		let mut cmd = self.cmd("cat").await?;115		cmd.arg(path);116		cmd.run_string().await117	}118	pub async fn read_dir(&self, path: impl AsRef<OsStr>) -> Result<Vec<String>> {119		let mut cmd = self.cmd("ls").await?;120		cmd.arg(path);121		let out = cmd.run_string().await?;122		let mut lines = out.split('\n');123		if let Some(last) = lines.next_back() {124			ensure!(last.is_empty(), "output of ls should end with newline");125		}126		Ok(lines.map(ToOwned::to_owned).collect())127	}128	#[allow(dead_code)]129	pub async fn read_file_json<D: DeserializeOwned>(&self, path: impl AsRef<OsStr>) -> Result<D> {130		let text = self.read_file_text(path).await?;131		Ok(serde_json::from_str(&text)?)132	}133	pub async fn read_env(&self, env: &str) -> Result<String> {134		let mut cmd = self.cmd("printenv").await?;135		cmd.arg(env);136		cmd.run_string().await137	}138	pub async fn find_in_path(&self, command: &str) -> Result<String> {139		// // `which` is not a part of coreutils, and it might not exist on machine.140		// let path = self.read_env("PATH").await?;141		// // Assuming delimiter is :, we don't work with windows host, this check will be much142		// // more sophisticated in remowt backend (and quicker, since actual PATH search will be done on remote machine)143		// for ele in path.split(':') {144		// 	let test_path = format!("{ele}/{cmd}");145		// 	test -x etc146		// }147		// let mut cmd = self.cmd("printenv").await?;148		// cmd.arg(env);149		// Ok(cmd.run_string().await?)150		// Assuming this is an environment issue if which doesn't exist, will be fixed with remowt.151		let mut cmd = self152			.cmd_escalation(153				// Not used154				EscalationStrategy::Su,155				"which",156			)157			.await?;158		cmd.arg(command);159		cmd.run_string().await160	}161	pub async fn read_file_value<D: FromStr>(&self, path: impl AsRef<OsStr>) -> Result<D>162	where163		<D as FromStr>::Err: Display,164	{165		let text = self.read_file_text(path).await?;166		D::from_str(&text).map_err(|e| anyhow!("failed to parse value: {e}"))167	}168	pub async fn cmd(&self, cmd: impl AsRef<OsStr>) -> Result<MyCommand> {169		self.cmd_escalation(self.escalation_strategy().await?, cmd)170			.await171	}172	pub async fn cmd_escalation(173		&self,174		escalation: EscalationStrategy,175		cmd: impl AsRef<OsStr>,176	) -> Result<MyCommand> {177		if self.local {178			Ok(MyCommand::new(escalation, cmd))179		} else {180			let session = self.open_session().await?;181			Ok(MyCommand::new_on(escalation, cmd, session))182		}183	}184185	pub async fn decrypt(&self, data: SecretData) -> Result<Vec<u8>> {186		ensure!(data.encrypted, "secret is not encrypted");187		let mut cmd = self.cmd("fleet-install-secrets").await?;188		cmd.arg("decrypt").eqarg("--secret", data.to_string());189		let encoded = cmd190			.sudo()191			.run_string()192			.await193			.context("failed to call remote host for decrypt")?;194		let data: SecretData = encoded.parse().map_err(|e| anyhow!("{e}"))?;195		ensure!(!data.encrypted, "secret came out encrypted");196		Ok(data.data)197	}198	pub async fn reencrypt(&self, data: SecretData, targets: Vec<String>) -> Result<SecretData> {199		ensure!(data.encrypted, "secret is not encrypted");200		let mut cmd = self.cmd("fleet-install-secrets").await?;201		cmd.arg("reencrypt").eqarg("--secret", data.to_string());202		for target in targets {203			let key = self.config.key(&target).await?;204			cmd.eqarg("--targets", key);205		}206		let encoded = cmd207			.sudo()208			.run_string()209			.await210			.context("failed to call remote host for decrypt")?;211		let data: SecretData = encoded.parse().map_err(|e| anyhow!("{e}"))?;212		ensure!(data.encrypted, "secret came out not encrypted");213		Ok(data)214	}215	/// Returns path for futureproofing, as path might change i.e on conversion to CA216	pub async fn remote_derivation(&self, path: &PathBuf) -> Result<PathBuf> {217		if self.local {218			// Path is located locally, thus already trusted.219			return Ok(path.to_owned());220		}221		let mut nix = MyCommand::new(222			// Not used223			EscalationStrategy::Su,224			"nix",225		);226		nix.arg("copy")227			.arg("--substitute-on-destination")228			.comparg("--to", format!("ssh-ng://{}", self.name))229			.arg(path);230		nix.run_nix().await.context("nix copy")?;231		Ok(path.to_owned())232	}233	pub async fn systemctl_stop(&self, name: &str) -> Result<()> {234		let mut cmd = self.cmd("systemctl").await?;235		cmd.arg("stop").arg(name);236		cmd.sudo().run().await237	}238	pub async fn systemctl_start(&self, name: &str) -> Result<()> {239		let mut cmd = self.cmd("systemctl").await?;240		cmd.arg("start").arg(name);241		cmd.sudo().run().await242	}243244	pub async fn rm_file(&self, path: impl AsRef<OsStr>, sudo: bool) -> Result<()> {245		let mut cmd = self.cmd("rm").await?;246		cmd.arg("-f").arg(path);247		if sudo {248			cmd = cmd.sudo()249		}250		cmd.run().await251	}252}253impl ConfigHost {254	// TOCTOU is possible here in case if config is changed, but this case is not handled anywhere anyway,255	// assuming getting tags always returns the same value.256	pub async fn tags(&self) -> Result<Vec<String>> {257		if let Some(v) = self.groups.get() {258			return Ok(v.clone());259		}260		let Some(host_config) = &self.host_config else {261			return Ok(vec![]);262		};263		let tags: Vec<String> = nix_go_json!(host_config.tags);264265		let _ = self.groups.set(tags.clone());266267		Ok(tags)268	}269	pub async fn nixos_config(&self) -> Result<Value> {270		if let Some(v) = self.nixos_config.get() {271			return Ok(v.clone());272		}273		let Some(host_config) = &self.host_config else {274			bail!("local host has no nixos_config");275		};276		let nixos_config = nix_go!(host_config.nixos.config);277		assert_warn("nixos config evaluation", &nixos_config).await?;278279		let _ = self.nixos_config.set(nixos_config.clone());280281		Ok(nixos_config)282	}283284	pub async fn list_configured_secrets(&self) -> Result<Vec<String>> {285		let nixos = self.nixos_config().await?;286		let secrets = nix_go!(nixos.secrets);287		let mut out = Vec::new();288		for name in secrets.list_fields().await? {289			let secret = nix_go!(secrets[{ name }]);290			let is_shared: bool = nix_go_json!(secret.shared);291			if is_shared {292				continue;293			}294			out.push(name);295		}296		Ok(out)297	}298	pub async fn secret_field(&self, name: &str) -> Result<Value> {299		let nixos = self.nixos_config().await?;300		Ok(nix_go!(nixos.secrets[{ name }]))301	}302303	/// Packages for this host, resolved with nixpkgs overlays304	pub async fn pkgs(&self) -> Result<Value> {305		if let Some(value) = &self.pkgs_override {306			return Ok(value.clone());307		}308		let Some(host_config) = &self.host_config else {309			bail!("local host has no host_config");310		};311		// TODO: Should nixos.options be cached?312		Ok(nix_go!(host_config.nixos.options._module.args.value.pkgs))313	}314}315316impl Config {317	pub async fn tagged_hostnames(&self, tag: &str) -> Result<Vec<String>> {318		let config = &self.config_field;319		let tagged: Vec<String> = nix_go_json!(config.taggedWith[{ tag }]);320		Ok(tagged)321	}322	pub async fn expand_owner_set(&self, owners: Vec<String>) -> Result<BTreeSet<String>> {323		let mut out = BTreeSet::new();324		for owner in owners {325			if let Some(tag) = owner.strip_prefix('@') {326				let hosts = self.tagged_hostnames(tag).await?;327				out.extend(hosts);328			} else {329				out.insert(owner);330			}331		}332		Ok(out)333	}334	pub fn local_host(&self) -> ConfigHost {335		ConfigHost {336			config: self.clone(),337			name: "<virtual localhost>".to_owned(),338			host_config: None,339			nixos_config: OnceCell::new(),340			groups: {341				let cell = OnceCell::new();342				let _ = cell.set(vec![]);343				cell344			},345			pkgs_override: Some(self.default_pkgs.clone()),346347			local: true,348			session: OnceLock::new(),349		}350	}351352	pub async fn host(&self, name: &str) -> Result<ConfigHost> {353		let config = &self.config_field;354		let host_config = nix_go!(config.hosts[{ name }]);355356		Ok(ConfigHost {357			config: self.clone(),358			name: name.to_owned(),359			host_config: Some(host_config),360			nixos_config: OnceCell::new(),361			groups: OnceCell::new(),362			pkgs_override: None,363364			// TODO: Remove with connectivit refactor365			local: self.localhost == name,366			session: OnceLock::new(),367		})368	}369	pub async fn list_hosts(&self) -> Result<Vec<ConfigHost>> {370		let config = &self.config_field;371		let names = nix_go!(config.hosts).list_fields().await?;372		let mut out = vec![];373		for name in names {374			out.push(self.host(&name).await?);375		}376		Ok(out)377	}378	// TODO: Replace usages with .host().nixos_config379	pub async fn system_config(&self, host: &str) -> Result<Value> {380		let fleet_field = &self.config_field;381		Ok(nix_go!(fleet_field.hosts[{ host }].nixos.config))382	}383384	/// Shared secrets configured in fleet.nix or in flake385	pub async fn list_configured_shared(&self) -> Result<Vec<String>> {386		let config_field = &self.config_field;387		Ok(nix_go!(config_field.sharedSecrets).list_fields().await?)388	}389	/// Shared secrets configured in fleet.nix390	pub fn list_shared(&self) -> Vec<String> {391		let data = self.data();392		data.shared_secrets.keys().cloned().collect()393	}394	pub fn has_shared(&self, name: &str) -> bool {395		let data = self.data();396		data.shared_secrets.contains_key(name)397	}398	pub fn replace_shared(&self, name: String, shared: FleetSharedSecret) {399		let mut data = self.data_mut();400		data.shared_secrets.insert(name.to_owned(), shared);401	}402	pub fn remove_shared(&self, secret: &str) {403		let mut data = self.data_mut();404		data.shared_secrets.remove(secret);405	}406407	pub fn list_secrets(&self, host: &str) -> Vec<String> {408		let data = self.data();409		let Some(secrets) = data.host_secrets.get(host) else {410			return Vec::new();411		};412		secrets.keys().cloned().collect()413	}414415	pub fn has_secret(&self, host: &str, secret: &str) -> bool {416		let data = self.data();417		let Some(host_secrets) = data.host_secrets.get(host) else {418			return false;419		};420		host_secrets.contains_key(secret)421	}422	pub fn insert_secret(&self, host: &str, secret: String, value: FleetSecret) {423		let mut data = self.data_mut();424		let host_secrets = data.host_secrets.entry(host.to_owned()).or_default();425		host_secrets.insert(secret, value);426	}427428	pub fn host_secret(&self, host: &str, secret: &str) -> Result<FleetSecret> {429		let data = self.data();430		let Some(host_secrets) = data.host_secrets.get(host) else {431			bail!("no secrets for machine {host}");432		};433		let Some(secret) = host_secrets.get(secret) else {434			bail!("machine {host} has no secret {secret}");435		};436		Ok(secret.clone())437	}438	pub fn shared_secret(&self, secret: &str) -> Result<FleetSharedSecret> {439		let data = self.data();440		let Some(secret) = data.shared_secrets.get(secret) else {441			bail!("no shared secret {secret}");442		};443		Ok(secret.clone())444	}445	pub async fn shared_secret_expected_owners(&self, secret: &str) -> Result<Vec<String>> {446		let config_field = &self.config_field;447		Ok(nix_go_json!(448			config_field.sharedSecrets[{ secret }].expectedOwners449		))450	}451452	// TODO: Should this be something modifiable from other processes?453	// E.g terraform provider might want to update FleetData (e.g secrets),454	// and current implementation assumes only one process holds current fleet.nix455	// Given that it is no longer needs to be a file for nix evaluation,456	// maybe it can be a .nix file for persistence, but accessible only457	// thru some shared state controller? Might it be stored in terraform458	// state provider?459	pub fn data(&self) -> MutexGuard<FleetData> {460		self.data.lock().unwrap()461	}462	pub fn data_mut(&self) -> MutexGuard<FleetData> {463		self.data.lock().unwrap()464	}465	pub fn save(&self) -> Result<()> {466		let mut tempfile = NamedTempFile::new_in(self.directory.clone()).context("failed to create updated version of fleet.nix in the same directory as original.\nDo you have write access to it? Access only to the fleet.nix won't be enough, the directory is used for atomic overwrite operation.\nIt is not recommended to use fleet by root anyway, move fleet project to your home directory.")?;467		let data = nixlike::serialize(&self.data() as &FleetData)?;468		tempfile.write_all(469			format!(470				"# This file contains fleet state and shouldn't be edited by hand\n\n{}\n\n# vim: ts=2 et nowrap\n",471				data472			)473			.as_bytes(),474		)?;475		let mut fleet_data_path = self.directory.clone();476		fleet_data_path.push("fleet.nix");477		tempfile.persist(fleet_data_path)?;478		Ok(())479	}480}