103 lines
3.8 KiB
Nix
103 lines
3.8 KiB
Nix
# Shared shell steps for a unit that keeps a secret it once generated on disk
|
|
# in the swarm secret store instead. The store's value wins; a store holding
|
|
# none is seeded from the old file, so the secret keeps its value; a new value
|
|
# is minted only when there is no file either.
|
|
#
|
|
# `store_seeded` prints the value and never rotates one: the store is written
|
|
# with `-cas=0`, so only a leaf that holds nothing takes a value, and a lost
|
|
# race reads the winner's back. A read of the leaf that fails for any reason
|
|
# but "No value found" prints the store's error and neither mints nor writes.
|
|
#
|
|
# Pure function — NOT a NixOS module. Call it from a module's `let`:
|
|
#
|
|
# storeSeededSecret = import ./lib/store-seeded-secret.nix { };
|
|
# script = ''
|
|
# ${storeSeededSecret}
|
|
# store_init
|
|
# store_login
|
|
# key="$(store_seeded secret/swarm/services/foo/key /var/lib/foo/key mint_key)" || exit 1
|
|
# '';
|
|
#
|
|
# Needs `bao`, `coreutils` and `gnugrep` on the caller's `path` and the `BAO_*` client
|
|
# environment set. Takes the EXIT trap, to remove its scratch file.
|
|
{ }:
|
|
''
|
|
# Bounded, so a store that drops packets cannot hold the caller past its
|
|
# start timeout; one that refuses answers at once.
|
|
store_bao() {
|
|
timeout 15 bao "$@"
|
|
}
|
|
|
|
store_init() {
|
|
STORE_ERR="$(mktemp)"
|
|
STORE_UP=0
|
|
trap 'rm -f "$STORE_ERR"' EXIT
|
|
}
|
|
|
|
# Sets STORE_UP. A store that cannot be logged in to leaves every secret to
|
|
# its file.
|
|
store_login() {
|
|
local token
|
|
if token="$(store_bao login -method=cert -token-only 2>"$STORE_ERR")"; then
|
|
BAO_TOKEN="$token"
|
|
export BAO_TOKEN
|
|
STORE_UP=1
|
|
else
|
|
cat "$STORE_ERR" >&2
|
|
echo "could not log in to the swarm secret store; secrets keep the value of their files." >&2
|
|
fi
|
|
}
|
|
|
|
# <leaf> <earlier file> <mint command…>. The value on stdout; status 1 when
|
|
# neither the store nor the file can give one. `kv get` exits 2 both for a
|
|
# leaf that holds nothing ("No value found at <path>") and for a refused
|
|
# read, so only that message means absent. Any other failure of the first
|
|
# read, the `timeout` (124) included, neither mints nor writes: the file's
|
|
# value is used when it has one, and the call fails when it has none.
|
|
store_seeded() {
|
|
local leaf="$1" earlier="$2" value candidate rc=0
|
|
shift 2
|
|
if [ "$STORE_UP" = 1 ]; then
|
|
value="$(store_bao kv get -field=value "$leaf" 2>"$STORE_ERR")" || rc=$?
|
|
if [ "$rc" = 0 ] && [ -n "$value" ]; then
|
|
printf '%s' "$value"
|
|
return 0
|
|
fi
|
|
if [ "$rc" != 0 ] && ! grep -q '^No value found at ' "$STORE_ERR"; then
|
|
echo "could not read $leaf from the swarm secret store (exit status $rc):" >&2
|
|
cat "$STORE_ERR" >&2
|
|
if [ -s "$earlier" ]; then
|
|
echo "using the value of $earlier for $leaf; nothing is written to the store." >&2
|
|
printf '%s' "$(< "$earlier")"
|
|
return 0
|
|
fi
|
|
echo "no value for $leaf in the store or at $earlier." >&2
|
|
return 1
|
|
fi
|
|
if [ -s "$earlier" ]; then
|
|
candidate="$(< "$earlier")"
|
|
echo "storing the value of $earlier in $leaf." >&2
|
|
else
|
|
candidate="$("$@")"
|
|
echo "no earlier value; minting $leaf." >&2
|
|
fi
|
|
if ! printf '%s' "$candidate" | store_bao kv put -cas=0 "$leaf" value=- >/dev/null 2>"$STORE_ERR"; then
|
|
echo "could not create $leaf; reading it back in case another run created it." >&2
|
|
cat "$STORE_ERR" >&2
|
|
fi
|
|
if value="$(store_bao kv get -field=value "$leaf" 2>"$STORE_ERR")" && [ -n "$value" ]; then
|
|
printf '%s' "$value"
|
|
return 0
|
|
fi
|
|
cat "$STORE_ERR" >&2
|
|
echo "the store did not return $leaf." >&2
|
|
fi
|
|
if [ -s "$earlier" ]; then
|
|
echo "using the value of $earlier for $leaf." >&2
|
|
printf '%s' "$(< "$earlier")"
|
|
return 0
|
|
fi
|
|
echo "no value for $leaf in the store or at $earlier." >&2
|
|
return 1
|
|
}
|
|
''
|