110 lines
4.2 KiB
Nix
110 lines
4.2 KiB
Nix
# The root-side copy of the cache facts the host's nix daemon and hive-priv
|
|
# trust: the key a downloaded closure must be signed by and the netrc the pull
|
|
# token goes out in. The script runs as root on the hive host under the hive's
|
|
# own store identity and writes both into `dir`, which only root can read, and
|
|
# a nix.conf fragment at `confFile` that the host's nix.conf includes.
|
|
#
|
|
# What the daemon and hive-priv decide on is here or in the host's
|
|
# configuration, and nothing is read from a file hive-c0re (unprivileged)
|
|
# writes: the key and the token come from the store, the cache's address from
|
|
# `services.hyperhive.swarm.attic.{domain,cache}`. The fragment holds no secret
|
|
# (the key is public, the netrc stays in `dir`) and hive-c0re can read it: it
|
|
# takes the cache's address from there.
|
|
#
|
|
# A store that holds no facts yet, or cannot be reached, leaves what is in `dir`
|
|
# and `confFile` as they are. Nothing here removes a file.
|
|
#
|
|
# Pure function — NOT a NixOS module. Call it from a unit's `script`, with
|
|
# `bao`, `coreutils`, `gnugrep` and `systemd` on its `path` and the `BAO_*`
|
|
# client environment set:
|
|
#
|
|
# script = import ./lib/attic-root-facts.nix { inherit lib; } {
|
|
# hive = "alpha"; host = "attic.example.org"; dir = "/run/hyperhive-priv/attic";
|
|
# url = "https://attic.example.org/swarm"; confFile = "/run/hyperhive-nix/cache.conf";
|
|
# };
|
|
{ lib }:
|
|
{
|
|
# The hive's name in the store: facts are read from
|
|
# `secret/swarm/hives/<hive>/attic/`.
|
|
hive,
|
|
# The cache server's host name, which the netrc line names.
|
|
host,
|
|
# Where the key and the netrc go.
|
|
dir,
|
|
# The cache's address as the daemon lists it in `trusted-substituters`.
|
|
url,
|
|
# Where the nix.conf fragment goes; its directory is root's and readable.
|
|
confFile,
|
|
}:
|
|
''
|
|
set -euo pipefail
|
|
${import ./store-seeded-secret.nix { }}
|
|
${import ./atomic-write-secret.nix { }}
|
|
${import ./refresh-consumer.nix { }}
|
|
|
|
dir=${lib.escapeShellArg dir}
|
|
conf=${lib.escapeShellArg confFile}
|
|
install -d -m 0700 "$dir"
|
|
install -d -m 0755 "$(dirname -- "$conf")"
|
|
|
|
store_init
|
|
store_login
|
|
if [ "$STORE_UP" != 1 ]; then
|
|
echo "could not read the cache facts; $dir stays as it is." >&2
|
|
exit 1
|
|
fi
|
|
|
|
# <leaf> <variable>. Sets the variable to the leaf's value. A leaf the store
|
|
# does not hold sets `missing`; any other failure ends the run.
|
|
missing=0
|
|
fetch() {
|
|
local value
|
|
if value="$(store_bao kv get -field=value ${lib.escapeShellArg "secret/swarm/hives/${hive}/attic"}/"$1" 2>"$STORE_ERR")"; then
|
|
printf -v "$2" '%s' "$value"
|
|
elif grep -qi 'no value found' "$STORE_ERR"; then
|
|
missing=1
|
|
else
|
|
cat "$STORE_ERR" >&2
|
|
echo "could not read the cache fact $1; $dir stays as it is." >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
key=""
|
|
token=""
|
|
fetch public-key key
|
|
fetch pull-token token
|
|
if [ "$missing" = 1 ]; then
|
|
echo "the swarm has not given this hive its cache facts yet; $dir stays as it is."
|
|
exit 0
|
|
fi
|
|
|
|
# One token each: both land in a file nix and hive-priv parse by whitespace.
|
|
if [[ ! "$key" =~ ^[^[:space:]:]+:[^[:space:]]+$ ]] || [[ ! "$token" =~ ^[^[:space:]]+$ ]]; then
|
|
echo "the stored cache facts are not a <name>:<key> and a single token; $dir stays as it is." >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Written only when the value changed, so the files keep their mtime between
|
|
# runs. The owner is the running user, root, and the mode is 0600.
|
|
if secret_differs "$dir/public-key" "$key"; then
|
|
atomic_write_secret 0600 "" "$dir/public-key" "$key"
|
|
fi
|
|
netrc="machine ${host} password $token"
|
|
if secret_differs "$dir/netrc" "$netrc"; then
|
|
atomic_write_secret 0600 "" "$dir/netrc" "$netrc"
|
|
fi
|
|
|
|
# Last, so a daemon that reads the fragment finds the netrc in place. The
|
|
# address is the one hive-c0re may name as the substituter. The mtime moves
|
|
# only with the content. Lix re-reads nix.conf for every connection, CppNix
|
|
# only at start, so a daemon that started before this write is restarted.
|
|
printf -v fragment '%s\n%s\n%s' \
|
|
${lib.escapeShellArg "extra-trusted-substituters = ${url}"} \
|
|
"extra-trusted-public-keys = $key" \
|
|
"netrc-file = $dir/netrc"
|
|
if secret_differs "$conf" "$fragment"; then
|
|
atomic_write_secret 0644 "" "$conf" "$fragment"
|
|
fi
|
|
refresh_unit nix-daemon.service "$conf"
|
|
''
|