swarm-nats: take the callout issuer and user keys from the store
`swarm-bao-nats-callout-xkey` runs `ensure-callout-keys`, importing
/var/lib/swarm-nats-callout/{issuer,callout-user}.seed when present so the
keys keep their public halves, then fetches all three public halves from
the store. The verb removes each seed file once a read of the store returns
a seed; when the store's seed differs, it is kept and a warning names the
file. No tmpfiles rule touches those files, since one could run before the
import with the store sealed and leave the next run to mint a new key.
The server renders the issuer and user public halves from the fetched files,
checked for shape as the xkey's is, and does not start without them. The
responder reads both seeds from the store, so the copies into the container
and their LoadCredential entries are gone, and a tmpfiles rule removes the
copies a container still holds. `swarm-nats-callout-keys` is removed.
On the store's host the fetch unit is also ordered after
`swarm-bao-secret-publisher-policy`, so the publisher's denial of the seed
paths is written before the unit creates or keeps a seed there.
`deploy.nats.autoGenerateCallout`, `calloutUserPublicKey`,
`calloutIssuerPublicKey`, `calloutUserSeedFile` and `calloutIssuerSeedFile`
are removed with `mkRemovedOptionModule`, under `swarm.nats` too, each
message saying the keys live in the store.
This commit is contained in:
atlas
mara
parent
66ac034949
commit
c10cc0e018
12 changed files with 427 additions and 556 deletions
|
|
@ -1,7 +1,7 @@
|
|||
# `checks.script-test-nats-render-config` — runs the queue server's
|
||||
# `ExecStartPre`, ../host-modules/swarm-nats.nix's `renderConfig`, which writes
|
||||
# the callout xkey into the config `nats-server` reads. The cases are in
|
||||
# ./nats-render-config.sh.
|
||||
# the callout's three public keys into the config `nats-server` reads. The
|
||||
# cases are in ./nats-render-config.sh.
|
||||
#
|
||||
# What runs is the rendered script. The one edit is its runtime directory,
|
||||
# moved under the build directory because the sandbox has no writable
|
||||
|
|
@ -27,11 +27,6 @@ let
|
|||
|
||||
queue = hive {
|
||||
deploy.nats.enable = true;
|
||||
deploy.nats.autoGenerateCallout = false;
|
||||
deploy.nats.calloutUserPublicKey = "UTESTUSERPUBKEYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
|
||||
deploy.nats.calloutIssuerPublicKey = "ATESTISSUERPUBKEYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
|
||||
deploy.nats.calloutUserSeedFile = "/run/secrets/nats-user.seed";
|
||||
deploy.nats.calloutIssuerSeedFile = "/run/secrets/nats-issuer.seed";
|
||||
deploy.nats.authPackage = pkgs.emptyDirectory;
|
||||
deploy.nats.authBaoClientCertFile = "/etc/pki/nats-auth.pem";
|
||||
deploy.nats.authBaoClientKeyFile = "/etc/pki/nats-auth-key.pem";
|
||||
|
|
|
|||
|
|
@ -11,8 +11,11 @@ fail() {
|
|||
failures=$((failures + 1))
|
||||
}
|
||||
|
||||
# The shape the script checks for, X and 55 base32 characters.
|
||||
# The shapes the script checks for: the key type's letter and 55 base32
|
||||
# characters.
|
||||
key=XAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
issuer=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
user=UAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
||||
|
||||
setup() {
|
||||
case=$1
|
||||
|
|
@ -27,31 +30,60 @@ setup() {
|
|||
if ! grep -qxF "d=$rt" "$dir/render"; then fail "the rewrite did not reach the script's runtime directory"; fi
|
||||
}
|
||||
|
||||
# All three public keys, as the fetch unit leaves them.
|
||||
fetched() {
|
||||
printf '%s\n' "$key" >"$rt/callout-xkey.pub"
|
||||
printf '%s\n' "$issuer" >"$rt/issuer.pub"
|
||||
printf '%s\n' "$user" >"$rt/callout-user.pub"
|
||||
}
|
||||
|
||||
go() {
|
||||
count=$((count + 1))
|
||||
"$dir/render" >"$dir/out" 2>"$dir/err"
|
||||
rc=$?
|
||||
}
|
||||
|
||||
setup "a fetched key is rendered into auth_callout.xkey, and the server's config includes it"
|
||||
printf '%s' "$key" >"$rt/callout-xkey.pub"
|
||||
refused() {
|
||||
go
|
||||
if [ "$rc" -eq 0 ]; then fail "exited 0"; fi
|
||||
if [ -e "$rt/callout.conf" ] || [ -e "$rt/nats.conf" ]; then fail "a config was written"; fi
|
||||
}
|
||||
|
||||
setup "the fetched keys are rendered into auth_callout and the callout account, and the server's config includes them"
|
||||
fetched
|
||||
go
|
||||
if [ "$rc" -ne 0 ]; then fail "exit $rc: $(cat "$dir/err")"; fi
|
||||
if ! jq -e --arg k "$key" '.authorization.auth_callout.xkey == $k' "$rt/callout.conf" >/dev/null; then
|
||||
fail "callout.conf does not carry the key as auth_callout.xkey"
|
||||
fail "callout.conf does not carry the xkey as auth_callout.xkey"
|
||||
fi
|
||||
if ! jq -e --arg k "$issuer" '.authorization.auth_callout.issuer == $k' "$rt/callout.conf" >/dev/null; then
|
||||
fail "callout.conf does not carry the issuer key as auth_callout.issuer"
|
||||
fi
|
||||
if ! jq -e --arg k "$user" '.authorization.auth_callout.auth_users == [$k] and .accounts.AUTH.users == [{nkey: $k}]' "$rt/callout.conf" >/dev/null; then
|
||||
fail "callout.conf does not carry the user key as the one exempt user and the callout account's one member"
|
||||
fi
|
||||
if ! grep -qxF 'include "callout.conf"' "$rt/nats.conf"; then fail "nats.conf does not include callout.conf"; fi
|
||||
|
||||
setup "with no key file the start fails and writes no config"
|
||||
go
|
||||
if [ "$rc" -eq 0 ]; then fail "exited 0"; fi
|
||||
if [ -e "$rt/callout.conf" ] || [ -e "$rt/nats.conf" ]; then fail "a config was written"; fi
|
||||
refused
|
||||
|
||||
setup "a file that is not a public xkey fails the start and writes no config"
|
||||
printf '%s' "not-a-key" >"$rt/callout-xkey.pub"
|
||||
go
|
||||
if [ "$rc" -eq 0 ]; then fail "exited 0"; fi
|
||||
if [ -e "$rt/callout.conf" ] || [ -e "$rt/nats.conf" ]; then fail "a config was written"; fi
|
||||
for file in callout-xkey.pub issuer.pub callout-user.pub; do
|
||||
setup "with no $file the start fails and writes no config"
|
||||
fetched
|
||||
rm "$rt/$file"
|
||||
refused
|
||||
|
||||
setup "a $file that is not its kind of public key fails the start and writes no config"
|
||||
fetched
|
||||
printf '%s' "not-a-key" >"$rt/$file"
|
||||
refused
|
||||
done
|
||||
|
||||
# Each key in the other's file: right shape, wrong letter.
|
||||
setup "an issuer key where the user key belongs fails the start and writes no config"
|
||||
fetched
|
||||
printf '%s' "$issuer" >"$rt/callout-user.pub"
|
||||
refused
|
||||
|
||||
if [ "$failures" -ne 0 ]; then
|
||||
echo "script-test-nats-render-config: $failures of $count cases broke" >&2
|
||||
|
|
|
|||
Loading…
Reference in a new issue