86 lines
2.9 KiB
Nix
86 lines
2.9 KiB
Nix
# Shared shell steps for a unit that keeps a secret it once generated on disk
|
|
# in the swarm secret store instead. The store's value wins; a store holding
|
|
# none is seeded from the old file, so the secret keeps its value; a new value
|
|
# is minted only when there is no file either.
|
|
#
|
|
# `store_seeded` prints the value and never rotates one: the store is written
|
|
# with `-cas=0`, so only a leaf that holds nothing takes a value, and a lost
|
|
# race reads the winner's back.
|
|
#
|
|
# Pure function — NOT a NixOS module. Call it from a module's `let`:
|
|
#
|
|
# storeSeededSecret = import ./lib/store-seeded-secret.nix { };
|
|
# script = ''
|
|
# ${storeSeededSecret}
|
|
# store_init
|
|
# store_login
|
|
# key="$(store_seeded secret/swarm/services/foo/key /var/lib/foo/key mint_key)" || exit 1
|
|
# '';
|
|
#
|
|
# Needs `bao` and `coreutils` on the caller's `path` and the `BAO_*` client
|
|
# environment set. Takes the EXIT trap, to remove its scratch file.
|
|
{ }:
|
|
''
|
|
# Bounded, so a store that drops packets cannot hold the caller past its
|
|
# start timeout; one that refuses answers at once.
|
|
store_bao() {
|
|
timeout 15 bao "$@"
|
|
}
|
|
|
|
store_init() {
|
|
STORE_ERR="$(mktemp)"
|
|
STORE_UP=0
|
|
trap 'rm -f "$STORE_ERR"' EXIT
|
|
}
|
|
|
|
# Sets STORE_UP. A store that cannot be logged in to leaves every secret to
|
|
# its file.
|
|
store_login() {
|
|
local token
|
|
if token="$(store_bao login -method=cert -token-only 2>"$STORE_ERR")"; then
|
|
BAO_TOKEN="$token"
|
|
export BAO_TOKEN
|
|
STORE_UP=1
|
|
else
|
|
cat "$STORE_ERR" >&2
|
|
echo "could not log in to the swarm secret store; secrets keep the value of their files." >&2
|
|
fi
|
|
}
|
|
|
|
# <leaf> <earlier file> <mint command…>. The value on stdout; status 1 when
|
|
# neither the store nor the file can give one.
|
|
store_seeded() {
|
|
local leaf="$1" earlier="$2" value candidate
|
|
shift 2
|
|
if [ "$STORE_UP" = 1 ]; then
|
|
if value="$(store_bao kv get -field=value "$leaf" 2>"$STORE_ERR")" && [ -n "$value" ]; then
|
|
printf '%s' "$value"
|
|
return 0
|
|
fi
|
|
if [ -s "$earlier" ]; then
|
|
candidate="$(< "$earlier")"
|
|
echo "storing the value of $earlier in $leaf." >&2
|
|
else
|
|
candidate="$("$@")"
|
|
echo "no earlier value; minting $leaf." >&2
|
|
fi
|
|
if ! printf '%s' "$candidate" | store_bao kv put -cas=0 "$leaf" value=- >/dev/null 2>"$STORE_ERR"; then
|
|
echo "could not create $leaf; reading it back in case another run created it." >&2
|
|
cat "$STORE_ERR" >&2
|
|
fi
|
|
if value="$(store_bao kv get -field=value "$leaf" 2>"$STORE_ERR")" && [ -n "$value" ]; then
|
|
printf '%s' "$value"
|
|
return 0
|
|
fi
|
|
cat "$STORE_ERR" >&2
|
|
echo "the store did not return $leaf." >&2
|
|
fi
|
|
if [ -s "$earlier" ]; then
|
|
echo "using the value of $earlier for $leaf." >&2
|
|
printf '%s' "$(< "$earlier")"
|
|
return 0
|
|
fi
|
|
echo "no value for $leaf in the store or at $earlier." >&2
|
|
return 1
|
|
}
|
|
''
|