From 5e2e95e9c703aa7828492158f8972b552047fad0 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 28 Aug 2023 10:25:16 +0200 Subject: [PATCH 1/2] clan-cli: add zerotier subcommand --- pkgs/clan-cli/clan_cli/__init__.py | 5 ++- pkgs/clan-cli/clan_cli/zerotier/__init__.py | 47 ++++++++++++--------- pkgs/clan-cli/tests/test_zerotier.py | 2 +- 3 files changed, 32 insertions(+), 22 deletions(-) diff --git a/pkgs/clan-cli/clan_cli/__init__.py b/pkgs/clan-cli/clan_cli/__init__.py index 45fad676..ff67eeaf 100644 --- a/pkgs/clan-cli/clan_cli/__init__.py +++ b/pkgs/clan-cli/clan_cli/__init__.py @@ -4,7 +4,7 @@ import sys from types import ModuleType from typing import Optional -from . import admin, config, machines, secrets, webui +from . import admin, config, machines, secrets, webui, zerotier from .errors import ClanError from .ssh import cli as ssh_cli @@ -41,6 +41,9 @@ def create_parser(prog: Optional[str] = None) -> argparse.ArgumentParser: parser_webui = subparsers.add_parser("webui", help="start webui") webui.register_parser(parser_webui) + parser_zerotier = subparsers.add_parser("zerotier", help="create zerotier network") + zerotier.register_parser(parser_zerotier) + if argcomplete: argcomplete.autocomplete(parser) diff --git a/pkgs/clan-cli/clan_cli/zerotier/__init__.py b/pkgs/clan-cli/clan_cli/zerotier/__init__.py index 6269d7e2..9dddf07a 100644 --- a/pkgs/clan-cli/clan_cli/zerotier/__init__.py +++ b/pkgs/clan-cli/clan_cli/zerotier/__init__.py @@ -1,3 +1,4 @@ +import argparse import json import socket import subprocess @@ -42,7 +43,8 @@ class ZerotierController: def __init__(self, port: int, home: Path) -> None: self.port = port self.home = home - self.secret = (home / "authtoken.secret").read_text() + self.authtoken = (home / "authtoken.secret").read_text() + self.secret = (home / "identity.secret").read_text() def _http_request( self, @@ -56,7 +58,7 @@ class ZerotierController: if data is not None: body = json.dumps(data).encode("ascii") headers["Content-Type"] = "application/json" - headers["X-ZT1-AUTH"] = self.secret + headers["X-ZT1-AUTH"] = self.authtoken url = f"http://127.0.0.1:{self.port}{path}" req = urllib.request.Request(url, headers=headers, method=method, data=body) resp = urllib.request.urlopen(req) @@ -75,11 +77,6 @@ class ZerotierController: def get_network(self, id: str) -> dict[str, Any]: return self._http_request(f"/controller/network/{id}") - def update_network(self, id: str, new_config: dict[str, Any]) -> dict[str, Any]: - return self._http_request( - f"/controller/network/{id}", method="POST", data=new_config - ) - @contextmanager def zerotier_controller() -> Iterator[ZerotierController]: @@ -117,6 +114,7 @@ def zerotier_controller() -> Iterator[ZerotierController]: "/proc", "--dev", "/dev", + "--unshare-user", "--uid", "0", "--gid", @@ -151,19 +149,28 @@ def zerotier_controller() -> Iterator[ZerotierController]: p.wait() -class ZerotierNetwork: - def __init__(self, network_id: str) -> None: - self.network_id = network_id - - # TODO: allow merging more network configuration here -def create_network(private: bool = False) -> ZerotierNetwork: +def create_network() -> dict: with zerotier_controller() as controller: network = controller.create_network() - network_id = network["nwid"] - network = controller.get_network(network_id) - network["private"] = private - network["v6AssignMode"]["rfc4193"] = True - controller.update_network(network_id, network) - # TODO: persist home into sops? - return ZerotierNetwork(network_id) + return { + "secret": controller.secret, + "networkid": network["nwid"], + } + + +def main(args: argparse.Namespace) -> None: + zerotier = create_network() + outpath = Path(args.outpath) + outpath.mkdir(parents=True, exist_ok=True) + with open(outpath / "network.id", "w+") as nwid_file: + nwid_file.write(zerotier["networkid"]) + with open(outpath / "identity.secret", "w+") as secret_file: + secret_file.write(zerotier["secret"]) + + +def register_parser(parser: argparse.ArgumentParser) -> None: + parser.add_argument( + "--outpath", help="directory to put the secret file to", required=True + ) + parser.set_defaults(func=main) diff --git a/pkgs/clan-cli/tests/test_zerotier.py b/pkgs/clan-cli/tests/test_zerotier.py index dfc5eae4..cf1b2a33 100644 --- a/pkgs/clan-cli/tests/test_zerotier.py +++ b/pkgs/clan-cli/tests/test_zerotier.py @@ -3,4 +3,4 @@ from clan_cli.zerotier import create_network def test_create_network() -> None: network = create_network() - assert network.network_id + assert network["networkid"] From 9fca1e7f43d66a702828b80af3eabb7faf668c15 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 28 Aug 2023 11:09:05 +0200 Subject: [PATCH 2/2] move clanCore into nixosModules, add secrets generate command --- clanModules/zerotier.nix | 29 ------ flake.nix | 4 +- nixosModules/clanCore/flake-module.nix | 32 +++++++ nixosModules/clanCore/secrets/default.nix | 66 ++++++++++++++ nixosModules/clanCore/secrets/sops.nix | 63 +++++++++++++ nixosModules/clanCore/zerotier.nix | 100 +++++++++++++++++++++ nixosModules/flake-module.nix | 6 +- nixosModules/secrets/default.nix | 39 -------- pkgs/clan-cli/clan_cli/secrets/__init__.py | 6 ++ pkgs/clan-cli/clan_cli/secrets/generate.py | 51 +++++++++++ 10 files changed, 320 insertions(+), 76 deletions(-) delete mode 100644 clanModules/zerotier.nix create mode 100644 nixosModules/clanCore/flake-module.nix create mode 100644 nixosModules/clanCore/secrets/default.nix create mode 100644 nixosModules/clanCore/secrets/sops.nix create mode 100644 nixosModules/clanCore/zerotier.nix delete mode 100644 nixosModules/secrets/default.nix create mode 100644 pkgs/clan-cli/clan_cli/secrets/generate.py diff --git a/clanModules/zerotier.nix b/clanModules/zerotier.nix deleted file mode 100644 index 180b64d7..00000000 --- a/clanModules/zerotier.nix +++ /dev/null @@ -1,29 +0,0 @@ -{ config, lib, ... }: -{ - options.clan.networking.zerotier = { - networkId = lib.mkOption { - type = lib.types.str; - description = '' - zerotier networking id - ''; - }; - }; - config = { - systemd.network.networks.zerotier = { - matchConfig.Name = "zt*"; - networkConfig = { - LLMNR = true; - LLDP = true; - MulticastDNS = true; - KeepConfiguration = "static"; - }; - }; - networking.firewall.allowedUDPPorts = [ 9993 ]; - networking.firewall.interfaces."zt+".allowedTCPPorts = [ 5353 ]; - networking.firewall.interfaces."zt+".allowedUDPPorts = [ 5353 ]; - services.zerotierone = { - enable = true; - joinNetworks = [ config.clan.networking.zerotier.networkId ]; - }; - }; -} diff --git a/flake.nix b/flake.nix index 613abeef..cf9d45ab 100644 --- a/flake.nix +++ b/flake.nix @@ -36,9 +36,7 @@ ./lib/flake-module.nix ./nixosModules/flake-module.nix - ({ self, lib, ... }: { - flake.clanModules = lib.mapAttrs (_: nix: { imports = [ nix ]; }) (self.lib.findNixFiles ./clanModules); - }) + ./nixosModules/clanCore/flake-module.nix ]; }); } diff --git a/nixosModules/clanCore/flake-module.nix b/nixosModules/clanCore/flake-module.nix new file mode 100644 index 00000000..da8fa0e6 --- /dev/null +++ b/nixosModules/clanCore/flake-module.nix @@ -0,0 +1,32 @@ +{ self, inputs, lib, ... }: { + flake.nixosModules.clanCore = { pkgs, ... }: { + options.clanCore = { + clanDir = lib.mkOption { + type = lib.types.str; + description = '' + the location of the flake repo, used to calculate the location of facts and secrets + ''; + }; + machineName = lib.mkOption { + type = lib.types.str; + description = '' + the name of the machine + ''; + }; + clanPkgs = lib.mkOption { + default = self.packages.${pkgs.system}; + }; + }; + options.system.clan = lib.mkOption { + type = lib.types.lazyAttrsOf lib.types.raw; + description = '' + utility outputs for clan management of this machine + ''; + }; + imports = [ + ./secrets + ./zerotier.nix + inputs.sops-nix.nixosModules.sops + ]; + }; +} diff --git a/nixosModules/clanCore/secrets/default.nix b/nixosModules/clanCore/secrets/default.nix new file mode 100644 index 00000000..f1128a32 --- /dev/null +++ b/nixosModules/clanCore/secrets/default.nix @@ -0,0 +1,66 @@ +{ config, lib, ... }: +{ + options.clanCore.secrets = lib.mkOption { + type = lib.types.attrsOf + (lib.types.submodule (secret: { + options = { + name = lib.mkOption { + type = lib.types.str; + default = secret.config._module.args.name; + description = '' + namespace of the secret + ''; + }; + generator = lib.mkOption { + type = lib.types.nullOr lib.types.str; + description = '' + script to generate the secret. + can be set to null. then the user has to provide the secret via the clan cli + ''; + }; + secrets = lib.mkOption { + type = lib.types.attrsOf (lib.types.submodule (secret: { + options = { + name = lib.mkOption { + type = lib.types.str; + description = '' + name of the secret + ''; + default = secret.config._module.args.name; + }; + }; + })); + description = '' + path where the secret is located in the filesystem + ''; + }; + facts = lib.mkOption { + type = lib.types.attrsOf (lib.types.submodule (fact: { + options = { + name = lib.mkOption { + type = lib.types.str; + description = '' + name of the fact + ''; + default = fact.config._module.args.name; + }; + path = lib.mkOption { + type = lib.types.str; + description = '' + path to a fact which is generated by the generator + ''; + default = "${config.clanCore.clanDir}/facts/${config.clanCore.machineName}/${fact.config._module.args.name}"; + }; + value = lib.mkOption { + default = builtins.readFile fact.config.path; + }; + }; + })); + }; + }; + })); + }; + imports = [ + ./sops.nix # for now we have only one implementation, thats why we import it here and not in clanModules + ]; +} diff --git a/nixosModules/clanCore/secrets/sops.nix b/nixosModules/clanCore/secrets/sops.nix new file mode 100644 index 00000000..7df0b31d --- /dev/null +++ b/nixosModules/clanCore/secrets/sops.nix @@ -0,0 +1,63 @@ +{ config, lib, pkgs, ... }: +{ + config = { + system.clan.generateSecrets = pkgs.writeScript "generate_secrets" '' + #!/bin/sh + set -efu + set -x # remove for prod + + PATH=$PATH:${lib.makeBinPath [ + config.clanCore.clanPkgs.clan-cli + ]} + + # initialize secret store + if ! clan secrets machines list | grep -q ${config.clanCore.machineName}; then ( + INITTMP=$(mktemp -d) + trap 'rm -rf "$INITTMP"' EXIT + ${pkgs.age}/bin/age-keygen -o "$INITTMP/secret" 2> "$INITTMP/public" + PUBKEY=$(cat "$INITTMP/public" | sed 's/.*: //') + clan secrets machines add ${config.clanCore.machineName} "$PUBKEY" + tail -1 "$INITTMP/secret" | clan secrets set --machine ${config.clanCore.machineName} ${config.clanCore.machineName}-age.key + ) fi + + ${lib.foldlAttrs (acc: n: v: '' + ${acc} + # ${n} + # if any of the secrets are missing, we regenerate all connected facts/secrets + (if ! ${lib.concatMapStringsSep " && " (x: "clan secrets get ${config.clanCore.machineName}-${x.name} >/dev/null") (lib.attrValues v.secrets)}; then + + facts=$(mktemp -d) + trap "rm -rf $facts" EXIT + secrets=$(mktemp -d) + trap "rm -rf $secrets" EXIT + ${v.generator} + + ${lib.concatMapStrings (fact: '' + mkdir -p "$(dirname ${fact.path})" + cp "$facts"/${fact.name} ${fact.path} + '') (lib.attrValues v.facts)} + + ${lib.concatMapStrings (secret: '' + cat "$secrets"/${secret.name} | clan secrets set --machine ${config.clanCore.machineName} ${config.clanCore.machineName}-${secret.name} + '') (lib.attrValues v.secrets)} + fi) + '') "" config.clanCore.secrets} + ''; + sops.secrets = + let + encryptedForThisMachine = name: type: + let + symlink = config.clanCore.clanDir + "/sops/secrets/${name}/machines/${config.clanCore.machineName}"; + in + # WTF, nix bug, my symlink is in the nixos module detected as a directory also it works in the repl + type == "directory" && (builtins.readFileType symlink == "directory" || builtins.readFileType symlink == "symlink"); + secrets = lib.filterAttrs encryptedForThisMachine (builtins.readDir (config.clanCore.clanDir + "/sops/secrets")); + in + builtins.mapAttrs + (name: _: { + sopsFile = config.clanCore.clanDir + "/sops/secrets/${name}/secret"; + format = "binary"; + }) + secrets; + }; +} diff --git a/nixosModules/clanCore/zerotier.nix b/nixosModules/clanCore/zerotier.nix new file mode 100644 index 00000000..452294d9 --- /dev/null +++ b/nixosModules/clanCore/zerotier.nix @@ -0,0 +1,100 @@ +{ config, lib, pkgs, ... }: +let + cfg = config.clan.networking.zerotier; +in +{ + options.clan.networking.zerotier = { + networkId = lib.mkOption { + type = lib.types.str; + description = '' + zerotier networking id + ''; + }; + controller = { + enable = lib.mkEnableOption "turn this machine into the networkcontroller"; + public = lib.mkOption { + type = lib.types.bool; + default = false; + description = '' + everyone can join a public network without having the administrator to accept + ''; + }; + }; + }; + config = { + systemd.network.networks.zerotier = { + matchConfig.Name = "zt*"; + networkConfig = { + LLMNR = true; + LLDP = true; + MulticastDNS = true; + KeepConfiguration = "static"; + }; + }; + networking.firewall.allowedUDPPorts = [ 9993 ]; + networking.firewall.interfaces."zt+".allowedTCPPorts = [ 5353 ]; + networking.firewall.interfaces."zt+".allowedUDPPorts = [ 5353 ]; + services.zerotierone = { + enable = true; + joinNetworks = [ cfg.networkId ]; + }; + } // lib.mkIf cfg.controller.enable { + # only the controller needs to have the key in the repo, the other clients can be dynamic + # we generate the zerotier code manually for the controller, since it's part of the bootstrap command + clanCore.secrets.zerotier = { + facts."network.id" = { }; + secrets."identity.secret" = { }; + generator = '' + TMPDIR=$(mktemp -d) + trap 'rm -rf "$TMPDIR"' EXIT + ${config.clanCore.clanPkgs.clan-cli}/bin/clan zerotier --outpath "$TMPDIR" + cp "$TMPDIR"/network.id "$facts"/network.id + cp "$TMPDIR"/identity.secret "$secrets"/identity.secret + ''; + }; + + systemd.tmpfiles.rules = [ + "L+ /var/lib/zerotierone/controller.d/network/${cfg.networkId}.json - - - - ${pkgs.writeText "net.json" (builtins.toJSON { + authTokens = [ + null + ]; + authorizationEndpoint = ""; + capabilities = []; + clientId = ""; + dns = []; + enableBroadcast = true; + id = cfg.networkId; + ipAssignmentPools = []; + mtu = 2800; + multicastLimit = 32; + name = ""; + uwid = cfg.networkId; + objtype = "network"; + private = true; + remoteTraceLevel = 0; + remoteTraceTarget = null; + revision = 1; + routes = []; + rules = [ + { + not = false; + or = false; + type = "ACTION_ACCEPT"; + } + ]; + rulesSource = ""; + ssoEnabled = false; + tags = []; + v4AssignMode = { + zt = false; + }; + v6AssignMode = { + "6plane" = false; + rfc4193 = false; + zt = false; + }; + })}" + ]; + }; +} + diff --git a/nixosModules/flake-module.nix b/nixosModules/flake-module.nix index 15ab5758..6443ac97 100644 --- a/nixosModules/flake-module.nix +++ b/nixosModules/flake-module.nix @@ -1,10 +1,6 @@ -{ inputs, ... }: { +{ ... }: { flake.nixosModules = { hidden-ssh-announce.imports = [ ./hidden-ssh-announce.nix ]; installer.imports = [ ./installer ]; - secrets.imports = [ - inputs.sops-nix.nixosModules.sops - ./secrets - ]; }; } diff --git a/nixosModules/secrets/default.nix b/nixosModules/secrets/default.nix deleted file mode 100644 index eb2d6ae1..00000000 --- a/nixosModules/secrets/default.nix +++ /dev/null @@ -1,39 +0,0 @@ -{ lib, config, ... }: -let - encryptedForThisMachine = name: type: - let - symlink = config.clan.sops.sopsDirectory + "/secrets/${name}/machines/${config.clan.sops.machineName}"; - in - # WTF, nix bug, my symlink is in the nixos module detected as a directory also it works in the repl - type == "directory" && (builtins.readFileType symlink == "directory" || builtins.readFileType symlink == "symlink"); - secrets = lib.filterAttrs encryptedForThisMachine (builtins.readDir (config.clan.sops.sopsDirectory + "/secrets")); -in -{ - imports = [ - ]; - options = { - clan.sops = { - machineName = lib.mkOption { - type = lib.types.str; - default = config.networking.hostName; - description = '' - Machine used to lookup secrets in the sops directory. - ''; - }; - sopsDirectory = lib.mkOption { - type = lib.types.path; - description = '' - Sops toplevel directory that stores users, machines, groups and secrets. - ''; - }; - }; - }; - config = { - sops.secrets = builtins.mapAttrs - (name: _: { - sopsFile = config.clan.sops.sopsDirectory + "/secrets/${name}/secret"; - format = "binary"; - }) - secrets; - }; -} diff --git a/pkgs/clan-cli/clan_cli/secrets/__init__.py b/pkgs/clan-cli/clan_cli/secrets/__init__.py index 8bb0efeb..9383971b 100644 --- a/pkgs/clan-cli/clan_cli/secrets/__init__.py +++ b/pkgs/clan-cli/clan_cli/secrets/__init__.py @@ -1,6 +1,7 @@ # !/usr/bin/env python3 import argparse +from .generate import register_generate_parser from .groups import register_groups_parser from .import_sops import register_import_sops_parser from .machines import register_machines_parser @@ -29,4 +30,9 @@ def register_parser(parser: argparse.ArgumentParser) -> None: import_sops_parser = subparser.add_parser("import-sops", help="import a sops file") register_import_sops_parser(import_sops_parser) + parser_generate = subparser.add_parser( + "generate", help="generate secrets for machines if they don't exist yet" + ) + register_generate_parser(parser_generate) + register_secrets_parser(subparser) diff --git a/pkgs/clan-cli/clan_cli/secrets/generate.py b/pkgs/clan-cli/clan_cli/secrets/generate.py new file mode 100644 index 00000000..0b01a8c8 --- /dev/null +++ b/pkgs/clan-cli/clan_cli/secrets/generate.py @@ -0,0 +1,51 @@ +import argparse +import subprocess +import sys + +from clan_cli.errors import ClanError + + +def get_secret_script(machine: str) -> None: + proc = subprocess.run( + [ + "nix", + "build", + "--impure", + "--print-out-paths", + "--expr", + "let f = builtins.getFlake (toString ./.); in " + f"(f.nixosConfigurations.{machine}.extendModules " + "{ modules = [{ clanCore.clanDir = toString ./.; }]; })" + ".config.system.clan.generateSecrets", + ], + check=True, + capture_output=True, + text=True, + ) + if proc.returncode != 0: + print(proc.stderr, file=sys.stderr) + raise ClanError(f"failed to generate secrets:\n{proc.stderr}") + + secret_generator_script = proc.stdout.strip() + print(secret_generator_script) + secret_generator = subprocess.run( + [secret_generator_script], + check=True, + ) + + if secret_generator.returncode != 0: + raise ClanError("failed to generate secrets") + else: + print("successfully generated secrets") + + +def generate_command(args: argparse.Namespace) -> None: + get_secret_script(args.machine) + + +def register_generate_parser(parser: argparse.ArgumentParser) -> None: + parser.add_argument( + "machine", + help="The machine to generate secrets for", + ) + parser.set_defaults(func=generate_command)