move clanCore into nixosModules, add secrets generate command

clanModules/zerotier.nix

@@ -1,29 +0,0 @@
-{ config, lib, ... }:
-{
-  options.clan.networking.zerotier = {
-    networkId = lib.mkOption {
-      type = lib.types.str;
-      description = ''
-        zerotier networking id
-      '';
-    };
-  };
-  config = {
-    systemd.network.networks.zerotier = {
-      matchConfig.Name = "zt*";
-      networkConfig = {
-        LLMNR = true;
-        LLDP = true;
-        MulticastDNS = true;
-        KeepConfiguration = "static";
-      };
-    };
-    networking.firewall.allowedUDPPorts = [ 9993 ];
-    networking.firewall.interfaces."zt+".allowedTCPPorts = [ 5353 ];
-    networking.firewall.interfaces."zt+".allowedUDPPorts = [ 5353 ];
-    services.zerotierone = {
-      enable = true;
-      joinNetworks = [ config.clan.networking.zerotier.networkId ];
-    };
-  };
-}

flake.nix

@@ -36,9 +36,7 @@
 
         ./lib/flake-module.nix
         ./nixosModules/flake-module.nix
-        ({ self, lib, ... }: {
-          flake.clanModules = lib.mapAttrs (_: nix: { imports = [ nix ]; }) (self.lib.findNixFiles ./clanModules);
-        })
+        ./nixosModules/clanCore/flake-module.nix
       ];
     });
 }

nixosModules/clanCore/flake-module.nix

@@ -0,0 +1,31 @@
+{ self, lib, ... }: {
+  flake.nixosModules.clanCore = { pkgs, ... }: {
+    options.clanCore = {
+      clanDir = lib.mkOption {
+        type = lib.types.str;
+        description = ''
+          the location of the flake repo, used to calculate the location of facts and secrets
+        '';
+      };
+      machineName = lib.mkOption {
+        type = lib.types.str;
+        description = ''
+          the name of the machine
+        '';
+      };
+      clanPkgs = lib.mkOption {
+        default = self.packages.${pkgs.system};
+      };
+    };
+    options.system.clan = lib.mkOption {
+      type = lib.types.lazyAttrsOf lib.types.raw;
+      description = ''
+        utility outputs for clan management of this machine
+      '';
+    };
+    imports = [
+      ./secrets
+      ./zerotier.nix
+    ];
+  };
+}

nixosModules/clanCore/secrets/clan_cli.nix

@@ -0,0 +1,44 @@
+{ config, lib, pkgs, ... }:
+{
+  config = lib.mkIf (config.clanCore.secrets.method == "clan_cli") {
+    system.clan.generateSecrets = pkgs.writeScript "generate_secrets" ''
+      #!/bin/sh
+      set -efux # remove x for prod
+
+      #initialize secret store
+      if ! [ -e ${config.clanCore.clanDir}/sops/machines/${config.clanCore.machineName}/key.json ]; then (
+        INITTMP=$(mktemp -d)
+        trap 'rm -rf "$INITTMP"' EXIT
+        ${pkgs.age}/bin/age-keygen -o "$INITTMP/secret" 2> "$INITTMP/public"
+        PUBKEY=$(cat "$INITTMP/public" | sed 's/.*: //')
+        ${config.clanCore.clanPkgs.clan-cli}/bin/clan secrets machines add ${config.clanCore.machineName} "$PUBKEY"
+        tail -1 "$INITTMP/secret" | ${config.clanCore.clanPkgs.clan-cli}/bin/clan secrets set --machine ${config.clanCore.machineName} age.key
+      ) fi
+
+      ${lib.foldlAttrs (acc: n: v: ''
+        ${acc}
+        # ${n}
+        # if any of the facts or secrets are missing, we regenerate all connected facts/secrets
+        if ! [ ${lib.concatMapStringsSep " -a " (x: "-e ${x.path}") ((lib.attrValues v.secrets) ++ (lib.attrValues v.facts))} ]; then
+
+          facts=$(mktemp -d)
+          trap "rm -rf $facts" EXIT
+          secrets=$(mktemp -d)
+          trap "rm -rf $secrets" EXIT
+          ${v.generator}
+
+          ${lib.foldlAttrs (acc: factfile: fact: ''
+            ${acc}
+            mkdir -p "$(dirname ${fact.path})"
+            cp "$facts"/${factfile} ${fact.path}
+          '') "" v.facts}
+
+          ${lib.foldlAttrs (acc: secretfile: _secret: ''
+            ${acc}
+            cat "$secrets"/${secretfile} | ${config.clanCore.clanPkgs.clan-cli}/bin/clan secrets set --machine ${config.clanCore.machineName} ${secretfile}
+          '') "" v.secrets}
+        fi
+      '') "" config.clanCore.secrets.namespaces}
+    '';
+  };
+}

nixosModules/clanCore/secrets/default.nix

@@ -0,0 +1,74 @@
+{ config, lib, ... }:
+{
+  options.clanCore.secrets = {
+    method = lib.mkOption {
+      type = lib.types.str; # maybe enum? but how can other people implement secret modules outside
+      default = "clan_cli";
+      description = ''
+        the secret provider which is used to encrypt/decrypt secrets
+      '';
+    };
+    namespaces = lib.mkOption {
+      type = lib.types.attrsOf
+        (lib.types.submodule (secret: {
+          options = {
+            name = lib.mkOption {
+              type = lib.types.str;
+              default = secret.config._module.args.name;
+              description = ''
+                namespace of the secret
+              '';
+            };
+            generator = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              description = ''
+                script to generate the secret.
+                can be set to null. then the user has to provide the secret via the clan cli
+              '';
+            };
+            secrets = lib.mkOption {
+              type = lib.types.attrsOf (lib.types.submodule (secret: {
+                options = {
+                  path = lib.mkOption {
+                    type = lib.types.str;
+                    description = ''
+                      path to the secret in the local clanRepo
+                    '';
+                    default = "${config.clanCore.clanDir}/secrets/${config.clanCore.machineName}/${secret.config._module.args.name}";
+                  };
+                  remotePath = lib.mkOption {
+                    type = lib.types.str;
+                    description = ''
+                      destination where the secret should be installed on the target machine
+                    '';
+                  };
+                };
+              }));
+              description = ''
+                path where the secret is located in the filesystem
+              '';
+            };
+            facts = lib.mkOption {
+              type = lib.types.attrsOf (lib.types.submodule (fact: {
+                options = {
+                  path = lib.mkOption {
+                    type = lib.types.str;
+                    description = ''
+                      path to a fact which is generated by the generator
+                    '';
+                    default = "${config.clanCore.clanDir}/facts/${config.clanCore.machineName}/${fact.config._module.args.name}";
+                  };
+                  value = lib.mkOption {
+                    default = builtins.readFile fact.config.path;
+                  };
+                };
+              }));
+            };
+          };
+        }));
+    };
+  };
+  imports = [
+    ./clan_cli.nix # for now we have only one implementation, thats why we import it here and not in clanModules
+  ];
+}

nixosModules/clanCore/zerotier.nix

@@ -0,0 +1,100 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.clan.networking.zerotier;
+in
+{
+  options.clan.networking.zerotier = {
+    networkId = lib.mkOption {
+      type = lib.types.str;
+      description = ''
+        zerotier networking id
+      '';
+    };
+    controller = {
+      enable = lib.mkEnableOption "turn this machine into the networkcontroller";
+      public = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = ''
+          everyone can join a public network without having the administrator to accept
+        '';
+      };
+    };
+  };
+  config = {
+    systemd.network.networks.zerotier = {
+      matchConfig.Name = "zt*";
+      networkConfig = {
+        LLMNR = true;
+        LLDP = true;
+        MulticastDNS = true;
+        KeepConfiguration = "static";
+      };
+    };
+    networking.firewall.allowedUDPPorts = [ 9993 ];
+    networking.firewall.interfaces."zt+".allowedTCPPorts = [ 5353 ];
+    networking.firewall.interfaces."zt+".allowedUDPPorts = [ 5353 ];
+    services.zerotierone = {
+      enable = true;
+      joinNetworks = [ cfg.networkId ];
+    };
+  } // lib.mkIf cfg.controller.enable {
+    # only the controller needs to have the key in the repo, the other clients can be dynamic
+    # we generate the zerotier code manually for the controller, since it's part of the bootstrap command
+    clanCore.secrets.namespaces.zerotier = {
+      facts."network.id" = { };
+      secrets."identity.secret".remotePath = "/var/lib/zerotier-one/identity.secret";
+      generator = ''
+        TMPDIR=$(mktemp -d)
+        trap 'rm -rf "$TMPDIR"' EXIT
+        ${config.clanCore.clanPkgs.clan-cli}/bin/clan zerotier --outpath "$TMPDIR"
+        cp "$TMPDIR"/network.id "$facts"/network.id
+        cp "$TMPDIR"/identity.secret "$secrets"/identity.secret
+      '';
+    };
+
+    systemd.tmpfiles.rules = [
+      "L+ /var/lib/zerotierone/controller.d/network/${cfg.networkId}.json - - - - ${pkgs.writeText "net.json" (builtins.toJSON {
+        authTokens = [
+          null
+        ];
+        authorizationEndpoint = "";
+        capabilities = [];
+        clientId = "";
+        dns = [];
+        enableBroadcast = true;
+        id = cfg.networkId;
+        ipAssignmentPools = [];
+        mtu = 2800;
+        multicastLimit = 32;
+        name = "";
+        uwid = cfg.networkId;
+        objtype = "network";
+        private = true;
+        remoteTraceLevel = 0;
+        remoteTraceTarget = null;
+        revision = 1;
+        routes = [];
+        rules = [
+          {
+            not = false;
+            or = false;
+            type = "ACTION_ACCEPT";
+          }
+        ];
+        rulesSource = "";
+        ssoEnabled = false;
+        tags = [];
+        v4AssignMode = {
+          zt = false;
+        };
+        v6AssignMode = {
+          "6plane" = false;
+          rfc4193 = false;
+          zt = false;
+        };
+      })}"
+    ];
+  };
+}
+

pkgs/clan-cli/clan_cli/secrets/__init__.py

@@ -1,6 +1,7 @@
 # !/usr/bin/env python3
 import argparse
 
+from .generate import register_generate_parser
 from .groups import register_groups_parser
 from .import_sops import register_import_sops_parser
 from .machines import register_machines_parser
@@ -29,4 +30,9 @@ def register_parser(parser: argparse.ArgumentParser) -> None:
     import_sops_parser = subparser.add_parser("import-sops", help="import a sops file")
     register_import_sops_parser(import_sops_parser)
 
+    parser_generate = subparser.add_parser(
+        "generate", help="generate secrets for machines if they don't exist yet"
+    )
+    register_generate_parser(parser_generate)
+
     register_secrets_parser(subparser)

pkgs/clan-cli/clan_cli/secrets/generate.py

@@ -0,0 +1,52 @@
+import argparse
+import subprocess
+import sys
+
+from clan_cli.errors import ClanError
+
+
+def get_secret_script(machine: str) -> None:
+    proc = subprocess.run(
+        [
+            "nix",
+            "build",
+            "--impure",
+            "--print-out-paths",
+            "--expr",
+            "let f = builtins.getFlake (toString ./.); in "
+            f"(f.nixosConfigurations.{machine}.extendModules "
+            "{ modules = [{ clanCore.clanDir = toString ./.; }]; })"
+            ".config.system.clan.generateSecrets",
+        ],
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+    if proc.returncode != 0:
+        print(proc.stderr, file=sys.stderr)
+        raise ClanError(f"failed to generate secrets:\n{proc.stderr}")
+
+    secret_generator_script = proc.stdout.strip()
+    print(secret_generator_script)
+    secret_generator = subprocess.run(
+        [secret_generator_script],
+        check=True,
+    )
+
+    if secret_generator.returncode != 0:
+        print(secret_generator.stderr, file=sys.stderr)
+        raise ClanError("failed to generate secrets")
+    else:
+        print("successfully generated secrets")
+
+
+def generate_command(args: argparse.Namespace) -> None:
+    get_secret_script(args.machine)
+
+
+def register_generate_parser(parser: argparse.ArgumentParser) -> None:
+    parser.add_argument(
+        "machine",
+        help="The machine to generate secrets for",
+    )
+    parser.set_defaults(func=generate_command)