WIP: secrets generator + zerotier module
All checks were successful
build / test (pull_request) Successful in 3s
All checks were successful
build / test (pull_request) Successful in 3s
This commit is contained in:
parent
d5ea8b9914
commit
b47bd87981
@ -1,29 +0,0 @@
|
||||
{ config, lib, ... }:
|
||||
{
|
||||
options.clan.networking.zerotier = {
|
||||
networkId = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
zerotier networking id
|
||||
'';
|
||||
};
|
||||
};
|
||||
config = {
|
||||
systemd.network.networks.zerotier = {
|
||||
matchConfig.Name = "zt*";
|
||||
networkConfig = {
|
||||
LLMNR = true;
|
||||
LLDP = true;
|
||||
MulticastDNS = true;
|
||||
KeepConfiguration = "static";
|
||||
};
|
||||
};
|
||||
networking.firewall.allowedUDPPorts = [ 9993 ];
|
||||
networking.firewall.interfaces."zt+".allowedTCPPorts = [ 5353 ];
|
||||
networking.firewall.interfaces."zt+".allowedUDPPorts = [ 5353 ];
|
||||
services.zerotierone = {
|
||||
enable = true;
|
||||
joinNetworks = [ config.clan.networking.zerotier.networkId ];
|
||||
};
|
||||
};
|
||||
}
|
@ -36,9 +36,7 @@
|
||||
|
||||
./lib/flake-module.nix
|
||||
./nixosModules/flake-module.nix
|
||||
({ self, lib, ... }: {
|
||||
flake.clanModules = lib.mapAttrs (_: nix: { imports = [ nix ]; }) (self.lib.findNixFiles ./clanModules);
|
||||
})
|
||||
./nixosModules/clanCore/flake-module.nix
|
||||
];
|
||||
});
|
||||
}
|
||||
|
@ -1,4 +1,7 @@
|
||||
{ lib, ... }:
|
||||
{ lib
|
||||
, eval-config
|
||||
, ...
|
||||
}:
|
||||
{
|
||||
findNixFiles = folder:
|
||||
lib.mapAttrs'
|
||||
@ -13,4 +16,5 @@
|
||||
(builtins.readDir folder);
|
||||
|
||||
jsonschema = import ./jsonschema { inherit lib; };
|
||||
secrets = import ./secrets { inherit lib eval-config; };
|
||||
}
|
||||
|
@ -1,8 +1,12 @@
|
||||
{ lib
|
||||
, self
|
||||
, ...
|
||||
}: {
|
||||
imports = [
|
||||
./jsonschema/flake-module.nix
|
||||
];
|
||||
flake.lib = import ./default.nix { inherit lib; };
|
||||
flake.lib = import ./default.nix {
|
||||
inherit lib;
|
||||
eval-config = import (self.inputs.nixpkgs + "/nixos/lib/eval-config.nix");
|
||||
};
|
||||
}
|
||||
|
38
lib/secrets/default.nix
Normal file
38
lib/secrets/default.nix
Normal file
@ -0,0 +1,38 @@
|
||||
{ lib, eval-config, ... }:
|
||||
{
|
||||
sopsGenerateSecrets = clanDir: cfg:
|
||||
let
|
||||
evaledCfg = eval-config {
|
||||
modules = [
|
||||
cfg
|
||||
{ clanCore.clanDir = clanDir; }
|
||||
];
|
||||
};
|
||||
in
|
||||
lib.foldlAttrs
|
||||
(acc: n: v: ''
|
||||
${acc}
|
||||
# ${n}
|
||||
# if any of the facts or secrets are missing, we regenerate all connected facts/secrets
|
||||
if ! [ ${lib.concatMapStringsSep " && " (x: "-e ${x.path}") ((lib.attrValues v.secrets) ++ (lib.attrValues v.facts))} ]; then
|
||||
|
||||
facts=$(mktemp -d)
|
||||
trap "rm -rf $facts" EXIT
|
||||
secrets=$(mktemp -d)
|
||||
trap "rm -rf $secrets" EXIT
|
||||
${v.generator}
|
||||
|
||||
${lib.foldlAttrs (acc: factfile: fact: ''
|
||||
${acc}
|
||||
cp "$facts"/${factfile} ${fact.path}
|
||||
'') "" v.facts}
|
||||
|
||||
${lib.foldlAttrs (acc: secretfile: secret: ''
|
||||
${acc}
|
||||
cat "$secrets"/${secretfile} | clan secrets set --machine ${evaledCfg.config.clanCore.machineName} ${secret.path}
|
||||
'') "" v.secrets}
|
||||
fi
|
||||
'')
|
||||
"set -efux"
|
||||
evaledCfg.config.clanCore.secrets;
|
||||
}
|
31
nixosModules/clanCore/flake-module.nix
Normal file
31
nixosModules/clanCore/flake-module.nix
Normal file
@ -0,0 +1,31 @@
|
||||
{ self, lib, ... }: {
|
||||
flake.nixosModules.clanCore = { pkgs, ... }: {
|
||||
options.clanCore = {
|
||||
clanDir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
the location of the flake repo, used to calculate the location of facts and secrets
|
||||
'';
|
||||
};
|
||||
machineName = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
the name of the machine
|
||||
'';
|
||||
};
|
||||
clanPkgs = lib.mkOption {
|
||||
default = self.packages.${pkgs.system};
|
||||
};
|
||||
};
|
||||
options.system.clan = lib.mkOption {
|
||||
type = lib.types.lazyAttrsOf lib.types.raw;
|
||||
description = ''
|
||||
utility outputs for clan management of this machine
|
||||
'';
|
||||
};
|
||||
imports = [
|
||||
./secrets
|
||||
./zerotier.nix
|
||||
];
|
||||
};
|
||||
}
|
36
nixosModules/clanCore/secrets/clan_cli.nix
Normal file
36
nixosModules/clanCore/secrets/clan_cli.nix
Normal file
@ -0,0 +1,36 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
{
|
||||
config = lib.mkIf (config.clanCore.secrets.method == "clan_cli") {
|
||||
system.clan.generateSecrets = pkgs.writeScript "generate_secrets" (lib.foldlAttrs
|
||||
(acc: n: v: ''
|
||||
${acc}
|
||||
# ${n}
|
||||
# if any of the facts or secrets are missing, we regenerate all connected facts/secrets
|
||||
if ! [ ${lib.concatMapStringsSep " -a " (x: "-e ${x.path}") ((lib.attrValues v.secrets) ++ (lib.attrValues v.facts))} ]; then
|
||||
|
||||
facts=$(mktemp -d)
|
||||
trap "rm -rf $facts" EXIT
|
||||
secrets=$(mktemp -d)
|
||||
trap "rm -rf $secrets" EXIT
|
||||
${v.generator}
|
||||
|
||||
${lib.foldlAttrs (acc: factfile: fact: ''
|
||||
${acc}
|
||||
mkdir -p "$(dirname ${fact.path})"
|
||||
cp "$facts"/${factfile} ${fact.path}
|
||||
'') "" v.facts}
|
||||
|
||||
${lib.foldlAttrs (acc: secretfile: _secret: ''
|
||||
${acc}
|
||||
cat "$secrets"/${secretfile} | ${config.clanCore.clanPkgs.clan-cli}/bin/clan secrets set --machine ${config.clanCore.machineName} ${secretfile}
|
||||
'') "" v.secrets}
|
||||
fi
|
||||
'')
|
||||
''
|
||||
#!/bin/sh
|
||||
set -efux
|
||||
'' # remove x for prod
|
||||
config.clanCore.secrets.namespaces
|
||||
);
|
||||
};
|
||||
}
|
74
nixosModules/clanCore/secrets/default.nix
Normal file
74
nixosModules/clanCore/secrets/default.nix
Normal file
@ -0,0 +1,74 @@
|
||||
{ config, lib, ... }:
|
||||
{
|
||||
options.clanCore.secrets = {
|
||||
method = lib.mkOption {
|
||||
type = lib.types.str; # maybe enum? but how can other people implement secret modules outside
|
||||
default = "clan_cli";
|
||||
description = ''
|
||||
the secret provider which is used to encrypt/decrypt secrets
|
||||
'';
|
||||
};
|
||||
namespaces = lib.mkOption {
|
||||
type = lib.types.attrsOf
|
||||
(lib.types.submodule (secret: {
|
||||
options = {
|
||||
name = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = secret.config._module.args.name;
|
||||
description = ''
|
||||
namespace of the secret
|
||||
'';
|
||||
};
|
||||
generator = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
description = ''
|
||||
script to generate the secret.
|
||||
can be set to null. then the user has to provide the secret via the clan cli
|
||||
'';
|
||||
};
|
||||
secrets = lib.mkOption {
|
||||
type = lib.types.attrsOf (lib.types.submodule (secret: {
|
||||
options = {
|
||||
path = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
path to the secret in the local clanRepo
|
||||
'';
|
||||
default = "${config.clanCore.clanDir}/secrets/${config.clanCore.machineName}/${secret.config._module.args.name}";
|
||||
};
|
||||
remotePath = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
destination where the secret should be installed on the target machine
|
||||
'';
|
||||
};
|
||||
};
|
||||
}));
|
||||
description = ''
|
||||
path where the secret is located in the filesystem
|
||||
'';
|
||||
};
|
||||
facts = lib.mkOption {
|
||||
type = lib.types.attrsOf (lib.types.submodule (fact: {
|
||||
options = {
|
||||
path = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
path to a fact which is generated by the generator
|
||||
'';
|
||||
default = "${config.clanCore.clanDir}/facts/${config.clanCore.machineName}/${fact.config._module.args.name}";
|
||||
};
|
||||
value = lib.mkOption {
|
||||
default = builtins.readFile fact.config.path;
|
||||
};
|
||||
};
|
||||
}));
|
||||
};
|
||||
};
|
||||
}));
|
||||
};
|
||||
};
|
||||
imports = [
|
||||
./clan_cli.nix # for now we have only one implementation, thats why we import it here and not in clanModules
|
||||
];
|
||||
}
|
100
nixosModules/clanCore/zerotier.nix
Normal file
100
nixosModules/clanCore/zerotier.nix
Normal file
@ -0,0 +1,100 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
let
|
||||
cfg = config.clan.networking.zerotier;
|
||||
in
|
||||
{
|
||||
options.clan.networking.zerotier = {
|
||||
networkId = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
zerotier networking id
|
||||
'';
|
||||
};
|
||||
controller = {
|
||||
enable = lib.mkEnableOption "turn this machine into the networkcontroller";
|
||||
public = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
everyone can join a public network without having the administrator to accept
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
config = {
|
||||
systemd.network.networks.zerotier = {
|
||||
matchConfig.Name = "zt*";
|
||||
networkConfig = {
|
||||
LLMNR = true;
|
||||
LLDP = true;
|
||||
MulticastDNS = true;
|
||||
KeepConfiguration = "static";
|
||||
};
|
||||
};
|
||||
networking.firewall.allowedUDPPorts = [ 9993 ];
|
||||
networking.firewall.interfaces."zt+".allowedTCPPorts = [ 5353 ];
|
||||
networking.firewall.interfaces."zt+".allowedUDPPorts = [ 5353 ];
|
||||
services.zerotierone = {
|
||||
enable = true;
|
||||
joinNetworks = [ cfg.networkId ];
|
||||
};
|
||||
} // lib.mkIf cfg.controller.enable {
|
||||
# only the controller needs to have the key in the repo, the other clients can be dynamic
|
||||
# we generate the zerotier code manually for the controller, since it's part of the bootstrap command
|
||||
clanCore.secrets.namespaces.zerotier = {
|
||||
facts."network.id" = { };
|
||||
secrets."identity.secret".remotePath = "/var/lib/zerotier-one/identity.secret";
|
||||
generator = ''
|
||||
TMPDIR=$(mktemp -d)
|
||||
trap 'rm -rf "$TMPDIR"' EXIT
|
||||
${config.clanCore.clanPkgs.clan-cli}/bin/clan zerotier --outpath "$TMPDIR"
|
||||
cp "$TMPDIR"/network.id "$facts"/network.id
|
||||
cp "$TMPDIR"/identity.secret "$secrets"/identity.secret
|
||||
'';
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"L+ /var/lib/zerotierone/controller.d/network/${cfg.networkId}.json - - - - ${pkgs.writeText "net.json" (builtins.toJSON {
|
||||
authTokens = [
|
||||
null
|
||||
];
|
||||
authorizationEndpoint = "";
|
||||
capabilities = [];
|
||||
clientId = "";
|
||||
dns = [];
|
||||
enableBroadcast = true;
|
||||
id = cfg.networkId;
|
||||
ipAssignmentPools = [];
|
||||
mtu = 2800;
|
||||
multicastLimit = 32;
|
||||
name = "";
|
||||
uwid = cfg.networkId;
|
||||
objtype = "network";
|
||||
private = true;
|
||||
remoteTraceLevel = 0;
|
||||
remoteTraceTarget = null;
|
||||
revision = 1;
|
||||
routes = [];
|
||||
rules = [
|
||||
{
|
||||
not = false;
|
||||
or = false;
|
||||
type = "ACTION_ACCEPT";
|
||||
}
|
||||
];
|
||||
rulesSource = "";
|
||||
ssoEnabled = false;
|
||||
tags = [];
|
||||
v4AssignMode = {
|
||||
zt = false;
|
||||
};
|
||||
v6AssignMode = {
|
||||
"6plane" = false;
|
||||
rfc4193 = false;
|
||||
zt = false;
|
||||
};
|
||||
})}"
|
||||
];
|
||||
};
|
||||
}
|
||||
|
@ -4,7 +4,7 @@ import sys
|
||||
from types import ModuleType
|
||||
from typing import Optional
|
||||
|
||||
from . import admin, config, machines, secrets, webui
|
||||
from . import admin, config, machines, secrets, webui, zerotier
|
||||
from .errors import ClanError
|
||||
from .ssh import cli as ssh_cli
|
||||
|
||||
@ -41,6 +41,9 @@ def create_parser(prog: Optional[str] = None) -> argparse.ArgumentParser:
|
||||
parser_webui = subparsers.add_parser("webui", help="start webui")
|
||||
webui.register_parser(parser_webui)
|
||||
|
||||
parser_zerotier = subparsers.add_parser("zerotier", help="create zerotier network")
|
||||
zerotier.register_parser(parser_zerotier)
|
||||
|
||||
if argcomplete:
|
||||
argcomplete.autocomplete(parser)
|
||||
|
||||
|
@ -3,9 +3,13 @@ import argparse
|
||||
import os
|
||||
import subprocess
|
||||
|
||||
from .secrets.secrets import encrypt_secret, sops_secrets_folder
|
||||
from .zerotier import create_network
|
||||
|
||||
|
||||
def create(args: argparse.Namespace) -> None:
|
||||
os.makedirs(args.folder, exist_ok=True)
|
||||
os.chdir(args.folder)
|
||||
# TODO create clan template in flake
|
||||
subprocess.Popen(
|
||||
[
|
||||
@ -16,6 +20,13 @@ def create(args: argparse.Namespace) -> None:
|
||||
"git+https://git.clan.lol/clan/clan-core#new-clan",
|
||||
]
|
||||
)
|
||||
network = create_network()
|
||||
encrypt_secret(
|
||||
sops_secrets_folder() / "zerotier.secret",
|
||||
network["secret"],
|
||||
)
|
||||
with open(".zerotier.id", "w+") as id_file:
|
||||
id_file.write(network["networkid"])
|
||||
|
||||
|
||||
def git(args: argparse.Namespace) -> None:
|
||||
|
@ -1,6 +1,7 @@
|
||||
# !/usr/bin/env python3
|
||||
import argparse
|
||||
|
||||
from .generate import register_generate_parser
|
||||
from .groups import register_groups_parser
|
||||
from .import_sops import register_import_sops_parser
|
||||
from .machines import register_machines_parser
|
||||
@ -29,4 +30,9 @@ def register_parser(parser: argparse.ArgumentParser) -> None:
|
||||
import_sops_parser = subparser.add_parser("import-sops", help="import a sops file")
|
||||
register_import_sops_parser(import_sops_parser)
|
||||
|
||||
parser_generate = subparser.add_parser(
|
||||
"generate", help="generate secrets for machines if they don't exist yet"
|
||||
)
|
||||
register_generate_parser(parser_generate)
|
||||
|
||||
register_secrets_parser(subparser)
|
||||
|
54
pkgs/clan-cli/clan_cli/secrets/generate.py
Normal file
54
pkgs/clan-cli/clan_cli/secrets/generate.py
Normal file
@ -0,0 +1,54 @@
|
||||
import argparse
|
||||
import subprocess
|
||||
import sys
|
||||
|
||||
from clan_cli.errors import ClanError
|
||||
|
||||
|
||||
def get_secret_script(machine: str) -> None:
|
||||
proc = subprocess.run(
|
||||
[
|
||||
"nix",
|
||||
"build",
|
||||
"--impure",
|
||||
"--print-out-paths",
|
||||
"--expr",
|
||||
"let f = builtins.getFlake (toString ./.); in "
|
||||
f"(f.nixosConfigurations.{machine}.extendModules "
|
||||
"{ modules = [{ clanCore.clanDir = toString ./.; }]; })"
|
||||
".config.system.clan.generateSecrets",
|
||||
],
|
||||
check=True,
|
||||
capture_output=True,
|
||||
text=True,
|
||||
)
|
||||
if proc.returncode != 0:
|
||||
print(proc.stderr, file=sys.stderr)
|
||||
raise ClanError(f"failed to generate secrets:\n{proc.stderr}")
|
||||
|
||||
secret_generator_script = proc.stdout.strip()
|
||||
print(secret_generator_script)
|
||||
secret_generator = subprocess.run(
|
||||
[secret_generator_script],
|
||||
check=True,
|
||||
capture_output=True,
|
||||
text=True,
|
||||
)
|
||||
|
||||
if secret_generator.returncode != 0:
|
||||
print(secret_generator.stderr, file=sys.stderr)
|
||||
raise ClanError(f"failed to generate secrets:\n{secret_generator.stderr}")
|
||||
else:
|
||||
print("successfully generated secrets")
|
||||
|
||||
|
||||
def generate_command(args: argparse.Namespace) -> None:
|
||||
get_secret_script(args.machine)
|
||||
|
||||
|
||||
def register_generate_parser(parser: argparse.ArgumentParser) -> None:
|
||||
parser.add_argument(
|
||||
"machine",
|
||||
help="The machine to generate secrets for",
|
||||
)
|
||||
parser.set_defaults(func=generate_command)
|
@ -1,3 +1,4 @@
|
||||
import argparse
|
||||
import json
|
||||
import socket
|
||||
import subprocess
|
||||
@ -42,7 +43,8 @@ class ZerotierController:
|
||||
def __init__(self, port: int, home: Path) -> None:
|
||||
self.port = port
|
||||
self.home = home
|
||||
self.secret = (home / "authtoken.secret").read_text()
|
||||
self.authtoken = (home / "authtoken.secret").read_text()
|
||||
self.secret = (home / "identity.secret").read_text()
|
||||
|
||||
def _http_request(
|
||||
self,
|
||||
@ -56,7 +58,7 @@ class ZerotierController:
|
||||
if data is not None:
|
||||
body = json.dumps(data).encode("ascii")
|
||||
headers["Content-Type"] = "application/json"
|
||||
headers["X-ZT1-AUTH"] = self.secret
|
||||
headers["X-ZT1-AUTH"] = self.authtoken
|
||||
url = f"http://127.0.0.1:{self.port}{path}"
|
||||
req = urllib.request.Request(url, headers=headers, method=method, data=body)
|
||||
resp = urllib.request.urlopen(req)
|
||||
@ -75,11 +77,6 @@ class ZerotierController:
|
||||
def get_network(self, id: str) -> dict[str, Any]:
|
||||
return self._http_request(f"/controller/network/{id}")
|
||||
|
||||
def update_network(self, id: str, new_config: dict[str, Any]) -> dict[str, Any]:
|
||||
return self._http_request(
|
||||
f"/controller/network/{id}", method="POST", data=new_config
|
||||
)
|
||||
|
||||
|
||||
@contextmanager
|
||||
def zerotier_controller() -> Iterator[ZerotierController]:
|
||||
@ -115,6 +112,7 @@ def zerotier_controller() -> Iterator[ZerotierController]:
|
||||
"/proc",
|
||||
"--dev",
|
||||
"/dev",
|
||||
"--unshare-user",
|
||||
"--uid",
|
||||
"0",
|
||||
"--gid",
|
||||
@ -149,19 +147,28 @@ def zerotier_controller() -> Iterator[ZerotierController]:
|
||||
p.wait()
|
||||
|
||||
|
||||
class ZerotierNetwork:
|
||||
def __init__(self, network_id: str) -> None:
|
||||
self.network_id = network_id
|
||||
|
||||
|
||||
# TODO: allow merging more network configuration here
|
||||
def create_network(private: bool = False) -> ZerotierNetwork:
|
||||
def create_network() -> dict:
|
||||
with zerotier_controller() as controller:
|
||||
network = controller.create_network()
|
||||
network_id = network["nwid"]
|
||||
network = controller.get_network(network_id)
|
||||
network["private"] = private
|
||||
network["v6AssignMode"]["rfc4193"] = True
|
||||
controller.update_network(network_id, network)
|
||||
# TODO: persist home into sops?
|
||||
return ZerotierNetwork(network_id)
|
||||
return {
|
||||
"secret": controller.secret,
|
||||
"networkid": network["nwid"],
|
||||
}
|
||||
|
||||
|
||||
def main(args: argparse.Namespace) -> None:
|
||||
zerotier = create_network()
|
||||
outpath = Path(args.outpath)
|
||||
outpath.mkdir(parents=True, exist_ok=True)
|
||||
with open(outpath / "network.id", "w+") as nwid_file:
|
||||
nwid_file.write(zerotier["networkid"])
|
||||
with open(outpath / "identity.secret", "w+") as secret_file:
|
||||
secret_file.write(zerotier["secret"])
|
||||
|
||||
|
||||
def register_parser(parser: argparse.ArgumentParser) -> None:
|
||||
parser.add_argument(
|
||||
"--outpath", help="directory to put the secret file to", required=True
|
||||
)
|
||||
parser.set_defaults(func=main)
|
||||
|
@ -3,4 +3,4 @@ from clan_cli.zerotier import create_network
|
||||
|
||||
def test_create_network() -> None:
|
||||
network = create_network()
|
||||
assert network.network_id
|
||||
assert network["networkid"]
|
||||
|
@ -1,9 +1,14 @@
|
||||
# AUTOMATICALLY GENERATED by clan
|
||||
{ ... }: {
|
||||
{ self, ... }: {
|
||||
imports =
|
||||
let
|
||||
relPaths = builtins.fromJSON (builtins.readFile ./imports.json);
|
||||
paths = map (path: ./. + path) relPaths;
|
||||
in
|
||||
paths;
|
||||
paths ++ [
|
||||
self.inputs.clan-core.clanModules.core
|
||||
{
|
||||
clan.netowkring.zerotier.networkId = builtins.readFile ./.zerotier.id;
|
||||
}
|
||||
];
|
||||
}
|
||||
|
@ -2,8 +2,7 @@
|
||||
description = "<Put your description here>";
|
||||
|
||||
inputs = {
|
||||
clan-core.url = "git+https://git.clan.lol/clan/clan-core";
|
||||
flake-parts.url = "github:hercules-ci/flake-parts";
|
||||
clan-core.url = "path:/home/lass/src/clan/clan-core/";
|
||||
};
|
||||
|
||||
outputs = inputs @ { flake-parts, ... }:
|
||||
|
Loading…
Reference in New Issue
Block a user