Merge branch 'master' into review

4 files changed, 613 insertions, 0 deletions

diff --git a/src/utils/data.rs b/src/utils/data.rs
new file mode 100644
index 0000000..6cf2c5a
--- /dev/null
+++ b/src/utils/data.rs
@@ -0,0 +1,74 @@
+// SPDX-FileCopyrightText: 2020 Serokell <https://serokell.io/>
+//
+// SPDX-License-Identifier: MPL-2.0
+
+use merge::Merge;
+
+use std::collections::HashMap;
+
+#[derive(Deserialize, Debug, Clone, Merge)]
+pub struct GenericSettings {
+    #[serde(rename(deserialize = "sshUser"))]
+    pub ssh_user: Option<String>,
+    pub user: Option<String>,
+    #[serde(
+        skip_serializing_if = "Vec::is_empty",
+        default,
+        rename(deserialize = "sshOpts")
+    )]
+    #[merge(strategy = merge::vec::append)]
+    pub ssh_opts: Vec<String>,
+    #[serde(rename(deserialize = "fastConnection"))]
+    pub fast_connection: Option<bool>,
+    #[serde(rename(deserialize = "autoRollback"))]
+    pub auto_rollback: Option<bool>,
+    #[serde(rename(deserialize = "confirmTimeout"))]
+    pub confirm_timeout: Option<u16>,
+    #[serde(rename(deserialize = "tempPath"))]
+    pub temp_path: Option<String>,
+    #[serde(rename(deserialize = "magicRollback"))]
+    pub magic_rollback: Option<bool>,
+}
+
+#[derive(Deserialize, Debug, Clone)]
+pub struct NodeSettings {
+    pub hostname: String,
+    pub profiles: HashMap<String, Profile>,
+    #[serde(
+        skip_serializing_if = "Vec::is_empty",
+        default,
+        rename(deserialize = "profilesOrder")
+    )]
+    pub profiles_order: Vec<String>,
+}
+
+#[derive(Deserialize, Debug, Clone)]
+pub struct ProfileSettings {
+    pub path: String,
+    pub bootstrap: Option<String>,
+    #[serde(rename(deserialize = "profilePath"))]
+    pub profile_path: Option<String>,
+}
+
+#[derive(Deserialize, Debug, Clone)]
+pub struct Profile {
+    #[serde(flatten)]
+    pub profile_settings: ProfileSettings,
+    #[serde(flatten)]
+    pub generic_settings: GenericSettings,
+}
+
+#[derive(Deserialize, Debug, Clone)]
+pub struct Node {
+    #[serde(flatten)]
+    pub generic_settings: GenericSettings,
+    #[serde(flatten)]
+    pub node_settings: NodeSettings,
+}
+
+#[derive(Deserialize, Debug, Clone)]
+pub struct Data {
+    #[serde(flatten)]
+    pub generic_settings: GenericSettings,
+    pub nodes: HashMap<String, Node>,
+}
diff --git a/src/utils/deploy.rs b/src/utils/deploy.rs
new file mode 100644
index 0000000..59217df
--- /dev/null
+++ b/src/utils/deploy.rs
@@ -0,0 +1,169 @@
+// SPDX-FileCopyrightText: 2020 Serokell <https://serokell.io/>
+//
+// SPDX-License-Identifier: MPL-2.0
+
+use std::borrow::Cow;
+use tokio::process::Command;
+
+fn build_activate_command(
+    activate_path_str: String,
+    sudo: &Option<String>,
+    profile_path: &str,
+    closure: &str,
+    bootstrap_cmd: &Option<String>,
+    auto_rollback: bool,
+    temp_path: &Cow<str>,
+    confirm_timeout: u16,
+    magic_rollback: bool,
+) -> String {
+    let mut self_activate_command = format!(
+        "{} '{}' '{}' --temp-path {} --confirm-timeout {}",
+        activate_path_str, profile_path, closure, temp_path, confirm_timeout
+    );
+
+    if magic_rollback {
+        self_activate_command = format!("{} --magic-rollback", self_activate_command);
+    }
+
+    if auto_rollback {
+        self_activate_command = format!("{} --auto-rollback", self_activate_command);
+    }
+
+    if let Some(ref bootstrap_cmd) = bootstrap_cmd {
+        self_activate_command = format!(
+            "{} --bootstrap-cmd '{}'",
+            self_activate_command, bootstrap_cmd
+        );
+    }
+
+    if let Some(sudo_cmd) = &sudo {
+        self_activate_command = format!("{} {}", sudo_cmd, self_activate_command);
+    }
+
+    self_activate_command
+}
+
+#[test]
+fn test_activation_command_builder() {
+    let activate_path_str = "/blah/bin/activate".to_string();
+    let sudo = Some("sudo -u test".to_string());
+    let profile_path = "/blah/profiles/test";
+    let closure = "/blah/etc";
+    let bootstrap_cmd = None;
+    let auto_rollback = true;
+    let temp_path = &"/tmp/deploy-rs".into();
+    let confirm_timeout = 30;
+    let magic_rollback = true;
+
+    assert_eq!(
+        build_activate_command(
+            activate_path_str,
+            &sudo,
+            profile_path,
+            closure,
+            &bootstrap_cmd,
+            auto_rollback,
+            temp_path,
+            confirm_timeout,
+            magic_rollback
+        ),
+        "sudo -u test /blah/bin/activate '/blah/profiles/test' '/blah/etc' --temp-path /tmp/deploy-rs --confirm-timeout 30 --magic-rollback --auto-rollback"
+            .to_string(),
+    );
+}
+
+pub async fn deploy_profile(
+    deploy_data: &super::DeployData<'_>,
+    deploy_defs: &super::DeployDefs<'_>,
+) -> Result<(), Box<dyn std::error::Error>> {
+    info!(
+        "Activating profile `{}` for node `{}`",
+        deploy_data.profile_name, deploy_data.node_name
+    );
+
+    let activate_path_str = super::deploy_path_to_activate_path_str(&deploy_defs.current_exe)?;
+
+    let temp_path: Cow<str> = match &deploy_data.merged_settings.temp_path {
+        Some(x) => x.into(),
+        None => "/tmp/deploy-rs".into(),
+    };
+
+    let confirm_timeout = deploy_data.merged_settings.confirm_timeout.unwrap_or(30);
+
+    let magic_rollback = deploy_data.merged_settings.magic_rollback.unwrap_or(false);
+
+    let auto_rollback = deploy_data.merged_settings.auto_rollback.unwrap_or(true);
+
+    let self_activate_command = build_activate_command(
+        activate_path_str,
+        &deploy_defs.sudo,
+        &deploy_defs.profile_path,
+        &deploy_data.profile.profile_settings.path,
+        &deploy_data.profile.profile_settings.bootstrap,
+        auto_rollback,
+        &temp_path,
+        confirm_timeout,
+        magic_rollback,
+    );
+
+    debug!("Constructed activation command: {}", self_activate_command);
+
+    let hostname = match deploy_data.cmd_overrides.hostname {
+        Some(ref x) => x,
+        None => &deploy_data.node.node_settings.hostname,
+    };
+
+    let mut c = Command::new("ssh");
+    let mut ssh_command = c
+        .arg("-t")
+        .arg(format!("ssh://{}@{}", deploy_defs.ssh_user, hostname));
+
+    for ssh_opt in &deploy_data.merged_settings.ssh_opts {
+        ssh_command = ssh_command.arg(ssh_opt);
+    }
+
+    let ssh_exit_status = ssh_command.arg(self_activate_command).status().await?;
+
+    if !ssh_exit_status.success() {
+        good_panic!("Activation over SSH failed");
+    }
+
+    info!("Success activating!");
+
+    if magic_rollback {
+        info!("Attempting to confirm activation");
+
+        let mut c = Command::new("ssh");
+        let mut ssh_confirm_command = c.arg(format!("ssh://{}@{}", deploy_defs.ssh_user, hostname));
+
+        for ssh_opt in &deploy_data.merged_settings.ssh_opts {
+            ssh_confirm_command = ssh_confirm_command.arg(ssh_opt);
+        }
+
+        let lock_hash = &deploy_data.profile.profile_settings.path[11 /* /nix/store/ */ ..];
+        let lock_path = format!("{}/activating-{}", temp_path, lock_hash);
+
+        let mut confirm_command = format!("rm {}", lock_path);
+        if let Some(sudo_cmd) = &deploy_defs.sudo {
+            confirm_command = format!("{} {}", sudo_cmd, confirm_command);
+        }
+
+        debug!(
+            "Attempting to run command to confirm deployment: {}",
+            confirm_command
+        );
+
+        let ssh_exit_status = ssh_confirm_command.arg(confirm_command).status().await?;
+
+        if !ssh_exit_status.success() {
+            good_panic!(
+                "Failed to confirm deployment, the node will roll back in <{} seconds",
+                confirm_timeout
+            );
+        }
+
+        info!("Deployment confirmed.");
+    }
+
+    Ok(())
+}
diff --git a/src/utils/mod.rs b/src/utils/mod.rs
new file mode 100644
index 0000000..a0e62e1
--- /dev/null
+++ b/src/utils/mod.rs
@@ -0,0 +1,233 @@
+// SPDX-FileCopyrightText: 2020 Serokell <https://serokell.io/>
+//
+// SPDX-License-Identifier: MPL-2.0
+
+use std::borrow::Cow;
+use std::path::PathBuf;
+
+use merge::Merge;
+
+#[macro_export]
+macro_rules! good_panic {
+    ($($tts:tt)*) => {{
+        error!($($tts)*);
+        std::process::exit(1);
+    }}
+}
+
+pub mod data;
+pub mod deploy;
+pub mod push;
+
+pub struct CmdOverrides {
+    pub ssh_user: Option<String>,
+    pub profile_user: Option<String>,
+    pub ssh_opts: Option<String>,
+    pub fast_connection: Option<bool>,
+    pub auto_rollback: Option<bool>,
+    pub hostname: Option<String>,
+    pub magic_rollback: Option<bool>,
+    pub temp_path: Option<String>,
+    pub confirm_timeout: Option<u16>,
+}
+
+#[derive(PartialEq, Debug)]
+pub struct DeployFlake<'a> {
+    pub repo: &'a str,
+    pub node: Option<&'a str>,
+    pub profile: Option<&'a str>,
+}
+
+pub fn parse_flake(flake: &str) -> DeployFlake {
+    let flake_fragment_start = flake.find('#');
+    let (repo, maybe_fragment) = match flake_fragment_start {
+        Some(s) => (&flake[..s], Some(&flake[s + 1..])),
+        None => (flake, None),
+    };
+
+    let (node, profile) = match maybe_fragment {
+        Some(fragment) => {
+            let fragment_profile_start = fragment.find('.');
+            match fragment_profile_start {
+                Some(s) => (Some(&fragment[..s]), Some(&fragment[s + 1..])),
+                None => (Some(fragment), None),
+            }
+        }
+        None => (None, None),
+    };
+
+    DeployFlake {
+        repo,
+        node,
+        profile,
+    }
+}
+
+#[test]
+fn test_parse_flake() {
+    assert_eq!(
+        parse_flake("../deploy/examples/system#example"),
+        DeployFlake {
+            repo: "../deploy/examples/system",
+            node: Some("example"),
+            profile: None
+        }
+    );
+
+    assert_eq!(
+        parse_flake("../deploy/examples/system#example.system"),
+        DeployFlake {
+            repo: "../deploy/examples/system",
+            node: Some("example"),
+            profile: Some("system")
+        }
+    );
+
+    assert_eq!(
+        parse_flake("../deploy/examples/system"),
+        DeployFlake {
+            repo: "../deploy/examples/system",
+            node: None,
+            profile: None,
+        }
+    );
+}
+
+pub struct DeployData<'a> {
+    pub node_name: &'a str,
+    pub node: &'a data::Node,
+    pub profile_name: &'a str,
+    pub profile: &'a data::Profile,
+
+    pub cmd_overrides: &'a CmdOverrides,
+
+    pub merged_settings: data::GenericSettings,
+}
+
+pub struct DeployDefs<'a> {
+    pub ssh_user: Cow<'a, str>,
+    pub profile_user: Cow<'a, str>,
+    pub profile_path: Cow<'a, str>,
+    pub current_exe: PathBuf,
+    pub sudo: Option<String>,
+}
+
+impl<'a> DeployData<'a> {
+    pub fn defs(&'a self) -> DeployDefs<'a> {
+        let ssh_user: Cow<str> = match self.merged_settings.ssh_user {
+            Some(ref u) => u.into(),
+            None => whoami::username().into(),
+        };
+
+        let profile_user: Cow<str> = match self.merged_settings.user {
+            Some(ref x) => x.into(),
+            None => match self.merged_settings.ssh_user {
+                Some(ref x) => x.into(),
+                None => good_panic!(
+                    "Neither user nor sshUser set for profile `{}` of node `{}`",
+                    self.profile_name,
+                    self.node_name
+                ),
+            },
+        };
+
+        let profile_path: Cow<str> = match self.profile.profile_settings.profile_path {
+            None => match &profile_user[..] {
+                "root" => format!("/nix/var/nix/profiles/{}", self.profile_name).into(),
+                _ => format!(
+                    "/nix/var/nix/profiles/per-user/{}/{}",
+                    profile_user, self.profile_name
+                )
+                .into(),
+            },
+            Some(ref x) => x.into(),
+        };
+
+        let sudo: Option<String> = match self.merged_settings.user {
+            Some(ref user) if user != &ssh_user => Some(format!("sudo -u {}", user)),
+            _ => None,
+        };
+
+        let current_exe =
+            std::env::current_exe().expect("Expected to find current executable path");
+
+        if !current_exe.starts_with("/nix/store/") {
+            good_panic!("The deploy binary must be in the Nix store");
+        }
+
+        DeployDefs {
+            ssh_user,
+            profile_user,
+            profile_path,
+            current_exe,
+            sudo,
+        }
+    }
+}
+
+pub fn make_deploy_data<'a, 's>(
+    top_settings: &'s data::GenericSettings,
+    node: &'a data::Node,
+    node_name: &'a str,
+    profile: &'a data::Profile,
+    profile_name: &'a str,
+    cmd_overrides: &'a CmdOverrides,
+) -> Result<DeployData<'a>, Box<dyn std::error::Error>> {
+    let mut merged_settings = top_settings.clone();
+    merged_settings.merge(node.generic_settings.clone());
+    merged_settings.merge(profile.generic_settings.clone());
+
+    if cmd_overrides.ssh_user.is_some() {
+        merged_settings.ssh_user = cmd_overrides.ssh_user.clone();
+    }
+    if cmd_overrides.profile_user.is_some() {
+        merged_settings.user = cmd_overrides.profile_user.clone();
+    }
+    if let Some(ref ssh_opts) = cmd_overrides.ssh_opts {
+        merged_settings.ssh_opts = ssh_opts.split(' ').map(|x| x.to_owned()).collect();
+    }
+    if let Some(fast_connection) = cmd_overrides.fast_connection {
+        merged_settings.fast_connection = Some(fast_connection);
+    }
+    if let Some(auto_rollback) = cmd_overrides.auto_rollback {
+        merged_settings.auto_rollback = Some(auto_rollback);
+    }
+    if let Some(magic_rollback) = cmd_overrides.magic_rollback {
+        merged_settings.magic_rollback = Some(magic_rollback);
+    }
+
+    Ok(DeployData {
+        profile,
+        profile_name,
+        node,
+        node_name,
+
+        cmd_overrides,
+
+        merged_settings,
+    })
+}
+
+pub fn deploy_path_to_activate_path_str(
+    deploy_path: &std::path::Path,
+) -> Result<String, Box<dyn std::error::Error>> {
+    Ok(format!(
+        "{}/activate",
+        deploy_path
+            .parent()
+            .ok_or("Deploy path too short")?
+            .to_str()
+            .ok_or("Deploy path is not valid utf8")?
+            .to_owned()
+    ))
+}
+
+#[test]
+fn test_activate_path_generation() {
+    match deploy_path_to_activate_path_str(&std::path::PathBuf::from(
+        "/blah/blah/deploy-rs/bin/deploy",
+    )) {
+        Err(_) => panic!(""),
+        Ok(x) => assert_eq!(x, "/blah/blah/deploy-rs/bin/activate".to_string()),
+    }
+}
diff --git a/src/utils/push.rs b/src/utils/push.rs
new file mode 100644
index 0000000..5e87d5c
--- /dev/null
+++ b/src/utils/push.rs
@@ -0,0 +1,137 @@
+// SPDX-FileCopyrightText: 2020 Serokell <https://serokell.io/>
+//
+// SPDX-License-Identifier: MPL-2.0
+
+use std::process::Stdio;
+use tokio::process::Command;
+
+pub async fn push_profile(
+    supports_flakes: bool,
+    check_sigs: bool,
+    repo: &str,
+    deploy_data: &super::DeployData<'_>,
+    deploy_defs: &super::DeployDefs<'_>,
+    keep_result: bool,
+    result_path: Option<&str>,
+) -> Result<(), Box<dyn std::error::Error>> {
+    info!(
+        "Building profile `{}` for node `{}`",
+        deploy_data.profile_name, deploy_data.node_name
+    );
+
+    let mut build_c = if supports_flakes {
+        Command::new("nix")
+    } else {
+        Command::new("nix-build")
+    };
+
+    let mut build_command = if supports_flakes {
+        build_c.arg("build").arg("--no-link").arg(format!(
+            "{}#deploy.nodes.{}.profiles.{}.path",
+            repo, deploy_data.node_name, deploy_data.profile_name
+        ))
+    } else {
+        build_c
+            .arg(&repo)
+            .arg("--no-out-link")
+            .arg("-A")
+            .arg(format!(
+                "deploy.nodes.{}.profiles.{}.path",
+                deploy_data.node_name, deploy_data.profile_name
+            ))
+    };
+
+    build_command = match (keep_result, supports_flakes) {
+        (true, _) => {
+            let result_path = match result_path {
+                Some(x) => x,
+                None => "./.deploy-gc",
+            };
+
+            build_command.arg("--out-link").arg(format!(
+                "{}/{}/{}",
+                result_path, deploy_data.node_name, deploy_data.profile_name
+            ))
+        }
+        (false, false) => build_command.arg("--no-out-link"),
+        (false, true) => build_command.arg("--no-link"),
+    };
+
+    let build_exit_status = build_command.stdout(Stdio::null()).status().await?;
+
+    if !build_exit_status.success() {
+        good_panic!("`nix build` failed");
+    }
+
+    if let Ok(local_key) = std::env::var("LOCAL_KEY") {
+        info!(
+            "Signing key present! Signing profile `{}` for node `{}`",
+            deploy_data.profile_name, deploy_data.node_name
+        );
+
+        let sign_exit_status = Command::new("nix")
+            .arg("sign-paths")
+            .arg("-r")
+            .arg("-k")
+            .arg(local_key)
+            .arg(&deploy_data.profile.profile_settings.path)
+            .arg(&super::deploy_path_to_activate_path_str(
+                &deploy_defs.current_exe,
+            )?)
+            .stdout(Stdio::null())
+            .stderr(Stdio::null())
+            .status()
+            .await?;
+
+        if !sign_exit_status.success() {
+            good_panic!("`nix sign-paths` failed");
+        }
+    }
+
+    debug!(
+        "Copying profile `{}` to node `{}`",
+        deploy_data.profile_name, deploy_data.node_name
+    );
+
+    let mut copy_command_ = Command::new("nix");
+    let mut copy_command = copy_command_.arg("copy");
+
+    if let Some(true) = deploy_data.merged_settings.fast_connection {
+        copy_command = copy_command.arg("--substitute-on-destination");
+    }
+
+    if !check_sigs {
+        copy_command = copy_command.arg("--no-check-sigs");
+    }
+
+    let ssh_opts_str = deploy_data
+        .merged_settings
+        .ssh_opts
+        // This should provide some extra safety, but it also breaks for some reason, oh well
+        // .iter()
+        // .map(|x| format!("'{}'", x))
+        // .collect::<Vec<String>>()
+        .join(" ");
+
+    let hostname = match deploy_data.cmd_overrides.hostname {
+        Some(ref x) => x,
+        None => &deploy_data.node.node_settings.hostname,
+    };
+
+    let copy_exit_status = copy_command
+        .arg("--to")
+        .arg(format!("ssh://{}@{}", deploy_defs.ssh_user, hostname))
+        .arg(&deploy_data.profile.profile_settings.path)
+        .arg(&super::deploy_path_to_activate_path_str(
+            &deploy_defs.current_exe,
+        )?)
+        .env("NIX_SSHOPTS", ssh_opts_str)
+        .status()
+        .await?;
+
+    if !copy_exit_status.success() {
+        good_panic!("`nix copy` failed");
+    }
+
+    Ok(())
+}