chore: Release dkl version 1.2.3

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "dkl"
-version = "1.2.1"
+version = "1.2.3"
 edition = "2024"
 
 [profile.release]
@@ -23,6 +23,7 @@ eyre = "0.6.12"
 fastrand = "2.3.0"
 futures = "0.3.31"
 futures-util = "0.3.31"
+getrandom = "0.4.2"
 glob = "0.3.2"
 hex = "0.4.3"
 human-units = "0.5.3"
@@ -37,7 +38,7 @@ rpassword = "7.4.0"
 rust-argon2 = "3.0.0"
 serde = { version = "1.0.219", features = ["derive"] }
 serde_json = "1.0.140"
-serde_yaml = "0.9.34"
+serde_yaml = { version = "0.10.0", package = "serde_yaml_ng" }
 signal-hook = "0.4.4"
 tabled = "0.20.0"
 thiserror = "2.0.12"

Dockerfile

@@ -1,4 +1,4 @@
-from mcluseau/rust:1.95.0 as build
+from mcluseau/rust:1.97.0 as build
 
 workdir /app
 copy . .
@@ -10,6 +10,6 @@ run \
  && find target/release -maxdepth 1 -type f -executable -exec cp -v {} /dist/ +
 
 # ------------------------------------------------------------------------
-from alpine:3.23.4
+from alpine:3.24.0
 copy --from=build /dist/ /bin/
 

release.sh

@@ -2,15 +2,17 @@ set -ex
 tag=$(git describe --always)
 repo=novit.tech/direktil/dkl:$tag
 
-docker build --push --platform=linux/amd64,linux/arm64 . -t $repo
-
 publish() {
     arch=$1
     pf=$2
 
+    docker build --push --platform=$pf . -t $repo
+
+    for bin in dkl dls; do
     curl --user $(jq '.auths["novit.tech"].auth' ~/.docker/config.json -r |base64 -d) \
-        --upload-file <(docker run --rm --platform $pf $repo cat /bin/dkl) \
-        https://novit.tech/api/packages/direktil/generic/dkl/$tag/dkl.$arch
+        --upload-file <(docker run --rm --platform $pf $repo cat /bin/$bin) \
+        https://novit.tech/api/packages/direktil/generic/dkl/$tag/$bin.$arch
+    done
 }
 
 publish x86_64 linux/amd64

src/apply.rs

@@ -1,12 +1,20 @@
-use eyre::Result;
+use eyre::{Result, format_err, eyre};
 use log::info;
 use std::path::Path;
 use tokio::fs;
 
-use crate::base64_decode;
+use crate::File;
 
-pub async fn files(files: &[crate::File], root: &str, dry_run: bool) -> Result<()> {
-    for file in files {
+pub async fn files(files: &[File], root: &str, dry_run: bool) -> Result<()> {
+    for f in files {
+        if let Err(e) = file(f, root, dry_run).await {
+            return Err(format_err!("{}: {e}", f.path));
+        }
+    }
+    Ok(())
+}
+
+pub async fn file(file: &File, root: &str, dry_run: bool) -> Result<()> {
     let path = chroot(root, &file.path);
     let path = Path::new(&path);
 
@@ -14,78 +22,49 @@ pub async fn files(files: &[crate::File], root: &str, dry_run: bool) -> Result<(
         fs::create_dir_all(parent).await?;
     }
 
-        use crate::{FileKind as K, FilePart as P};
-        match &file.kind {
-            K::Content(content) => {
+    let kind = file.kind();
+    let content = kind.content()?;
+
+    use crate::FileKind as K;
+    match kind.as_ref() {
+        K::Skip => {
+            info!("{}: kind is skip", file.path);
+            return Ok(());
+        }
+        K::Content(_) | K::Content64(_) | K::Parts(_) => {
+            let content = content.expect("this file kind should have content");
             if dry_run {
-                    info!(
-                        "would create {} ({} bytes from content)",
-                        file.path,
-                        content.len()
-                    );
+                info!("would create {} ({} bytes)", file.path, content.len());
             } else {
-                    fs::write(path, content.as_bytes()).await?;
+                fs::write(path, &content).await.map_err(|e| eyre!("write {}: {e}", path.display()))?;
             }
         }
-            K::Content64(content) => {
-                let content = base64_decode(content)?;
-                if dry_run {
-                    info!(
-                        "would create {} ({} bytes from content64)",
-                        file.path,
-                        content.len()
-                    );
-                } else {
-                    fs::write(path, content).await?
-                }
-            }
-            K::Parts(parts) => {
-                let mut assembly = Vec::new();
-                for part in parts {
-                    match part {
-                        P::Content(content) => assembly.extend(content.as_bytes()),
-                        P::Content64(content) => assembly.extend(base64_decode(content)?),
-                    }
-                }
-                if dry_run {
-                    info!(
-                        "would create {} ({} bytes from parts)",
-                        file.path,
-                        assembly.len()
-                    );
-                } else {
-                    fs::write(path, assembly).await?
-                }
-            }
-            K::Dir(true) => {
+        K::Dir => {
             if dry_run {
                 info!("would create {} (directory)", file.path);
             } else {
-                    fs::create_dir(path).await?;
+                fs::create_dir(path).await.map_err(|e| eyre!("create dir {}: {e}", path.display()))?;
             }
         }
-            K::Dir(false) => {} // shouldn't happen, but semantic is to ignore
         K::Symlink(tgt) => {
             if dry_run {
                 info!("would create {} (symlink to {})", file.path, tgt);
             } else {
-                    fs::symlink(tgt, path).await?;
+                let _ = fs::remove_file(path).await; // we're ln --force
+                fs::symlink(tgt, path).await.map_err(|e| eyre!("symlink {} -> {tgt}: {e}", path.display()))?;
             }
         }
     }
 
     if dry_run {
-            continue;
+        return Ok(());
     }
 
-        match file.kind {
-            K::Symlink(_) => {}
-            _ => set_perms(path, file.mode).await?,
+    if !file.is_symlink() {
+        set_perms(path, file.mode).await?;
     }
 
     info!("created {}", file.path);
-    }
-
     Ok(())
 }
 

src/bin/dkl.rs

@@ -1,5 +1,5 @@
 use clap::{CommandFactory, Parser, Subcommand};
-use eyre::{format_err, Result};
+use eyre::{Result, format_err};
 use human_units::Duration;
 use log::{debug, error};
 use std::net::SocketAddr;

src/bin/dls.rs

@@ -3,6 +3,7 @@ use clap::{CommandFactory, Parser, Subcommand};
 use eyre::format_err;
 use futures_util::Stream;
 use futures_util::StreamExt;
+use std::path::PathBuf;
 use std::time::{Duration, SystemTime};
 use tokio::fs;
 use tokio::io::{AsyncWrite, AsyncWriteExt};
@@ -21,6 +22,8 @@ struct Cli {
 
 #[derive(Subcommand)]
 enum Command {
+    #[command(subcommand)]
+    Config(Config),
     Clusters,
     Cluster {
         cluster: String,
@@ -40,6 +43,16 @@ enum Command {
     Hash {
         salt: String,
     },
+    Store {
+        store_path: PathBuf,
+        #[command(subcommand)]
+        op: StoreOp,
+    },
+}
+
+#[derive(Subcommand)]
+enum Config {
+    Upload { config_path: PathBuf },
 }
 
 #[derive(Subcommand)]
@@ -71,6 +84,10 @@ enum ClusterCommand {
         #[arg(default_value = "cluster")]
         name: String,
     },
+    SetCaCert {
+        ca: String,
+        cert_path: PathBuf,
+    },
     Token {
         #[arg(default_value = "admin")]
         name: String,
@@ -96,6 +113,12 @@ enum ClusterCommand {
     },
 }
 
+#[derive(Subcommand)]
+enum StoreOp {
+    Get { data_path: PathBuf },
+    Set { data_path: PathBuf, value: String },
+}
+
 #[tokio::main(flavor = "current_thread")]
 async fn main() -> eyre::Result<()> {
     clap_complete::CompleteEnv::with_factory(Cli::command).complete();
@@ -119,18 +142,26 @@ async fn main() -> eyre::Result<()> {
             let dls = dls();
             let cluster = dls.cluster(cluster);
 
+            let Some(command) = command else {
+                write_json(&cluster.config().await?);
+                return Ok(());
+            };
+
             use ClusterCommand as CC;
             match command {
-                None => write_json(&cluster.config().await?),
-                Some(CC::CaCert { name }) => write_raw(&cluster.ca_cert(&name).await?),
-                Some(CC::Token { name }) => println!("{}", &cluster.token(&name).await?),
-                Some(CC::Addons) => write_raw(&cluster.addons().await?),
-                Some(CC::SshSign {
+                CC::CaCert { name } => write_raw(&cluster.ca_cert(&name).await?),
+                CC::SetCaCert { ca, cert_path } => {
+                    let cert = tokio::fs::read(cert_path).await?;
+                    cluster.set_ca_cert(&ca, cert).await?;
+                }
+                CC::Token { name } => println!("{}", &cluster.token(&name).await?),
+                CC::Addons => write_raw(&cluster.addons().await?),
+                CC::SshSign {
                     user_public_key,
                     principal,
                     validity,
                     options,
-                }) => {
+                } => {
                     let pub_key = tokio::fs::read_to_string(user_public_key).await?;
                     let cert = cluster
                         .ssh_userca_sign(&dls::SshSignReq {
@@ -142,12 +173,12 @@ async fn main() -> eyre::Result<()> {
                         .await?;
                     write_raw(&cert);
                 }
-                Some(CC::KubeSign {
+                CC::KubeSign {
                     csr,
                     user,
                     group,
                     validity,
-                }) => {
+                } => {
                     let csr = tokio::fs::read_to_string(csr).await?;
                     let cert = cluster
                         .kube_sign(&dls::KubeSignReq {
@@ -231,6 +262,29 @@ async fn main() -> eyre::Result<()> {
             println!("hash (hex):    {}", hex::encode(&hash));
             println!("hash (base64): {}", dkl::base64_encode(&hash));
         }
+        C::Store { store_path, op } => {
+            let mut s = dls::store::Store::new(store_path);
+            s.unlock(&std::env::var("DLS_STORE_PW").unwrap()).await?;
+
+            match op {
+                StoreOp::Get { data_path } => {
+                    let mut data = std::io::Cursor::new(s.read(data_path).await?);
+                    tokio::io::copy(&mut data, &mut tokio::io::stdout()).await?;
+                }
+                StoreOp::Set { data_path, value } => s.write(data_path, value.as_bytes()).await?,
+            }
+        }
+        C::Config(cmd) => match cmd {
+            Config::Upload { config_path } => {
+                let cfg = fs::read(&config_path).await?;
+                let cfg: dls::Config = if config_path.ends_with(".yaml") {
+                    serde_yaml::from_slice(&cfg)?
+                } else {
+                    serde_json::from_slice(&cfg)?
+                };
+                dls().upload_config(&cfg).await?;
+            }
+        },
     };
 
     Ok(())

src/cgroup.rs

@@ -64,8 +64,8 @@ pub async fn ls(
     }
 
     use tabled::settings::{
-        object::{Column, Row},
         Alignment, Modify,
+        object::{Column, Row},
     };
     let mut table = table.build();
     table.with(tabled::settings::Style::psql());

src/dls.rs

@@ -23,6 +23,18 @@ impl Client {
         }
     }
 
+    pub fn new_with_http_client(
+        base_url: String,
+        token: String,
+        http_client: reqwest::Client,
+    ) -> Self {
+        Self {
+            base_url,
+            token,
+            http_client,
+        }
+    }
+
     pub fn with_proxy(self, proxy: String) -> reqwest::Result<Self> {
         let proxy = reqwest::Proxy::all(proxy)?;
         Ok(Self {
@@ -65,6 +77,15 @@ impl Client {
         Ok(resp.bytes_stream())
     }
 
+    pub async fn upload_config(&self, config: &Config) -> Result<()> {
+        do_req(self.req(Method::POST, "configs")?.json(config), &self.token).await?;
+        Ok(())
+    }
+
+    pub async fn get_config(&self) -> Result<Config> {
+        self.get_json("config").await
+    }
+
     pub async fn get_json<T: serde::de::DeserializeOwned>(&self, path: impl Display) -> Result<T> {
         self.req_json(self.get(&path)?).await
     }
@@ -133,6 +154,18 @@ impl<'t> Cluster<'t> {
         Ok(resp.bytes().await.map_err(Error::Read)?.to_vec())
     }
 
+    pub async fn set_ca_cert(&self, ca: &str, cert: Vec<u8>) -> Result<()> {
+        let req = self.dls.req(
+            Method::PUT,
+            format!("clusters/{}/CAs/{ca}/certificate", self.name),
+        )?;
+        let req = req
+            .body(cert)
+            .header("Content-Type", "application/x-x509-ca-cert");
+        do_req(req, &self.dls.token).await?;
+        Ok(())
+    }
+
     pub async fn kube_sign(&self, sign_req: &KubeSignReq) -> Result<Vec<u8>> {
         let req = (self.dls).req(Method::POST, format!("clusters/{}/kube/sign", self.name))?;
         let req = req.json(sign_req);
@@ -154,7 +187,7 @@ impl<'t> Host<'t> {
     pub async fn asset(
         &self,
         asset_name: &str,
-    ) -> Result<impl Stream<Item = reqwest::Result<Bytes>>> {
+    ) -> Result<impl Stream<Item = reqwest::Result<Bytes>> + use<>> {
         let req = self.dls.get(format!("hosts/{}/{asset_name}", self.name))?;
         let resp = do_req(req, &self.dls.token).await?;
         Ok(resp.bytes_stream())
@@ -162,17 +195,23 @@ impl<'t> Host<'t> {
 }
 
 #[derive(Default, serde::Deserialize, serde::Serialize)]
-#[serde(rename_all = "PascalCase")]
+#[serde(default, rename_all = "PascalCase")]
 pub struct Config {
-    #[serde(default, deserialize_with = "deserialize_null_as_default")]
+    #[serde(deserialize_with = "deserialize_null_as_default", alias = "clusters")]
     pub clusters: Vec<ClusterConfig>,
-    #[serde(default, deserialize_with = "deserialize_null_as_default")]
+    #[serde(deserialize_with = "deserialize_null_as_default", alias = "hosts")]
     pub hosts: Vec<HostConfig>,
-    #[serde(default, deserialize_with = "deserialize_null_as_default")]
+    #[serde(
+        deserialize_with = "deserialize_null_as_default",
+        alias = "hosttemplates"
+    )]
     pub host_templates: Vec<HostConfig>,
-    #[serde(default, rename = "SSLConfig")]
+    #[serde(default, rename = "SSLConfig", alias = "sslconfig")]
     pub ssl_config: String,
-    #[serde(default, deserialize_with = "deserialize_null_as_default")]
+    #[serde(
+        deserialize_with = "deserialize_null_as_default",
+        alias = "extracacerts"
+    )]
     pub extra_ca_certs: Map<String, String>,
 }
 
@@ -190,40 +229,58 @@ where
 #[derive(serde::Deserialize, serde::Serialize)]
 #[serde(rename_all = "PascalCase")]
 pub struct ClusterConfig {
+    #[serde(alias = "name")]
     pub name: String,
+    #[serde(alias = "bootstrappods")]
     pub bootstrap_pods: String,
+    #[serde(alias = "addons")]
     pub addons: String,
 }
 
 #[derive(Default, serde::Deserialize, serde::Serialize)]
 #[serde(rename_all = "PascalCase")]
 pub struct HostConfig {
+    #[serde(alias = "name")]
     pub name: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[serde(
+        default,
+        skip_serializing_if = "Option::is_none",
+        alias = "cluster_name",
+        alias = "clustername"
+    )]
     pub cluster_name: Option<String>,
 
-    #[serde(rename = "IPs")]
+    #[serde(rename = "IPs", alias = "ips")]
     pub ips: Vec<IpAddr>,
 
-    #[serde(default, skip_serializing_if = "Map::is_empty")]
+    #[serde(default, skip_serializing_if = "Map::is_empty", alias = "labels")]
     pub labels: Map<String, String>,
-    #[serde(default, skip_serializing_if = "Map::is_empty")]
+    #[serde(default, skip_serializing_if = "Map::is_empty", alias = "annotations")]
     pub annotations: Map<String, String>,
 
-    #[serde(rename = "IPXE", skip_serializing_if = "Option::is_none")]
+    #[serde(
+        rename = "IPXE",
+        skip_serializing_if = "Option::is_none",
+        alias = "ipxe"
+    )]
     pub ipxe: Option<String>,
 
+    #[serde(alias = "initrd")]
     pub initrd: String,
+    #[serde(alias = "kernel")]
     pub kernel: String,
+    #[serde(alias = "versions")]
     pub versions: Map<String, String>,
 
     /// initrd config template
+    #[serde(alias = "bootstrapconfig")]
     pub bootstrap_config: String,
     /// files to add to the final initrd config, with rendering
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    #[serde(default, skip_serializing_if = "Vec::is_empty", alias = "initrdfiles")]
     pub initrd_files: Vec<crate::File>,
 
     /// system config template
+    #[serde(alias = "config")]
     pub config: String,
 }
 

src/dls/store.rs

@@ -1,4 +1,13 @@
-pub fn hash_password(salt: &[u8], passphrase: &str) -> argon2::Result<[u8; 32]> {
+use openssl::symm::Mode;
+use std::borrow::Cow;
+use std::path::{Path, PathBuf};
+use tokio::{fs, io::AsyncWriteExt};
+
+pub type Salt = [u8; 16];
+pub type Key = [u8; 32];
+pub type Hash = Vec<u8>;
+
+pub fn hash_password(salt: &[u8], passphrase: &str) -> Result<Key> {
     let hash = argon2::hash_raw(
         passphrase.as_bytes(),
         salt,
@@ -6,12 +15,191 @@ pub fn hash_password(salt: &[u8], passphrase: &str) -> argon2::Result<[u8; 32]>
             variant: argon2::Variant::Argon2id,
             hash_length: 32,
             time_cost: 1,
-            mem_cost: 65536,
+            mem_cost: 64 << 10,
             thread_mode: argon2::ThreadMode::Parallel,
             lanes: 4,
             ..Default::default()
         },
-    )?;
+    )
+    .map_err(Error::Hash)?;
 
-    unsafe { Ok(hash.try_into().unwrap_unchecked()) }
+    Ok(hash.try_into().unwrap())
+}
+
+pub struct Store {
+    path: PathBuf,
+    key: Option<Key>,
+}
+
+impl Store {
+    pub fn new(path: impl Into<PathBuf>) -> Self {
+        Self {
+            path: path.into(),
+            key: None,
+        }
+    }
+
+    pub async fn unlock(&mut self, passphrase: &str) -> Result<()> {
+        let keys = self.read_keys().await?;
+
+        let salt = keys.salt;
+
+        let user_key = hash_password(&salt, passphrase)?;
+        let user_hash = openssl::sha::sha512(&user_key);
+
+        for nk in keys.keys {
+            if nk.hash != user_hash {
+                continue;
+            }
+
+            // build iv+data from salt
+            let mut enc_data = Vec::with_capacity(salt.len() + nk.enc_key.len());
+            enc_data.extend_from_slice(&salt);
+            enc_data.extend_from_slice(&nk.enc_key);
+
+            let key = crypt(&enc_data, &user_key, Mode::Decrypt)?;
+            let key = key.try_into().map_err(|_| Error::InvalidKey)?;
+
+            self.key = Some(key);
+            return Ok(());
+        }
+
+        Err(Error::KeyNotFound)
+    }
+
+    pub async fn read(&self, path: impl AsRef<Path>) -> Result<Vec<u8>> {
+        let enc_data = self.read_file(path.as_ref().with_extension("data")).await?;
+        self.decrypt(&enc_data)
+    }
+    pub async fn read_to_string(&self, path: impl AsRef<Path>) -> Result<String> {
+        let path = path.as_ref();
+        String::from_utf8(self.read(path).await?).map_err(|_| Error::InvalidUtf8(path.into()))
+    }
+
+    pub async fn write(&self, path: impl AsRef<Path>, data: &[u8]) -> Result<()> {
+        let enc_data = self.encrypt(data)?;
+        safe_write(self.path.join(&path).with_extension("data"), &enc_data).await
+    }
+
+    async fn read_keys(&self) -> Result<Keys<'_>> {
+        let keys = self.read_file(".keys").await?;
+        let Some(keys) = keys.strip_prefix(b"{json}") else {
+            return Err(Error::InvalidKeys);
+        };
+
+        serde_json::from_slice(keys).map_err(Error::KeysParse)
+    }
+
+    async fn read_file(&self, subpath: impl AsRef<Path>) -> Result<Vec<u8>> {
+        let path = self.path.join(subpath);
+        fs::read(&path).await.map_err(|e| Error::Read(path, e))
+    }
+
+    fn encrypt(&self, src: &[u8]) -> Result<Vec<u8>> {
+        self.crypt(src, Mode::Encrypt)
+    }
+    fn decrypt(&self, src: &[u8]) -> Result<Vec<u8>> {
+        self.crypt(src, Mode::Decrypt)
+    }
+    fn crypt(&self, src: &[u8], mode: Mode) -> Result<Vec<u8>> {
+        let key = self.key.as_ref().ok_or(Error::NotUnlocked)?;
+        crypt(src, key, mode)
+    }
+}
+
+async fn safe_write(path: impl AsRef<Path>, contents: &[u8]) -> Result<()> {
+    let path = path.as_ref();
+    let tmp = path.with_added_extension("new");
+
+    let tmp_err = |e| Error::Write(tmp.clone(), e);
+
+    let mut file = fs::OpenOptions::new()
+        .create(true)
+        .truncate(true)
+        .write(true)
+        .open(&tmp)
+        .await
+        .map_err(tmp_err)?;
+
+    file.write_all(contents).await.map_err(tmp_err)?;
+    file.sync_all().await.map_err(tmp_err)?;
+    file.shutdown().await.map_err(tmp_err)?;
+
+    fs::rename(tmp, &path)
+        .await
+        .map_err(|e| Error::Write(path.into(), e))
+}
+
+fn crypt(mut src: &[u8], key: &Key, mode: Mode) -> Result<Vec<u8>> {
+    use openssl::symm::{Cipher, Crypter};
+
+    let mut iv = [0u8; 16];
+    let mut dst: Vec<u8>;
+    let crypt_dst: &mut [u8];
+
+    match mode {
+        Mode::Encrypt => {
+            getrandom::fill(&mut iv).unwrap();
+            dst = vec![0u8; iv.len() + src.len()];
+            dst[..iv.len()].copy_from_slice(&iv);
+            crypt_dst = &mut dst[iv.len()..];
+        }
+        Mode::Decrypt => {
+            iv = src[..iv.len()]
+                .try_into()
+                .map_err(|_| Error::DecryptInputToSmall)?;
+            src = &src[iv.len()..];
+            dst = vec![0u8; src.len()];
+            crypt_dst = &mut dst;
+        }
+    }
+
+    let cipher = Cipher::aes_256_cfb128();
+    Crypter::new(cipher, mode, key, Some(&iv))
+        .expect("Failed to init AES")
+        .update(src, crypt_dst)
+        .expect("AES CFB encrypt/decrypt failed");
+
+    Ok(dst)
+}
+
+pub type Result<T> = std::result::Result<T, Error>;
+
+#[derive(Debug, thiserror::Error)]
+pub enum Error {
+    #[error("hash error: {0}")]
+    Hash(argon2::Error),
+    #[error("read {0} failed: {1}")]
+    Read(PathBuf, std::io::Error),
+    #[error("write {0} failed: {1}")]
+    Write(PathBuf, std::io::Error),
+    #[error("read {0} failed: invalid UTF-8")]
+    InvalidUtf8(PathBuf),
+    #[error("invalid keys data")]
+    InvalidKeys,
+    #[error("invalid key")]
+    InvalidKey,
+    #[error("keys parse error: {0}")]
+    KeysParse(serde_json::Error),
+    #[error("key not found")]
+    KeyNotFound,
+    #[error("store not unlocked")]
+    NotUnlocked,
+    #[error("decrypt input too small")]
+    DecryptInputToSmall,
+}
+
+#[derive(Clone, Debug, serde::Serialize, serde::Deserialize)]
+#[serde(rename_all = "PascalCase")]
+struct Keys<'t> {
+    salt: Salt,
+    keys: Vec<NamedKey<'t>>,
+}
+
+#[derive(Clone, Debug, serde::Serialize, serde::Deserialize)]
+#[serde(rename_all = "PascalCase")]
+struct NamedKey<'t> {
+    name: Cow<'t, str>,
+    hash: Hash,
+    enc_key: Key,
 }

src/dynlay.rs

@@ -1,4 +1,4 @@
-use eyre::{format_err, Result};
+use eyre::{Result, format_err};
 use log::{debug, error, info, warn};
 use std::path::PathBuf;
 use tokio::{fs, io::AsyncWriteExt, process::Command};

src/lib.rs

@@ -1,3 +1,5 @@
+use std::borrow::Cow;
+
 pub mod apply;
 pub mod bootstrap;
 pub mod cgroup;
@@ -9,7 +11,7 @@ pub mod logger;
 pub mod proxy;
 pub mod rc;
 
-#[derive(Debug, Default, serde::Deserialize, serde::Serialize)]
+#[derive(Debug, Default, Clone, serde::Deserialize, serde::Serialize)]
 pub struct Config {
     pub layers: Vec<String>,
     pub root_user: RootUser,
@@ -23,14 +25,14 @@ pub struct Config {
     pub users: Vec<User>,
 }
 
-#[derive(Debug, Default, serde::Deserialize, serde::Serialize)]
+#[derive(Debug, Default, Clone, serde::Deserialize, serde::Serialize)]
 pub struct RootUser {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub password_hash: Option<String>,
     pub authorized_keys: Vec<String>,
 }
 
-#[derive(Debug, Default, serde::Deserialize, serde::Serialize)]
+#[derive(Debug, Default, Clone, serde::Deserialize, serde::Serialize)]
 pub struct Mount {
     pub dev: String,
     pub path: String,
@@ -40,14 +42,14 @@ pub struct Mount {
     pub options: Option<String>,
 }
 
-#[derive(Debug, serde::Deserialize, serde::Serialize)]
+#[derive(Debug, Clone, serde::Deserialize, serde::Serialize)]
 pub struct Group {
     pub name: String,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub gid: Option<u32>,
 }
 
-#[derive(Debug, serde::Deserialize, serde::Serialize)]
+#[derive(Debug, Clone, serde::Deserialize, serde::Serialize)]
 pub struct User {
     pub name: String,
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -56,26 +58,41 @@ pub struct User {
     pub gid: Option<u32>,
 }
 
-#[derive(Debug, PartialEq, Eq, serde::Deserialize, serde::Serialize)]
+#[derive(Default, Debug, Clone, PartialEq, Eq, serde::Deserialize, serde::Serialize)]
 pub struct File {
     pub path: String,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub mode: Option<u32>,
-    #[serde(flatten)]
-    pub kind: FileKind,
+    pub kind: Option<FileKind>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub content: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub content64: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub symlink: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub parts: Option<Vec<FilePart>>,
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub dir: bool,
 }
 
-#[derive(Debug, PartialEq, Eq, serde::Deserialize, serde::Serialize)]
+fn is_false(b: &bool) -> bool {
+    !b
+}
+
+#[derive(Default, Debug, Clone, PartialEq, Eq, serde::Deserialize, serde::Serialize)]
 #[serde(rename_all = "lowercase")]
 pub enum FileKind {
+    #[default]
+    Skip,
     Content(String),
     Content64(String),
-    Symlink(String),
-    Dir(bool),
     Parts(Vec<FilePart>),
+    Symlink(String),
+    Dir,
 }
 
-#[derive(Debug, PartialEq, Eq, serde::Deserialize, serde::Serialize)]
+#[derive(Debug, Clone, PartialEq, Eq, serde::Deserialize, serde::Serialize)]
 #[serde(rename_all = "lowercase")]
 pub enum FilePart {
     Content(String),
@@ -102,3 +119,63 @@ pub fn base64_encode(b: &[u8]) -> String {
     use base64::{prelude::BASE64_STANDARD as B64, Engine as _};
     B64.encode(b)
 }
+
+impl<'t> File {
+    pub fn kind(&'t self) -> Cow<'t, FileKind> {
+        self.kind.as_ref().map(Cow::Borrowed).unwrap_or_else(|| {
+            use FileKind::*;
+            Cow::Owned(if let Some(ref s) = self.content {
+                Content(s.clone())
+            } else if let Some(ref s) = self.content64 {
+                Content64(s.clone())
+            } else if let Some(ref s) = self.symlink {
+                Symlink(s.clone())
+            } else if let Some(ref p) = self.parts {
+                Parts(p.clone())
+            } else if self.dir {
+                Dir
+            } else {
+                Skip
+            })
+        })
+    }
+
+    pub fn is_symlink(&self) -> bool {
+        if let Some(ref kind) = self.kind {
+            matches!(kind, FileKind::Symlink(_))
+        } else {
+            self.symlink.is_some()
+        }
+    }
+}
+
+impl FileKind {
+    pub fn content<'t>(&'t self) -> Result<Option<Cow<'t, [u8]>>, base64::DecodeError> {
+        use FileKind::*;
+        Ok(match self {
+            Content(content) => Some(Cow::Borrowed(content.as_bytes())),
+            Content64(content) => {
+                let content = base64_decode(content)?;
+                Some(Cow::Owned(content))
+            }
+            Parts(parts) => {
+                let mut assembly = Vec::new();
+                for part in parts {
+                    assembly.extend(part.content()?.into_iter());
+                }
+                Some(Cow::Owned(assembly))
+            }
+            _ => None,
+        })
+    }
+}
+
+impl FilePart {
+    pub fn content(&self) -> Result<Cow<'_, [u8]>, base64::DecodeError> {
+        use FilePart::*;
+        Ok(match self {
+            Content(content) => Cow::Borrowed(content.as_bytes()),
+            Content64(content) => Cow::Owned(base64_decode(content)?),
+        })
+    }
+}

src/logger.rs

@@ -1,6 +1,6 @@
 use async_compression::tokio::write::{ZstdDecoder, ZstdEncoder};
 use chrono::{DurationRound, TimeDelta, Utc};
-use eyre::{format_err, Result};
+use eyre::{Result, format_err};
 use log::{debug, error, warn};
 use std::ffi::OsStr;
 use std::path::{Path, PathBuf};
@@ -10,7 +10,7 @@ use tokio::{
     io::{self, AsyncBufReadExt, AsyncRead, AsyncWrite, AsyncWriteExt, BufReader, BufWriter},
     process::{Child, Command},
     sync::mpsc,
-    time::{sleep, Duration},
+    time::{Duration, sleep},
 };
 
 use crate::{cgroup, fs};
@@ -220,7 +220,7 @@ impl Logger {
 
 fn forward_signals_to(pid: i32) {
     use nix::{
-        sys::signal::{kill, Signal},
+        sys::signal::{Signal, kill},
         unistd::Pid,
     };
     use signal_hook::{consts::*, low_level::register};

src/rc.rs

@@ -5,9 +5,9 @@ use std::collections::{BTreeMap as Map, BTreeSet as Set};
 use std::path::PathBuf;
 use std::sync::LazyLock;
 use tokio::{
-    io::{copy, AsyncBufReadExt, AsyncReadExt, AsyncWriteExt, BufReader},
+    io::{AsyncBufReadExt, AsyncReadExt, AsyncWriteExt, BufReader, copy},
     net::{UnixListener, UnixStream},
-    sync::{mpsc, watch, RwLock},
+    sync::{RwLock, mpsc, watch},
 };
 
 use crate::{cgroup, fs};
@@ -117,7 +117,7 @@ where
             std::process::exit(0);
         }
         Err(e) => {
-            eprint!("{e}");
+            eprintln!("{e}");
             std::process::exit(1);
         }
     }
@@ -185,7 +185,7 @@ async fn handle(mut conn: UnixStream) {
 }
 
 async fn wait_terminate() {
-    use tokio::signal::unix::{signal, SignalKind};
+    use tokio::signal::unix::{SignalKind, signal};
     let Ok(mut sig) = signal(SignalKind::terminate())
         .inspect_err(|e| error!("failed to listen to SIGTERM (will be ignored): {e}"))
     else {
@@ -203,7 +203,7 @@ async fn wait_terminate() {
 }
 
 async fn wait_reload() {
-    use tokio::signal::unix::{signal, SignalKind};
+    use tokio::signal::unix::{SignalKind, signal};
     let Ok(mut sig) = signal(SignalKind::hangup())
         .inspect_err(|e| error!("failed to listen to SIGHUP (will be ignored): {e}"))
     else {

src/rc/runner.rs

@@ -1,13 +1,13 @@
 use log::{error, warn};
 use nix::{
-    sys::signal::{kill, Signal},
+    sys::signal::{Signal, kill},
     unistd::Pid,
 };
 use std::num::NonZero;
 use tokio::{
     process, select,
     sync::{mpsc, watch},
-    time::{sleep, sleep_until, Duration, Instant},
+    time::{Duration, Instant, sleep, sleep_until},
 };
 
 use super::{Error, Result, Service};