1
0

Compare commits

..

No commits in common. "3cf2308bee15bfe88126832720f18f9da56e786f" and "0df2c83382f98eed7717cecdbbc6d12e5fef2202" have entirely different histories.

11 changed files with 57 additions and 80 deletions

View File

@ -50,8 +50,9 @@ let
exec ${hostapd}/bin/hostapd -i $(output ${interface} ifname) -P /run/${name}/hostapd.pid -S /run/${name}/hostapd.conf exec ${hostapd}/bin/hostapd -i $(output ${interface} ifname) -P /run/${name}/hostapd.pid -S /run/${name}/hostapd.conf
''; '';
}; };
watch = filter (f: typeOf f == "lambda") (attrValues attrs); watch = filter (f: typeOf f == "set") (attrValues attrs);
in svc.secrets.subscriber.build { in svc.secrets.subscriber.build {
inherit service watch; inherit watch;
inherit service;
action = "restart-all"; action = "restart-all";
} }

View File

@ -1,7 +1,6 @@
{ {
liminix liminix
, lib , lib
, svc
, output-template , output-template
, writeAshScript , writeAshScript
, writeText , writeText
@ -79,7 +78,8 @@ let
max redials = 2 # this gives 1 actual retry, as xl2tpd can't count max redials = 2 # this gives 1 actual retry, as xl2tpd can't count
''; '';
control = "/run/${name}/control"; control = "/run/${name}/control";
service = longrun { in
longrun {
inherit name; inherit name;
run = '' run = ''
mkdir -p /run/${name} mkdir -p /run/${name}
@ -90,8 +90,4 @@ let
exec ${xl2tpd}/bin/xl2tpd -D -p /run/${name}/${name}.pid -c ${conf} -C ${control} exec ${xl2tpd}/bin/xl2tpd -D -p /run/${name}/${name}.pid -c ${conf} -C ${control}
''; '';
notification-fd = 10; notification-fd = 10;
};
in svc.secrets.subscriber.build {
watch = [ username password ];
inherit service;
} }

View File

@ -1,6 +1,5 @@
{ {
liminix liminix
, svc
, lib , lib
, output-template , output-template
, ppp , ppp
@ -67,7 +66,8 @@ let
"logfd" "2" "logfd" "2"
]; ];
timeoutOpt = if lcpEcho.interval != null then "-T ${builtins.toString (4 * lcpEcho.interval)}" else ""; timeoutOpt = if lcpEcho.interval != null then "-T ${builtins.toString (4 * lcpEcho.interval)}" else "";
service = longrun { in
longrun {
inherit name; inherit name;
run = '' run = ''
mkdir -p /run/${name} mkdir -p /run/${name}
@ -81,9 +81,4 @@ let
then (10 + lcpEcho.failure * lcpEcho.interval) * 1000 then (10 + lcpEcho.failure * lcpEcho.interval) * 1000
else 60 * 1000; else 60 * 1000;
dependencies = [ interface ]; dependencies = [ interface ];
};
in svc.secrets.subscriber.build {
watch = [ username password ];
inherit service;
action = "restart-all";
} }

View File

@ -66,7 +66,7 @@ in {
subscriber = config.system.callService ./subscriber.nix { subscriber = config.system.callService ./subscriber.nix {
watch = mkOption { watch = mkOption {
description = "secrets paths to subscribe to"; description = "secrets paths to subscribe to";
type = types.listOf (types.functionTo types.anything); type = types.listOf types.attrs;
}; };
service = mkOption { service = mkOption {
description = "subscribing service that will receive notification"; description = "subscribing service that will receive notification";

View File

@ -8,8 +8,8 @@ let
inherit (lib) unique optional; inherit (lib) unique optional;
inherit (service) name; inherit (service) name;
watched-services = unique (map (f: f "service") watch); watched-services = unique (map (f: f.service) watch);
paths = unique (map (f: f "path") watch); paths = unique (map (f: f.path) watch);
restart-flag = { restart-flag = {
restart = "-r"; restart = "-r";

View File

@ -127,4 +127,5 @@ in {
writeAshScript = callPackage ./write-ash-script { }; writeAshScript = callPackage ./write-ash-script { };
writeAshScriptBin = callPackage ./write-ash-script/bin.nix { }; writeAshScriptBin = callPackage ./write-ash-script/bin.nix { };
writeFennel = callPackage ./write-fennel { }; writeFennel = callPackage ./write-fennel { };
writeFennelScript = callPackage ./write-fennel-script { };
} }

View File

@ -1,14 +1,15 @@
{ {
netlink-lua, netlink-lua,
writeFennel, writeFennelScript,
runCommand, runCommand,
anoia, anoia,
}: }:
runCommand "ifwait" { } '' runCommand "ifwait" { } ''
mkdir -p $out/bin mkdir -p $out/bin
cp -p ${ cp -p ${
writeFennel "ifwait" { writeFennelScript "ifwait" [
packages = [ anoia netlink-lua ]; anoia
} ./ifwait.fnl netlink-lua
] ./ifwait.fnl
} $out/bin/ifwait } $out/bin/ifwait
'' ''

View File

@ -1,8 +1,6 @@
{ {
writeFennel, writeFennelScript,
anoia, anoia,
lualinux, lualinux,
}: }:
writeFennel "odhcpc-script" { writeFennelScript "odhcpc-script" [anoia lualinux] ./odhcp6-script.fnl
packages = [anoia lualinux];
} ./odhcp6-script.fnl

View File

@ -6,7 +6,7 @@
{ {
writeText, writeText,
writeFennel, writeFennelScript,
lib, lib,
s6-init-bin, s6-init-bin,
closureInfo, closureInfo,
@ -81,7 +81,7 @@ in attrset:
cp $closure/store-paths $out/etc/nix-store-paths cp $closure/store-paths $out/etc/nix-store-paths
$STRIP --remove-section=.note --remove-section=.comment --strip-all makedevs -o $out/bin/activate $STRIP --remove-section=.note --remove-section=.comment --strip-all makedevs -o $out/bin/activate
ln -s ${s6-init-bin}/bin/init $out/bin/init ln -s ${s6-init-bin}/bin/init $out/bin/init
cp -p ${writeFennel "restart-services" {} ./restart-services.fnl} $out/bin/restart-services cp -p ${writeFennelScript "restart-services" [] ./restart-services.fnl} $out/bin/restart-services
cat > $out/bin/install <<EOF cat > $out/bin/install <<EOF
#!/bin/sh -e #!/bin/sh -e
prefix=\''${1-/} prefix=\''${1-/}

View File

@ -90,20 +90,11 @@
})) }))
(fn http-post [url body] (fn http-post [url body]
(match (json.decode
(http.request "POST" url (http.request "POST" url
"" 0 "" 0
"application/x-www-form-urlencoded" "application/x-www-form-urlencoded"
body) body)))
s (json.decode s)
(nil err) (error err)))
(fn http-get [url body]
(match
(http.fetch url)
s (json.decode s)
(nil code msg) (error (.. "Error: " code ": " msg))))
(fn decrypt [] (fn decrypt []
(let [b64 (base64 :url) (let [b64 (base64 :url)
@ -121,7 +112,7 @@
jwk (jwk-exc-noi rep tmp)] jwk (jwk-exc-noi rep tmp)]
(print (jwe-dec jwk ph undigested))))) (print (jwe-dec jwk ph undigested)))))
(fn perform-encryption [jwks url input] (fn perform-encryption [jwks url]
(let [enc (jose! [:jwk :use "-i-" "-r" "-u" "deriveKey" "-o-"] (let [enc (jose! [:jwk :use "-i-" "-r" "-u" "deriveKey" "-o-"]
(json.encode jwks)) (json.encode jwks))
;; adding a -s to jwk use will "Always output a JWKSet" which ;; adding a -s to jwk use will "Always output a JWKSet" which
@ -140,7 +131,8 @@
:clevis {:pin "tang" :clevis {:pin "tang"
:tang {:url url :adv jwks }}}}] :tang {:url url :adv jwks }}}}]
(josep! [:jwe :enc "-i-" "-k-" "-I-" "-c"] (josep! [:jwe :enc "-i-" "-k-" "-I-" "-c"]
(.. (json.encode jwe) (json.encode jwk) input))))) (.. (json.encode jwe) (json.encode jwk)
(: (io.input) :read "*a"))))))
(fn usage [] (fn usage []
(print "tangc\n=====\n") (print "tangc\n=====\n")
@ -149,30 +141,23 @@
(json.encode {:url "http://tang.local"}))) (json.encode {:url "http://tang.local"})))
(print (%% "tangc encrypt %q < plaintext > filename.enc # encrypt" (print (%% "tangc encrypt %q < plaintext > filename.enc # encrypt"
(json.encode {:thp "idGFpbiBhIHByZWJ1aWx0IGRhdGFiYXNlIGZyb20gaH" (json.encode {:thp "idGFpbiBhIHByZWJ1aWx0IGRhdGFiYXNlIGZyb20gaH"
:url "http://tang.local"}))) :url "http://tang.local"}))))
(os.exit 1))
(fn encrypt [cfg] (fn encrypt [cfg]
(let [{ : url : thp : adv } cfg (let [{ : url : thp : adv } cfg
_ (or url (usage))
raw-input (: (io.input) :read "*a")
b64 (base64 :url) b64 (base64 :url)
adv (or adv (http-get (.. url "/adv/" (or thp ""))))] adv (or adv (json.decode (http.fetch (.. url "/adv/" (or thp "")))))]
(assert adv.payload "advertisement is malformed") (assert adv.payload "advertisement is malformed")
(let [jwks (json.decode (b64:decode adv.payload)) (let [jwks (json.decode (b64:decode adv.payload))
ver (jose! [:jwk :use "-i-" "-r" "-u" "verify" "-o-"] ver (jose! [:jwk :use "-i-" "-r" "-u" "verify" "-o-"]
(json.encode jwks))] (json.encode jwks))]
(match (print (josep! [:jws :ver "-i" (json.encode adv) "-k-" "-a"]
(josep! [:jws :ver "-i" (json.encode adv) "-k-" "-a"] (json.encode ver)) (json.encode ver)))
"" nil
str (error "jws verify of advertised keys failed: " str))
(if (and thp (search-key ver thp)) (if (and thp (search-key ver thp))
(: (io.output) :write (perform-encryption jwks url raw-input)) (print (perform-encryption jwks url))
;; the command line options are currently the same as clevis (print (.. "Thumbrints of advertised keys are listed below. Set the thp attribute to preferred key\n"
;; but unless I can greatly improve this wording, that's gonna change
(print (.. "\ntangc: Thumbprints of advertised keys are listed below. Rerun this command\nproviding the thp attribute to specify the preferred key\n\n"
(josep! [:jwk :thp "-i-" "-a" (. thumbprint-algs 1)] (json.encode ver)))))))) (josep! [:jwk :thp "-i-" "-a" (. thumbprint-algs 1)] (json.encode ver))))))))
@ -180,6 +165,6 @@
(case arg (case arg
["decrypt"] (decrypt) ["decrypt"] (decrypt)
["encrypt" cfg] (encrypt (json.decode cfg)) ["encrypt" cfg] (encrypt (json.decode cfg))
_ (usage))) _ (error "usage: tangc [decrypt] | [encrypt cfg]")))
{ : run } { : run }

View File

@ -5,10 +5,10 @@
let let
overlay = import "${liminix}/overlay.nix"; overlay = import "${liminix}/overlay.nix";
pkgs = import <nixpkgs> { overlays = [overlay]; }; pkgs = import <nixpkgs> { overlays = [overlay]; };
script = pkgs.writeFennel "foo" {} ./hello.fnl; script = pkgs.writeFennelScript "foo" [] ./hello.fnl;
inherit (pkgs.lua.pkgs) fifo; inherit (pkgs.lua.pkgs) fifo;
netlink = pkgs.netlink-lua; netlink = pkgs.netlink-lua;
script2 = pkgs.writeFennel "foo2" { packages = [fifo netlink];} ./hello.fnl; script2 = pkgs.writeFennelScript "foo2" [fifo netlink] ./hello.fnl;
in pkgs.runCommand "check" { in pkgs.runCommand "check" {
} '' } ''
set -e set -e