newedge/liminix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,346 Commits 4 Branches 0 Tags
541b1c61c259c483fbfad66c831bbaed479abaff
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Daniel Barlow 541b1c61c2 ensure $toplevel is path in /nix/store 2024-10-09 18:59:33 +01:00
Daniel Barlow 55c7410a55 add result/install.sh to systemConfiguration output 
this makes it possible to install a systemconfig instead of
having to use nix-shell (which is very slow)
 2024-10-09 13:35:02 +01:00
Daniel Barlow 0f50648157 don't put hostname in levitate logs 
there might not be one
 2024-10-08 22:55:39 +01:00
Daniel Barlow f1c260d4f7 make ci.ni "all" a derivation 
this is to stop hydra complaining
 2024-10-06 18:04:56 +01:00
Daniel Barlow 3d611d3ba2 fix unstable qemu build? 
nix-repl> (lib.versionOlder "24.11pre-git" "24.11")
true

nix-repl> (lib.versionOlder "24.11pre-git" "24.10")
false

n
 2024-10-06 18:04:48 +01:00
Daniel Barlow e6b7d86381 sort lines 2024-10-06 17:53:34 +01:00
Daniel Barlow 83fbffb39b catch another uncaught-logs 2024-10-06 17:53:09 +01:00
Daniel Barlow f8c579b41e add CI "all" target 2024-10-06 17:52:59 +01:00
Daniel Barlow ca9efc4b26 simplify CI 
* I didn't know what I was doing when I set up Hydra

* it's not certain that I do now either, but hey ho
 2024-10-06 15:55:01 +01:00
Daniel Barlow 336fc7e495 think 2024-10-06 14:27:45 +01:00
Daniel Barlow 4cc0add2ad update refs to uncaught-logs in docs/tests 2024-10-06 13:46:14 +01:00
Daniel Barlow 2d7e6188ac log shipping service now gets logs on stdin 
instead of having to open the unix socket
 2024-10-06 13:26:58 +01:00
Daniel Barlow b9999857cb longrun: don't add logger if producer-for is already set 2024-10-06 13:13:04 +01:00
Daniel Barlow ba03ddeb38 border-vm: add tang service 2024-10-06 12:38:06 +01:00
Daniel Barlow 493c5f69d7 add module for certifix-client 2024-10-06 11:27:39 +01:00
Daniel Barlow 1a915e91ff add altname to CSR 2024-10-06 10:13:28 +01:00
Daniel Barlow 197e2eb5b1 new package certifix-client uses certifix to sign ssl client cert 
this is initially for TLS-enabled logging but would be useful for
anything on a liminix box that wants to talk to a network service in a
"zero trust" setup
 2024-10-03 23:00:08 +01:00
Daniel Barlow 7ca822c826 more messing around with lua derivation 2024-10-03 23:00:08 +01:00
Daniel Barlow e5631783e1 add luaossl package with patch for CSR attributes 2024-10-03 23:00:08 +01:00
Daniel Barlow 635590d37a implement log shipping config 
to use this, you need config like for example

+  logging.shipping = {
+    enable = true;
+    service = longrun {
+      name = "ship-logs";
+      run = let path = lib.makeBinPath (with pkgs; [ s6 s6-networking s6 execline ]);
+            in ''
+        PATH=${path}:$PATH
+        s6-ipcserver -1 ${config.logging.shipping.socket} \
+        s6-tcpclient 10.0.2.2 19612 \
+        fdmove -c 1 7 cat
+      '';
+    };
+  };

but I think we can reduce the noise a bit if we use an s6-rc pipeline
with an s6-ipcserver on one side and and a (whatever the user wants)
on the other
 2024-09-18 22:14:34 +01:00
Daniel Barlow 17630f2678 rename logtee->logtap 2024-09-18 20:58:02 +01:00
Daniel Barlow 707a471bc2 add logtee to catchall logger 2024-09-16 21:30:06 +01:00
Daniel Barlow d3fce5edd4 implement error() for musl 2024-09-16 20:35:23 +01:00
Daniel Barlow 5771108fed improve logtee socket connection warning 
* print it less often
* to the correct stream (stdout not stderr)
 2024-09-16 20:34:26 +01:00
Daniel Barlow 9e5f2d663d close socket fd if we can't connect it 2024-09-15 22:09:31 +01:00
Daniel Barlow 21eeb1671e print diagnostic when eof on stderr 2024-09-15 21:59:24 +01:00
Daniel Barlow 44762d38fc write start cookie when socket connect succeeds 2024-09-15 21:54:21 +01:00
Daniel Barlow 1f6cfc3679 extract method is_connected 2024-09-15 21:40:05 +01:00
Daniel Barlow 8ec00f1710 improve error message 2024-09-15 21:37:04 +01:00
Daniel Barlow 6a6dd32dea make pollfd array global 2024-09-15 21:32:48 +01:00
Daniel Barlow 9b1fc11a59 logshipper/logtee :copy stdin to stdout & to a unix socket if present 
first draft
 2024-09-15 19:33:21 +01:00
Daniel Barlow aaa6e353db incz is a very rudimentary log shipper for zinc search 
although it probably would work with elasticsearch as well
as zinc is alleged to be ES-compatible

this is just the package and needs hooking into the service/log
infrastructure somehow
 2024-09-08 16:38:37 +01:00
Daniel Barlow 69bf6cb5fb write-fennel quote PATH properly 
escapeShellArg only quotes if the string contains special
characters, but for a Lua string we must quote unconditionally
 2024-09-07 22:31:44 +01:00
Daniel Barlow 9f58e7b926 maybe fix nixpkgs-unstable lua 2024-09-07 00:58:11 +01:00
Daniel Barlow 5a5c27ab9f think 2024-09-06 22:37:49 +01:00
Daniel Barlow 277c91acdf Revert "remove luaposix ref in write-fennel" 
This reverts commit a60c2539a6.
 2024-09-06 00:33:30 +01:00
Daniel Barlow e0725489ca unbreak pppoe ci job 2024-09-06 00:33:30 +01:00
Daniel Barlow cc47515cf8 watch-outputs remove debug code 2024-09-06 00:13:54 +01:00
Daniel Barlow 464913cc8f tangc use spawn to invoke jose 
hopefully we are now deadlock-free
 2024-09-06 00:12:45 +01:00
Daniel Barlow e604d628e3 fennel anoia.process.spawn 
runs a subprocess and invokes a callback whenever its io
descriptors are ready
 2024-09-06 00:11:33 +01:00
Daniel Barlow e2a597589b anoia.fs.find-executable looks for bin in colon-sep list of directories 2024-09-06 00:08:40 +01:00
Daniel Barlow 6a5fed83dd conditional fetch in json-to-fstree 2024-09-05 11:14:47 +01:00
Daniel Barlow bcf5ab24e8 tidy watch-outputs startup message 2024-09-05 10:11:16 +01:00
Daniel Barlow 32bf80c6fa devout: unlink socket pathname before binding 2024-09-05 10:05:13 +01:00
Daniel Barlow 12275f6896 add more test for table= 2024-09-04 21:21:30 +01:00
Daniel Barlow a60c2539a6 remove luaposix ref in write-fennel 2024-09-04 21:21:02 +01:00
Daniel Barlow 146a2d9ac0 fix startup race/fencepost in watch-ssh-keys 
if it starts _after_ the outputs are populated, it should
write the first lot of outputs without waiting for a change
 2024-09-04 21:19:51 +01:00
Daniel Barlow 091d863710 extract pppoe/l2tp common code 2024-09-04 12:02:00 +01:00
Daniel Barlow c7bcfbfa34 make pppoe/l2tp more consistent 2024-09-03 22:57:45 +01:00
Daniel Barlow 500a3c1025 make nodefaultroute explicit in ppp 2024-09-03 22:53:13 +01:00
Daniel Barlow 0c0d0eed8a make watch-ssh-keys robust against missing key 2024-09-03 22:51:29 +01:00
Daniel Barlow 699cf97206 improve tangc http error messages 2024-09-03 22:50:55 +01:00
Daniel Barlow cd0093279c think 2024-09-01 10:14:31 +01:00
Daniel Barlow 034d6aacc4 tangc handle non-zero exit from jwe dec 
Sometimes it exits non-zero but decrypts the file *anyway*. It only
does this on the device and I haven't been able to reproduce on build,
so this is a workaround until we find the root cause
 2024-09-01 09:57:38 +01:00
Daniel Barlow e590c0ad3f secrets subscriber: add provider as dep to controlled service 2024-09-01 09:56:59 +01:00
Daniel Barlow 14abdd9998 tang: notify on ready 2024-08-31 23:24:50 +01:00
Daniel Barlow 6287b92000 fix bugs handling base64 padding 2024-08-31 22:43:25 +01:00
Daniel Barlow d2215d3e56 tangc popen retry on short read 2024-08-31 22:18:23 +01:00
Daniel Barlow 3cf2308bee tangc: stop printing unexpected blank lines 2024-08-31 15:29:10 +01:00
Daniel Barlow 3913989be3 provide string to perform-encryption 
instead of letting it read stdin, which I think may have been read
by a subprocess already sometimes?
 2024-08-31 15:27:54 +01:00
Daniel Barlow 43e5e6876e improve tangc error messages 2024-08-31 15:22:26 +01:00
Daniel Barlow 7d6c80570c refactor all writeFennelScript calls to use writeFennel directly 2024-08-30 20:57:42 +01:00
Daniel Barlow e745991b9d restart pppoe/l2tp in secrets changes 2024-08-30 20:49:27 +01:00
Daniel Barlow defbfce1fb finish converting outputRef to lambda 2024-08-30 20:46:48 +01:00
Daniel Barlow 0df2c83382 tighten perms on service state directory 2024-08-29 23:56:43 +01:00
Daniel Barlow 01c28de88d think 2024-08-29 23:56:20 +01:00
Daniel Barlow 2bf197cad8 document outputs and secrets 2024-08-29 23:55:32 +01:00
Daniel Barlow a8a19977ca (untested) template service for tang encrypted secrets 2024-08-28 22:32:26 +01:00
Daniel Barlow 8a9284af1e think 2024-08-28 22:23:00 +01:00
Daniel Barlow 7351e143c5 remove redundant sourcing of ${serviceFns} 
this is done by the oneshot and longrun functions
 2024-08-28 21:28:27 +01:00
Daniel Barlow 283c3154a7 missing file in s6-rc-up-tree test fixture 2024-08-28 21:18:54 +01:00
Daniel Barlow 34f37d60d9 missed adding this 2024-08-28 20:56:52 +01:00
Daniel Barlow fe7b092075 (untested) http basic auth for outboard secrets 2024-08-28 20:53:59 +01:00
Daniel Barlow b56f121e04 fetch lua glue: handle missing content-length 2024-08-28 19:52:00 +01:00
Daniel Barlow d5d621f310 rename http-fstree => json-to-fstree 
it works for file urls as well, not just http
 2024-08-28 16:36:49 +01:00
Daniel Barlow da95a9fa62 tangc support encryption 2024-08-28 18:55:20 +01:00
Daniel Barlow 85071c88e7 remove argv0 from calls to jose 2024-08-28 11:16:43 +01:00
Daniel Barlow 74093b7ee3 josep! runs jose without json parsing the output 2024-08-28 08:13:50 +01:00
Daniel Barlow 41733e58d6 remove unused code, tidy string parsing 2024-08-28 07:20:07 +01:00
Daniel Barlow 9041d5d63a add jose! fn to reduce error-checking boilerplate 2024-08-28 07:10:47 +01:00
Daniel Barlow 001ebdc601 remove unused requires 2024-08-28 06:52:04 +01:00
Daniel Barlow 1f97409474 add popen2 to anoia.fs 2024-08-28 06:49:43 +01:00
Daniel Barlow a41839f3d1 clevis-decrypt-tang in fennel 
needs a lot of tidying up, but works on my test file
 2024-08-28 01:37:44 +01:00
Daniel Barlow ff76d854fc extend libfetch lua glue to other HTTP methods 2024-08-28 01:37:02 +01:00
Daniel Barlow 81a6480a4f anoia add base64 deode 2024-08-27 22:42:03 +01:00
Daniel Barlow c7164a6f4a sshd can use outputRef for authorized_keys 2024-08-25 16:35:50 +01:00
Daniel Barlow 83ca86fe42 keys in service output tree are strings 2024-08-25 15:59:24 +01:00
Daniel Barlow 1b4106e2a3 ssh-keys service, draft 2024-08-25 15:09:31 +01:00
Daniel Barlow 89912c766b nixpkgs 24.11 qemu does not expect texinfo 2024-08-25 14:23:29 +01:00
Daniel Barlow 9828b007ae watch-ssh-keys turns secrets-service into authorized_keys files 2024-08-24 23:25:32 +01:00
Daniel Barlow f34abc85ae add macros param to write-fennel 2024-08-24 23:19:46 +01:00
Daniel Barlow b475a680fb define-tests macro, evals body only when inside fennelrepl --test 2024-08-24 22:26:25 +01:00
Daniel Barlow 43612af71a anoia: %% is alias for string.formt 2024-08-24 13:56:54 +01:00
Daniel Barlow 5695c47496 add dig to anoia 2024-08-23 23:27:29 +01:00
Daniel Barlow e3ec514710 think 2024-08-23 23:27:17 +01:00
Daniel Barlow 99f68e5421 destructure params in ssh service 2024-08-23 23:13:49 +01:00
Daniel Barlow 9c30b6f882 change output references from attrset to lambda 
this is so that we can distinguish a ref from a literal parameter that
might be a attrset
 2024-08-23 22:25:57 +01:00
Daniel Barlow dd75322c10 think 2024-08-23 21:45:18 +01:00
Daniel Barlow 869a508c0a add authorizedKeys option to ssh service 
this has no apparent use as it stands, but opens the door to
having the keys managed by an external secrets service
 2024-08-23 20:35:07 +01:00
Daniel Barlow e835473945 patch dropbear to add -U option 2024-08-23 19:58:05 +01:00