newedge/liminix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,329 Commits 4 Branches 0 Tags
7ca822c8265ba86ade57ad01d71dd55bf4f3476b
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Daniel Barlow 7ca822c826 more messing around with lua derivation 2024-10-03 23:00:08 +01:00
Daniel Barlow e5631783e1 add luaossl package with patch for CSR attributes 2024-10-03 23:00:08 +01:00
Daniel Barlow 635590d37a implement log shipping config 
to use this, you need config like for example

+  logging.shipping = {
+    enable = true;
+    service = longrun {
+      name = "ship-logs";
+      run = let path = lib.makeBinPath (with pkgs; [ s6 s6-networking s6 execline ]);
+            in ''
+        PATH=${path}:$PATH
+        s6-ipcserver -1 ${config.logging.shipping.socket} \
+        s6-tcpclient 10.0.2.2 19612 \
+        fdmove -c 1 7 cat
+      '';
+    };
+  };

but I think we can reduce the noise a bit if we use an s6-rc pipeline
with an s6-ipcserver on one side and and a (whatever the user wants)
on the other
 2024-09-18 22:14:34 +01:00
Daniel Barlow 17630f2678 rename logtee->logtap 2024-09-18 20:58:02 +01:00
Daniel Barlow 707a471bc2 add logtee to catchall logger 2024-09-16 21:30:06 +01:00
Daniel Barlow d3fce5edd4 implement error() for musl 2024-09-16 20:35:23 +01:00
Daniel Barlow 5771108fed improve logtee socket connection warning 
* print it less often
* to the correct stream (stdout not stderr)
 2024-09-16 20:34:26 +01:00
Daniel Barlow 9e5f2d663d close socket fd if we can't connect it 2024-09-15 22:09:31 +01:00
Daniel Barlow 21eeb1671e print diagnostic when eof on stderr 2024-09-15 21:59:24 +01:00
Daniel Barlow 44762d38fc write start cookie when socket connect succeeds 2024-09-15 21:54:21 +01:00
Daniel Barlow 1f6cfc3679 extract method is_connected 2024-09-15 21:40:05 +01:00
Daniel Barlow 8ec00f1710 improve error message 2024-09-15 21:37:04 +01:00
Daniel Barlow 6a6dd32dea make pollfd array global 2024-09-15 21:32:48 +01:00
Daniel Barlow 9b1fc11a59 logshipper/logtee :copy stdin to stdout & to a unix socket if present 
first draft
 2024-09-15 19:33:21 +01:00
Daniel Barlow aaa6e353db incz is a very rudimentary log shipper for zinc search 
although it probably would work with elasticsearch as well
as zinc is alleged to be ES-compatible

this is just the package and needs hooking into the service/log
infrastructure somehow
 2024-09-08 16:38:37 +01:00
Daniel Barlow 69bf6cb5fb write-fennel quote PATH properly 
escapeShellArg only quotes if the string contains special
characters, but for a Lua string we must quote unconditionally
 2024-09-07 22:31:44 +01:00
Daniel Barlow 9f58e7b926 maybe fix nixpkgs-unstable lua 2024-09-07 00:58:11 +01:00
Daniel Barlow 5a5c27ab9f think 2024-09-06 22:37:49 +01:00
Daniel Barlow 277c91acdf Revert "remove luaposix ref in write-fennel" 
This reverts commit a60c2539a6.
 2024-09-06 00:33:30 +01:00
Daniel Barlow e0725489ca unbreak pppoe ci job 2024-09-06 00:33:30 +01:00
Daniel Barlow cc47515cf8 watch-outputs remove debug code 2024-09-06 00:13:54 +01:00
Daniel Barlow 464913cc8f tangc use spawn to invoke jose 
hopefully we are now deadlock-free
 2024-09-06 00:12:45 +01:00
Daniel Barlow e604d628e3 fennel anoia.process.spawn 
runs a subprocess and invokes a callback whenever its io
descriptors are ready
 2024-09-06 00:11:33 +01:00
Daniel Barlow e2a597589b anoia.fs.find-executable looks for bin in colon-sep list of directories 2024-09-06 00:08:40 +01:00
Daniel Barlow 6a5fed83dd conditional fetch in json-to-fstree 2024-09-05 11:14:47 +01:00
Daniel Barlow bcf5ab24e8 tidy watch-outputs startup message 2024-09-05 10:11:16 +01:00
Daniel Barlow 32bf80c6fa devout: unlink socket pathname before binding 2024-09-05 10:05:13 +01:00
Daniel Barlow 12275f6896 add more test for table= 2024-09-04 21:21:30 +01:00
Daniel Barlow a60c2539a6 remove luaposix ref in write-fennel 2024-09-04 21:21:02 +01:00
Daniel Barlow 146a2d9ac0 fix startup race/fencepost in watch-ssh-keys 
if it starts _after_ the outputs are populated, it should
write the first lot of outputs without waiting for a change
 2024-09-04 21:19:51 +01:00
Daniel Barlow 091d863710 extract pppoe/l2tp common code 2024-09-04 12:02:00 +01:00
Daniel Barlow c7bcfbfa34 make pppoe/l2tp more consistent 2024-09-03 22:57:45 +01:00
Daniel Barlow 500a3c1025 make nodefaultroute explicit in ppp 2024-09-03 22:53:13 +01:00
Daniel Barlow 0c0d0eed8a make watch-ssh-keys robust against missing key 2024-09-03 22:51:29 +01:00
Daniel Barlow 699cf97206 improve tangc http error messages 2024-09-03 22:50:55 +01:00
Daniel Barlow cd0093279c think 2024-09-01 10:14:31 +01:00
Daniel Barlow 034d6aacc4 tangc handle non-zero exit from jwe dec 
Sometimes it exits non-zero but decrypts the file *anyway*. It only
does this on the device and I haven't been able to reproduce on build,
so this is a workaround until we find the root cause
 2024-09-01 09:57:38 +01:00
Daniel Barlow e590c0ad3f secrets subscriber: add provider as dep to controlled service 2024-09-01 09:56:59 +01:00
Daniel Barlow 14abdd9998 tang: notify on ready 2024-08-31 23:24:50 +01:00
Daniel Barlow 6287b92000 fix bugs handling base64 padding 2024-08-31 22:43:25 +01:00
Daniel Barlow d2215d3e56 tangc popen retry on short read 2024-08-31 22:18:23 +01:00
Daniel Barlow 3cf2308bee tangc: stop printing unexpected blank lines 2024-08-31 15:29:10 +01:00
Daniel Barlow 3913989be3 provide string to perform-encryption 
instead of letting it read stdin, which I think may have been read
by a subprocess already sometimes?
 2024-08-31 15:27:54 +01:00
Daniel Barlow 43e5e6876e improve tangc error messages 2024-08-31 15:22:26 +01:00
Daniel Barlow 7d6c80570c refactor all writeFennelScript calls to use writeFennel directly 2024-08-30 20:57:42 +01:00
Daniel Barlow e745991b9d restart pppoe/l2tp in secrets changes 2024-08-30 20:49:27 +01:00
Daniel Barlow defbfce1fb finish converting outputRef to lambda 2024-08-30 20:46:48 +01:00
Daniel Barlow 0df2c83382 tighten perms on service state directory 2024-08-29 23:56:43 +01:00
Daniel Barlow 01c28de88d think 2024-08-29 23:56:20 +01:00
Daniel Barlow 2bf197cad8 document outputs and secrets 2024-08-29 23:55:32 +01:00
Daniel Barlow a8a19977ca (untested) template service for tang encrypted secrets 2024-08-28 22:32:26 +01:00
Daniel Barlow 8a9284af1e think 2024-08-28 22:23:00 +01:00
Daniel Barlow 7351e143c5 remove redundant sourcing of ${serviceFns} 
this is done by the oneshot and longrun functions
 2024-08-28 21:28:27 +01:00
Daniel Barlow 283c3154a7 missing file in s6-rc-up-tree test fixture 2024-08-28 21:18:54 +01:00
Daniel Barlow 34f37d60d9 missed adding this 2024-08-28 20:56:52 +01:00
Daniel Barlow fe7b092075 (untested) http basic auth for outboard secrets 2024-08-28 20:53:59 +01:00
Daniel Barlow b56f121e04 fetch lua glue: handle missing content-length 2024-08-28 19:52:00 +01:00
Daniel Barlow d5d621f310 rename http-fstree => json-to-fstree 
it works for file urls as well, not just http
 2024-08-28 16:36:49 +01:00
Daniel Barlow da95a9fa62 tangc support encryption 2024-08-28 18:55:20 +01:00
Daniel Barlow 85071c88e7 remove argv0 from calls to jose 2024-08-28 11:16:43 +01:00
Daniel Barlow 74093b7ee3 josep! runs jose without json parsing the output 2024-08-28 08:13:50 +01:00
Daniel Barlow 41733e58d6 remove unused code, tidy string parsing 2024-08-28 07:20:07 +01:00
Daniel Barlow 9041d5d63a add jose! fn to reduce error-checking boilerplate 2024-08-28 07:10:47 +01:00
Daniel Barlow 001ebdc601 remove unused requires 2024-08-28 06:52:04 +01:00
Daniel Barlow 1f97409474 add popen2 to anoia.fs 2024-08-28 06:49:43 +01:00
Daniel Barlow a41839f3d1 clevis-decrypt-tang in fennel 
needs a lot of tidying up, but works on my test file
 2024-08-28 01:37:44 +01:00
Daniel Barlow ff76d854fc extend libfetch lua glue to other HTTP methods 2024-08-28 01:37:02 +01:00
Daniel Barlow 81a6480a4f anoia add base64 deode 2024-08-27 22:42:03 +01:00
Daniel Barlow c7164a6f4a sshd can use outputRef for authorized_keys 2024-08-25 16:35:50 +01:00
Daniel Barlow 83ca86fe42 keys in service output tree are strings 2024-08-25 15:59:24 +01:00
Daniel Barlow 1b4106e2a3 ssh-keys service, draft 2024-08-25 15:09:31 +01:00
Daniel Barlow 89912c766b nixpkgs 24.11 qemu does not expect texinfo 2024-08-25 14:23:29 +01:00
Daniel Barlow 9828b007ae watch-ssh-keys turns secrets-service into authorized_keys files 2024-08-24 23:25:32 +01:00
Daniel Barlow f34abc85ae add macros param to write-fennel 2024-08-24 23:19:46 +01:00
Daniel Barlow b475a680fb define-tests macro, evals body only when inside fennelrepl --test 2024-08-24 22:26:25 +01:00
Daniel Barlow 43612af71a anoia: %% is alias for string.formt 2024-08-24 13:56:54 +01:00
Daniel Barlow 5695c47496 add dig to anoia 2024-08-23 23:27:29 +01:00
Daniel Barlow e3ec514710 think 2024-08-23 23:27:17 +01:00
Daniel Barlow 99f68e5421 destructure params in ssh service 2024-08-23 23:13:49 +01:00
Daniel Barlow 9c30b6f882 change output references from attrset to lambda 
this is so that we can distinguish a ref from a literal parameter that
might be a attrset
 2024-08-23 22:25:57 +01:00
Daniel Barlow dd75322c10 think 2024-08-23 21:45:18 +01:00
Daniel Barlow 869a508c0a add authorizedKeys option to ssh service 
this has no apparent use as it stands, but opens the door to
having the keys managed by an external secrets service
 2024-08-23 20:35:07 +01:00
Daniel Barlow e835473945 patch dropbear to add -U option 2024-08-23 19:58:05 +01:00
Daniel Barlow 055268d5d2 upgrade dropbear 2024-08-23 19:57:10 +01:00
Daniel Barlow ff38bcacbb improve devout error reporting 2024-08-21 23:24:13 +01:00
Daniel Barlow a6128955e7 ppp modules: permit (mostly) same params for l2tp as pppoe 
this also means that l2tp can use secrets for username/password
 2024-08-21 23:10:28 +01:00
Daniel Barlow 531cb113be devout needs a longer startup timeout 
seems to be taking around 40 seconds now, would be worth digging in to
find out why
 2024-08-21 23:09:11 +01:00
Daniel Barlow daede666cb in router-with-l2tp use secrets for ppp username/password 2024-08-21 00:17:53 +01:00
Daniel Barlow 2992771c7e pppoe allow secrets for username/password 2024-08-21 00:17:22 +01:00
Daniel Barlow 4cc82e1502 liminix.types.replacable is a string or ref to an output 2024-08-21 00:16:14 +01:00
Daniel Barlow 21f2320d86 inline method 2024-08-20 23:26:11 +01:00
Daniel Barlow d40ada4251 use structured ppp params in ppp test 2024-08-20 23:25:31 +01:00
Daniel Barlow 4053ea9481 secrets/subscriber implement different restart types 2024-08-20 22:56:26 +01:00
Daniel Barlow 54d3415885 pppoe convert to using a config file 
mostly for ease of implementation but does mean we don't
have username/password secrets on the command line
 2024-08-20 22:55:30 +01:00
Daniel Barlow 264d83c98d move some secret-watching stuff from hostapd to secrets 2024-08-20 21:49:11 +01:00
Daniel Barlow 97defc2076 hostapd: get secrets service/path from attrs 2024-08-17 22:25:30 +01:00
Daniel Barlow ddaa5476d3 override clevis derivation (experimental) 2024-08-15 23:02:54 +01:00
Daniel Barlow bcd9d56624 start devout after mdevd 
not 100% sure that there's a dependency but it's plausible, and
would explain the observed occasional failure to start at boot
 2024-08-15 23:01:29 +01:00
Daniel Barlow e2c883356c add secrets-subscriber service, make hostapd use it 2024-08-15 23:00:41 +01:00
Daniel Barlow d79a941504 new package watch-outputs and example of its use 2024-08-14 22:58:17 +01:00