cluster/services/incandescence: add base layout for ascensions

cluster/services/chant/default.nix

@@ -6,5 +6,6 @@
     nixos.listener = [
       ./listener.nix
     ];
+    simulacrum.deps = [ "consul" ];
   };
 }

cluster/services/incandescence/default.nix

@@ -0,0 +1,20 @@
+{ config, ... }:
+
+{
+  imports = [
+    ./options.nix
+  ];
+
+  services.incandescence = {
+    nodes = {
+      provider = config.services.consul.nodes.agent;
+    };
+    nixos = {
+      provider = [
+        ./provider.nix
+        ./provider-options.nix
+      ];
+    };
+    simulacrum.deps = [ "consul" ];
+  };
+}

cluster/services/incandescence/options.nix

@@ -0,0 +1,22 @@
+{ lib, ... }:
+
+let
+  inherit (lib) mkOption;
+  inherit (lib.types) attrsOf listOf submodule str;
+in
+
+{
+  options.incandescence = {
+    providers = mkOption {
+      type = attrsOf (submodule ({ name, ... }: {
+        options = {
+          objects = mkOption {
+            type = attrsOf (listOf str);
+            default = { };
+          };
+        };
+      }));
+      default = { };
+    };
+  };
+}

cluster/services/incandescence/provider-options.nix

@@ -0,0 +1,72 @@
+{ lib, ... }:
+
+let
+  inherit (lib) mkEnableOption mkOption;
+  inherit (lib.types) attrsOf functionTo ints listOf nullOr package submodule str;
+in
+
+{
+  options.services.incandescence = {
+    providers = mkOption {
+      type = attrsOf (submodule ({ name, ... }: {
+        options = {
+          locksmith = mkEnableOption "Locksmith integration";
+
+          wantedBy = mkOption {
+            type = listOf str;
+          };
+
+          partOf = mkOption {
+            type = listOf str;
+          };
+
+          wants = mkOption {
+            type = listOf str;
+            default = [ ];
+          };
+
+          after = mkOption {
+            type = listOf str;
+            default = [ ];
+          };
+
+          packages = mkOption {
+            type = listOf package;
+            default = [ ];
+          };
+
+          formulae = mkOption {
+            type = attrsOf (submodule ({ ... }: {
+              options = {
+                deps = mkOption {
+                  type = listOf str;
+                  default = [ ];
+                };
+
+                create = mkOption {
+                  type = functionTo str;
+                };
+
+                change = mkOption {
+                  type = nullOr (functionTo str);
+                  default = null;
+                };
+
+                destroy = mkOption {
+                  type = str;
+                };
+
+                destroyAfterDays = mkOption {
+                  type = ints.unsigned;
+                  default = 0;
+                };
+              };
+            }));
+            default = { };
+          };
+        };
+      }));
+      default = { };
+    };
+  };
+}

cluster/services/incandescence/provider.nix

@@ -0,0 +1,138 @@
+{ cluster, config, lib, ... }:
+
+let
+  inherit (lib) concatStringsSep escapeShellArg flatten filter filterAttrs length mapAttrs mapAttrs' mapAttrsToList mkIf mkMerge pipe stringToCharacters;
+
+  cfg = config.services.incandescence;
+  clusterCfg = cluster.config.incandescence;
+in
+
+{
+  systemd.services = pipe cfg.providers [
+    (mapAttrsToList (provider: providerConfig: pipe providerConfig.formulae [
+      (mapAttrsToList (formula: formulaConfig: let
+        kvRoot = "services/incandescence/providers/${provider}/formulae/${formula}";
+        time = "$(date +%s)";
+      in {
+        "ignite-${provider}-${formula}-create" = {
+          description = "Ignite Creation: ${provider} - ${formula}";
+          wantedBy = [ "incandescence-${provider}.target" ];
+          before = [ "incandescence-${provider}.target" ];
+          wants = providerConfig.wants ++ map (dep: "ignite-${provider}-${dep}-create.service") formulaConfig.deps;
+          after = providerConfig.after ++ map (dep: "ignite-${provider}-${dep}-create.service") formulaConfig.deps;
+          serviceConfig.Type = "oneshot";
+          distributed.enable = true;
+          path = [ config.services.consul.package ] ++ providerConfig.packages;
+          script = pipe clusterCfg.providers.${provider}.objects.${formula} [
+            (map (object: ''
+              if ! consul kv get ${kvRoot}/${object}/alive >/dev/null; then
+                echo "Create ${formula}: ${object}"
+                if (
+                ${formulaConfig.create object}
+                )
+                then
+                  consul kv put ${kvRoot}/${object}/alive true
+                  consul kv delete ${kvRoot}/${object}/destroyOn
+                else
+                  echo "Creation failed: ${object}"
+                fi
+              fi
+            ''))
+            (concatStringsSep "\n")
+          ];
+        };
+        "ignite-${provider}-${formula}-change" = mkIf (formulaConfig.change != null) {
+          description = "Ignite Change: ${provider} - ${formula}";
+          wantedBy = [ "incandescence-${provider}.target" ];
+          before = [ "incandescence-${provider}.target" ];
+          wants = providerConfig.wants ++ [ "ignite-${provider}-${formula}-create.service" ] ++ map (dep: "ignite-${provider}-${dep}-change.service") formulaConfig.deps;
+          after = providerConfig.after ++ [ "ignite-${provider}-${formula}-create.service" ] ++ map (dep: "ignite-${provider}-${dep}-change.service") formulaConfig.deps;
+          serviceConfig.Type = "oneshot";
+          distributed.enable = true;
+          path = [ config.services.consul.package ] ++ providerConfig.packages;
+          script = pipe clusterCfg.providers.${provider}.objects.${formula} [
+            (map (object: ''
+              echo "Change ${formula}: ${object}"
+              (
+              ${formulaConfig.change object}
+              ) || echo "Change failed: ${object}"
+            ''))
+            (concatStringsSep "\n")
+          ];
+        };
+        "ignite-${provider}-${formula}-destroy" = {
+          description = "Ignite Destruction: ${provider} - ${formula}";
+          wantedBy = [ "incandescence-${provider}.target" ] ++ map (dep: "ignite-${provider}-${dep}-destroy.service") formulaConfig.deps;
+          before = [ "incandescence-${provider}.target" ] ++ map (dep: "ignite-${provider}-${dep}-destroy.service") formulaConfig.deps;
+          wants = providerConfig.wants ++ [ "ignite-${provider}-${formula}-change.service" ];
+          after = providerConfig.after ++ [ "ignite-${provider}-${formula}-change.service" ];
+          serviceConfig.Type = "oneshot";
+          distributed.enable = true;
+          path = [ config.services.consul.package ] ++ providerConfig.packages;
+          script = let
+            fieldNum = pipe kvRoot [
+              stringToCharacters
+              (filter (x: x == "/"))
+              length
+              (builtins.add 2)
+              toString
+            ];
+            keyFilter = pipe clusterCfg.providers.${provider}.objects.${formula} [
+              (map (x: escapeShellArg "^${x}$"))
+              (concatStringsSep " \\\n  -e ")
+            ];
+            destroyAfterDays = toString formulaConfig.destroyAfterDays;
+          in ''
+            consul kv get --keys ${kvRoot}/ | cut -d/ -f${fieldNum} | grep -v -e ${keyFilter} | while read object; do
+              if consul kv get ${kvRoot}/$object/alive >/dev/null; then
+                destroyOn="$(consul kv get ${kvRoot}/$object/destroyOn || true)"
+                if [[ -z "$destroyOn" && "${destroyAfterDays}" -ne 0 ]]; then
+                  echo "Schedule ${formula} for destruction in ${destroyAfterDays} days: $object"
+                  consul kv put ${kvRoot}/$object/destroyOn "$((${time} + 86400 * ${destroyAfterDays}))"
+                elif [[ "${destroyAfterDays}" -eq 0 || "${time}" -ge "$destroyOn" ]]; then
+                  echo "Destroy ${formula}: $object"
+                  export OBJECT="$object"
+                  if (
+                  ${formulaConfig.destroy}
+                  )
+                  then
+                    consul kv delete --recurse ${kvRoot}/$object
+                  else
+                    echo "Destruction failed: $object"
+                  fi
+                else
+                  echo "Scheduled for destruction on $destroyOn (now: ${time})"
+                fi
+              fi
+            done
+          '';
+        };
+      }))
+    ]))
+    flatten
+    mkMerge
+  ];
+
+  systemd.targets = mapAttrs' (provider: providerConfig: {
+    name = "incandescence-${provider}";
+    value = {
+      description = "An Incandescence | ${provider}";
+      inherit (providerConfig) wantedBy partOf;
+    };
+  }) cfg.providers;
+
+  services.locksmith.providers = mapAttrs (provider: providerConfig: {
+    wantedBy = [ "incandescence-${provider}.target" ];
+    after = [ "incandescence-${provider}.target" ];
+  }) (filterAttrs (_: providerConfig: providerConfig.locksmith) cfg.providers);
+
+  system.ascensions = mapAttrs' (provider: providerConfig: {
+    name = "incandescence-${provider}";
+    value = {
+      distributed = true;
+      requiredBy = map (formula: "ignite-${provider}-${formula}-create.service") (lib.attrNames providerConfig.formulae);
+      before = map (formula: "ignite-${provider}-${formula}-create.service") (lib.attrNames providerConfig.formulae);
+      incantations = lib.mkDefault (i: []);
+    };
+  }) cfg.providers;
+}

cluster/services/locksmith/default.nix

@@ -14,5 +14,6 @@
         ./provider.nix
       ];
     };
+    simulacrum.deps = [ "chant" "consul" ];
   };
 }

cluster/services/locksmith/provider.nix

@@ -28,6 +28,10 @@ in
                 command = mkOption {
                   type = types.coercedTo types.package (package: "${package}") types.str;
                 };
+                checkUpdate = mkOption {
+                  type = types.coercedTo types.package (package: "${package}") types.str;
+                  default = "true";
+                };
                 owner = mkOption {
                   type = types.str;
                   default = "root";
@@ -72,20 +76,27 @@ in
         activeNodes = lib.unique (lib.flatten (lib.mapAttrsToList (_: secret: secret.nodes) activeSecrets));
         secretNames = map (name: "${providerRoot}-${name}/") (lib.attrNames activeSecrets);
 
-        createSecret = { path, nodes, owner, mode, group, command }: ''
+        createSecret = { path, nodes, owner, mode, group, command, checkUpdate }: ''
-          consul kv put ${lib.escapeShellArg path}/mode ${lib.escapeShellArg mode}
+          if (${checkUpdate}); then
-          consul kv put ${lib.escapeShellArg path}/owner ${lib.escapeShellArg owner}
+            consul kv put ${lib.escapeShellArg path}/mode ${lib.escapeShellArg mode}
-          consul kv put ${lib.escapeShellArg path}/group ${lib.escapeShellArg group}
+            consul kv put ${lib.escapeShellArg path}/owner ${lib.escapeShellArg owner}
-          ${lib.concatStringsSep "\n" (map (node: ''
+            consul kv put ${lib.escapeShellArg path}/group ${lib.escapeShellArg group}
-            consul kv put ${lib.escapeShellArg path}/recipient/${node} "$( (${command}) | age --encrypt --armor -r ${lib.escapeShellArg depot.hours.${node}.ssh.id.publicKey})"
+            secret="$(mktemp -ut)"
-          '') nodes)}
+            (${command}) > "$secret"
+            ${lib.concatStringsSep "\n" (map (node: ''
+              consul kv put ${lib.escapeShellArg path}/recipient/${node} "$(age < "$secret" --encrypt --armor -r ${lib.escapeShellArg depot.hours.${node}.ssh.id.publicKey})"
+            '') nodes)}
+          else
+            echo Skipping update for ${lib.escapeShellArg path}
+          fi
         '';
       in ''
         # create/update secrets
+        umask 77
         ${lib.pipe activeSecrets [
           (lib.mapAttrsToList (secretName: secretConfig: createSecret {
             path = "${providerRoot}-${secretName}";
-            inherit (secretConfig) nodes mode owner group command;
+            inherit (secretConfig) nodes mode owner group command checkUpdate;
           }))
           (lib.concatStringsSep "\n")
         ]}

cluster/services/patroni/create-databases.nix

@@ -0,0 +1,91 @@
+{ cluster, config, lib, pkgs, ... }:
+
+let
+  inherit (cluster.config.services.patroni) secrets;
+
+  patroni = cluster.config.links.patroni-pg-access;
+
+  cfg = cluster.config.patroni;
+
+  writeQueryFile = pkgs.writeText "patroni-query.sql";
+
+  psqlRunFile = file: ''
+    export PGPASSWORD="$(< ${secrets.PATRONI_SUPERUSER_PASSWORD.path})"
+    while ! ${config.services.patroni.postgresqlPackage}/bin/psql 'host=${patroni.ipv4} port=${patroni.portStr} dbname=postgres user=postgres' --tuples-only --csv --file="${file}"; do
+      sleep 3
+    done
+  '';
+
+  psql = query: psqlRunFile (writeQueryFile query);
+
+  psqlSecret = getSecret: queryTemplate: let
+    queryTemplateFile = writeQueryFile queryTemplate;
+  in ''
+    umask 77
+    secretFile="$(mktemp -ut patroniSecret.XXXXXXXXXXXXXXXX)"
+    queryFile="$(mktemp -ut patroniQuery.XXXXXXXXXXXXXXXX)"
+    trap "rm -f $secretFile $queryFile" EXIT
+    ${getSecret} > "$secretFile"
+    cp --no-preserve=mode ${queryTemplateFile} "$queryFile"
+    ${pkgs.replace-secret}/bin/replace-secret '@SECRET@' "$secretFile" "$queryFile"
+    ${psqlRunFile "$queryFile"}
+  '';
+
+  genPassword = pkgs.writeShellScript "patroni-generate-user-password" ''
+    umask 77
+    base64 -w0 /dev/urandom | tr -d /+ | head -c256 | tee "/run/keys/locksmith-provider-patroni-$1"
+  '';
+in
+
+{
+  services.incandescence.providers.patroni = lib.mkIf config.services.haproxy.enable {
+    locksmith = true;
+    wantedBy = [ "patroni.service" "multi-user.target" ];
+    partOf = [ "patroni.service" ];
+    wants = [ "postgresql.service" ];
+    after = [ "postgresql.service" ];
+
+    formulae = {
+      user = {
+        destroyAfterDays = 0;
+        create = user: psqlSecret "${genPassword} ${user}" ''
+          CREATE USER ${user} PASSWORD '@SECRET@';
+        '';
+        destroy = psqlSecret "printenv OBJECT" ''
+          DROP USER @SECRET@;
+        '';
+      };
+      database = {
+        destroyAfterDays = 30;
+        deps = [ "user" ];
+        create = db: psql ''
+          CREATE DATABASE ${db} OWNER ${cfg.databases.${db}.owner};
+        '';
+        destroy = psqlSecret "printenv OBJECT" ''
+          DROP DATABASE @SECRET@;
+        '';
+      };
+    };
+  };
+
+  services.locksmith.providers.patroni = lib.mkIf config.services.haproxy.enable {
+    secrets = lib.mapAttrs (user: userConfig: {
+      command = {
+        envFile = ''
+          echo "PGPASSWORD=$(cat /run/keys/locksmith-provider-patroni-${user})"
+          rm -f /run/keys/locksmith-provider-patroni-${user}
+        '';
+        pgpass = ''
+          echo "*:*:*:${user}:$(cat /run/keys/locksmith-provider-patroni-${user})"
+          rm -f /run/keys/locksmith-provider-patroni-${user}
+        '';
+        raw = ''
+          cat /run/keys/locksmith-provider-patroni-${user}
+          rm -f /run/keys/locksmith-provider-patroni-${user}
+        '';
+      }.${userConfig.locksmith.format};
+      checkUpdate = "test -e /run/keys/locksmith-provider-patroni-${user}";
+      inherit (userConfig.locksmith) nodes;
+    }) cfg.users;
+  };
+}

cluster/services/patroni/default.nix

@@ -1,6 +1,11 @@
-{ config, lib, ... }:
+{ config, ... }:
 
 {
+  imports = [
+    ./options.nix
+    ./incandescence.nix
+  ];
+
   links = {
     patroni-pg-internal.ipv4 = "0.0.0.0";
     patroni-api.ipv4 = "0.0.0.0";
@@ -15,6 +20,7 @@
       worker = [
         ./worker.nix
         ./metrics.nix
+        ./create-databases.nix
       ];
       haproxy = ./haproxy.nix;
     };
@@ -30,5 +36,6 @@
       PATRONI_REWIND_PASSWORD = default;
       metricsCredentials.nodes = nodes.worker;
     };
+    simulacrum.deps = [ "consul" "incandescence" "locksmith" ];
   };
 }

cluster/services/patroni/incandescence.nix

@@ -0,0 +1,10 @@
+{ config, lib, ... }:
+
+{
+  incandescence.providers.patroni = {
+    objects = {
+      user = lib.attrNames config.patroni.users;
+      database = lib.attrNames config.patroni.databases;
+    };
+  };
+}

cluster/services/patroni/options.nix

@@ -0,0 +1,37 @@
+{ lib, ... }:
+
+let
+  inherit (lib) mkOption;
+  inherit (lib.types) attrsOf enum listOf submodule str;
+in
+
+{
+  options.patroni = {
+    databases = mkOption {
+      type = attrsOf (submodule ({ name, ... }: {
+        options = {
+          owner = mkOption {
+            type = str;
+            default = name;
+          };
+        };
+      }));
+    };
+    users = mkOption {
+      type = attrsOf (submodule ({ ... }: {
+        options = {
+          locksmith = {
+            nodes = mkOption {
+              type = listOf str;
+              default = [];
+            };
+            format = mkOption {
+              type = enum [ "pgpass" "envFile" "raw" ];
+              default = "pgpass";
+            };
+          };
+        };
+      }));
+    };
+  };
+}