]>
Commit | Line | Data |
---|---|---|
1 | # auto-upgrade-with-pinch: Secure managed NixOS updates | |
2 | # | |
3 | # This program is free software: you can redistribute it and/or modify it | |
4 | # under the terms of the GNU General Public License as published by the | |
5 | # Free Software Foundation, version 3. | |
6 | ||
7 | { config, lib, pkgs, ... }: | |
8 | with lib; | |
9 | let | |
10 | local-pkgs = import ../. { inherit pkgs; }; | |
11 | cfg = config.system.autoUpgradeWithPinch; | |
12 | pull-repo-script = pkgs.writeShellScript "pull-repo" '' | |
13 | set -eo pipefail | |
14 | ||
15 | path=$1 | |
16 | config=$2 | |
17 | ||
18 | prop() { | |
19 | ${pkgs.jq}/bin/jq -r ".$1" <<< "$config" | |
20 | } | |
21 | ||
22 | echo Pulling in "$path" >&2 | |
23 | ||
24 | if [[ ! -e "$path" ]];then | |
25 | d=$(mktemp -d) | |
26 | ${pkgs.git}/bin/git init "$d" | |
27 | ${pkgs.git}/bin/git -C "$d" checkout -b "$(prop localBranch)" | |
28 | ${pkgs.git}/bin/git -C "$d" remote add "$(prop remoteName)" "$(prop url)" | |
29 | ${pkgs.git}/bin/git -C "$d" branch -u "$(prop remoteBranch)" | |
30 | mkdir -p "$(${pkgs.coreutils}/bin/dirname "$path")" | |
31 | mv "$d" "$path" | |
32 | fi | |
33 | ||
34 | cd "$path" | |
35 | ||
36 | if [[ "$(${pkgs.git}/bin/git remote get-url "$(prop remoteName)")" != "$(prop url)" ]]; then | |
37 | echo Expected git remote "$(prop remoteName)" to point at "$(prop url)" \ | |
38 | but it points at "$(${pkgs.git}/bin/git remote get-url "$(prop remoteName)")" >&2 | |
39 | case "$(prop onRemoteURLMismatch)" in | |
40 | abort) exit 1;; | |
41 | update) echo Updating it >&2 | |
42 | ${pkgs.git}/bin/git -C "$d" remote set-url "$(prop remoteName)" "$(prop url)";; | |
43 | esac | |
44 | fi | |
45 | ||
46 | ${pkgs.git}/bin/git fetch "$(prop remoteName)" "$(prop remoteBranch)" | |
47 | ||
48 | if [[ "$(${pkgs.git}/bin/git rev-parse --abbrev-ref HEAD)" != "$(prop localBranch)" ]];then | |
49 | echo Could not merge because currently-checked-out \ | |
50 | \""$(${pkgs.git}/bin/git rev-parse --abbrev-ref HEAD)"\" is not \ | |
51 | \""$(prop localBranch)"\" | |
52 | case "$(prop onBranchMismatch)" in | |
53 | abort) exit 1;; | |
54 | continue) exit 0;; | |
55 | esac | |
56 | fi | |
57 | ||
58 | if [[ "$(prop requireSignature)" == true ]]; then | |
59 | ${pkgs.polite-merge}/bin/polite-merge \ | |
60 | -c gpg.program=${escapeShellArg (local-pkgs.keyed-gpg cfg.signingKeys)} \ | |
61 | merge --ff-only --verify-signatures | |
62 | else | |
63 | ${pkgs.polite-merge}/bin/polite-merge merge --ff-only | |
64 | fi | |
65 | ''; | |
66 | ||
67 | auto-upgrade-script = pkgs.writeShellScript "auto-upgrade" '' | |
68 | ${pkgs.coreutils}/bin/nice -n 17 \ | |
69 | ${pkgs.util-linux}/bin/ionice -c 3 \ | |
70 | ${pkgs.util-linux}/bin/flock /run/auto-upgrade-with-pinch ${ | |
71 | pkgs.writeShellScript "auto-upgrade-with-lock-held" '' | |
72 | set -eo pipefail | |
73 | ||
74 | dry_run=false | |
75 | pinch_args=() | |
76 | if [[ "$1" == --dry-run ]];then | |
77 | dry_run=true | |
78 | pinch_args=( --dry-run ) | |
79 | fi | |
80 | ||
81 | hydrate() { | |
82 | if "$dry_run";then | |
83 | echo "Would run: $*" | |
84 | else | |
85 | "$@" | |
86 | fi | |
87 | } | |
88 | ||
89 | die() { | |
90 | echo "$*" >&2 | |
91 | exit 1 | |
92 | } | |
93 | ||
94 | in_tmpdir() { | |
95 | d=$(${pkgs.coreutils}/bin/mktemp -d) | |
96 | pushd "$d" | |
97 | "$@" | |
98 | popd | |
99 | ${pkgs.coreutils}/bin/rm -r "$d" | |
100 | } | |
101 | ||
102 | ${optionalString (cfg.upgradeConfigOwnershipPolicy != "any") ('' | |
103 | verify_ownership() { | |
104 | if [[ "$1" != /* ]];then | |
105 | die "Unexpected relative path: $1" | |
106 | fi | |
107 | if [[ "$1" != / ]];then | |
108 | verify_ownership "$(${pkgs.coreutils}/bin/dirname "$1")" | |
109 | fi | |
110 | if [[ ! -e "$1" ]];then | |
111 | die "Could not find upgrade config: $1 does not exist" | |
112 | fi | |
113 | if [[ -h "$1" ]];then | |
114 | verify_ownership "$( | |
115 | ${pkgs.coreutils}/bin/realpath --no-symlinks \ | |
116 | "$(${pkgs.coreutils}/bin/dirname "$1")/$(${pkgs.coreutils}/bin/readlink "$1")" | |
117 | )" | |
118 | fi | |
119 | perms="$(${pkgs.findutils}/bin/find "$1" -maxdepth 0 -printf "%M")" | |
120 | if [[ "$perms" == d*t ]];then | |
121 | die "Will not use upgrade config in sticky directory $1" | |
122 | fi | |
123 | owner=$(${pkgs.findutils}/bin/find "$1" -maxdepth 0 -printf "%u") | |
124 | if [[ "$owner" != root ]];then | |
125 | die "Will not use upgrade config not owned by root in $1" | |
126 | fi | |
127 | if [[ "$perms" == l* ]];then | |
128 | return 0 # Root-owned symlinks are fine | |
129 | fi | |
130 | if [[ "$perms" == *w? ]];then | |
131 | die "Will not use world-writable upgrade config in $1" | |
132 | fi | |
133 | ${ | |
134 | { | |
135 | root = '' | |
136 | if [[ "$perms" == *w???? ]];then | |
137 | die "Will not use group-writable upgrade config in $1" | |
138 | fi | |
139 | ''; | |
140 | wheel = '' | |
141 | if [[ "$perms" == *w???? ]];then | |
142 | group=$(${pkgs.findutils}/bin/find "$1" -maxdepth 0 -printf "%g") | |
143 | if [[ "$group" != wheel ]];then | |
144 | die "Will not use non-wheel-group group-writable upgrade config in $1" | |
145 | fi | |
146 | fi | |
147 | ''; | |
148 | }."${cfg.upgradeConfigOwnershipPolicy}" | |
149 | } | |
150 | } | |
151 | '' | |
152 | + concatMapStringsSep "\n" (f: "verify_ownership ${escapeShellArg f}") | |
153 | cfg.upgradeConfig)} | |
154 | ||
155 | config=$(${pkgs.nix}/bin/nix-instantiate --eval --strict --json -A config \ | |
156 | --arg upgradeConfig ${ | |
157 | escapeShellArg ("[" | |
158 | + lib.concatMapStringsSep " " lib.strings.escapeNixString | |
159 | cfg.upgradeConfig + "]") | |
160 | } ${../upgrade-config.nix}) | |
161 | ||
162 | config_query() { | |
163 | ${pkgs.jq}/bin/jq -r "$@" <<< "$config" | |
164 | } | |
165 | ||
166 | repo_query() { | |
167 | config_query --arg path "$1" ".repos[\$ARGS.named.path]$2" | |
168 | } | |
169 | ||
170 | userenv_query() { | |
171 | config_query --arg user "$1" ".userEnvironments[\$ARGS.named.user]$2" | |
172 | } | |
173 | ||
174 | # Pull updates | |
175 | while read path;do | |
176 | hydrate /run/wrappers/bin/sudo -u "$(repo_query "$path" .user)" \ | |
177 | ${pull-repo-script} "$path" "$(repo_query "$path" "")" | |
178 | done < <( config_query '.repos | keys []' ) | |
179 | ||
180 | # Update channels | |
181 | config_query '.pinchFiles[]' | ${pkgs.findutils}/bin/xargs --no-run-if-empty --delimiter=\\n ${pkgs.pinch}/bin/pinch update "''${pinch_args[@]}" | |
182 | ||
183 | # Build | |
184 | in_tmpdir hydrate ${config.system.build.nixos-rebuild}/bin/nixos-rebuild build | |
185 | while read user;do | |
186 | hydrate /run/wrappers/bin/sudo -u "$user" \ | |
187 | ${pkgs.nix}/bin/nix-build --no-out-link '<nixpkgs>' -A "$(userenv_query "$user" .package)" | |
188 | done < <( config_query '.userEnvironments | keys []' ) | |
189 | ||
190 | # Install | |
191 | hydrate ${config.system.build.nixos-rebuild}/bin/nixos-rebuild switch | |
192 | while read user;do | |
193 | remove_arg=-r | |
194 | if [[ "$(userenv_query "$user" .otherPackagesAction)" == keep ]];then | |
195 | remove_arg= | |
196 | fi | |
197 | hydrate /run/wrappers/bin/sudo -u "$user" \ | |
198 | ${pkgs.nix}/bin/nix-env -f '<nixpkgs>' $remove_arg -iA "$(userenv_query "$user" .package)" | |
199 | done < <( config_query '.userEnvironments | keys []' ) | |
200 | '' | |
201 | } | |
202 | ''; | |
203 | ||
204 | in { | |
205 | options = { | |
206 | system.autoUpgradeWithPinch = { | |
207 | ||
208 | enable = mkOption { | |
209 | type = types.bool; | |
210 | default = false; | |
211 | description = '' | |
212 | Whether to periodically upgrade NixOS to the latest version. | |
213 | Presumes that /etc/nixos is a git repo with a remote and | |
214 | contains a pinch file called "channels". | |
215 | ''; | |
216 | }; | |
217 | ||
218 | dates = mkOption { | |
219 | default = "04:40"; | |
220 | type = types.str; | |
221 | description = '' | |
222 | Specification (in the format described by | |
223 | <citerefentry><refentrytitle>systemd.time</refentrytitle> | |
224 | <manvolnum>7</manvolnum></citerefentry>) of the time at | |
225 | which the update will occur. | |
226 | ''; | |
227 | }; | |
228 | ||
229 | signingKeys = mkOption { | |
230 | type = types.listOf types.path; | |
231 | description = '' | |
232 | Files containing GPG keys that are authorized to sign updates. | |
233 | Updates are only merged if the commit at the tip of the remote | |
234 | ref is signed with one of these keys. | |
235 | ''; | |
236 | }; | |
237 | ||
238 | upgradeConfig = mkOption { | |
239 | type = types.listOf types.path; | |
240 | description = '' | |
241 | Configuration files that specify what git repo paths to pull, what | |
242 | pinch files to update from, and what user environments to update. | |
243 | These are specified in separate configuration files processed at | |
244 | update time so that changes to this configuration take effect in | |
245 | the same update cycle. | |
246 | ''; | |
247 | }; | |
248 | ||
249 | upgradeConfigOwnershipPolicy = mkOption { | |
250 | type = types.enum [ "root" "wheel" "any" ]; | |
251 | default = "root"; | |
252 | description = '' | |
253 | Verify ownership of upgrade config files before using them for | |
254 | system upgrades. | |
255 | ||
256 | root = Config must be writable only by root. | |
257 | wheel = Config must be writable only by root and wheel. | |
258 | any = No checks. Not recommended. | |
259 | ''; | |
260 | }; | |
261 | }; | |
262 | }; | |
263 | ||
264 | config = lib.mkIf cfg.enable { | |
265 | ||
266 | security.sudo.extraRules = lib.mkAfter [{ | |
267 | groups = [ "users" ]; | |
268 | commands = [{ | |
269 | command = "${auto-upgrade-script}"; | |
270 | options = [ "NOPASSWD" "NOSETENV" ]; | |
271 | }]; | |
272 | }]; | |
273 | # NOSETENV above still allows through ~17 vars, including PATH. Block those | |
274 | # as well: | |
275 | security.sudo.extraConfig = '' | |
276 | Defaults!${auto-upgrade-script} !env_check | |
277 | Defaults!${auto-upgrade-script} !env_keep | |
278 | ''; | |
279 | ||
280 | nixpkgs.overlays = [ | |
281 | (import ../overlays/pinch.nix) | |
282 | (import ../overlays/polite-merge.nix) | |
283 | (self: super: { | |
284 | auto-upgrade = super.writeShellScriptBin "auto-upgrade" '' | |
285 | /run/wrappers/bin/sudo ${auto-upgrade-script} | |
286 | ''; | |
287 | }) | |
288 | ]; | |
289 | ||
290 | environment.systemPackages = [ pkgs.auto-upgrade ]; | |
291 | ||
292 | systemd.services.nixos-upgrade = { | |
293 | description = "NixOS Upgrade"; | |
294 | restartIfChanged = false; | |
295 | unitConfig.X-StopOnRemoval = false; | |
296 | serviceConfig.Type = "oneshot"; | |
297 | environment = config.nix.envVars // { | |
298 | inherit (config.environment.sessionVariables) NIX_PATH; | |
299 | HOME = "/root"; | |
300 | } // config.networking.proxy.envVars; | |
301 | ||
302 | path = with pkgs; [ | |
303 | config.nix.package.out | |
304 | coreutils | |
305 | git | |
306 | gitMinimal | |
307 | gnutar | |
308 | gzip | |
309 | xz.bin | |
310 | ]; | |
311 | ||
312 | script = '' | |
313 | set -eo pipefail | |
314 | ||
315 | # Chill for awhile before applying updates. If applying an update | |
316 | # badly breaks things, we want a window in which an operator can | |
317 | # intervene either to fix the problem or disable automatic updates. | |
318 | sleep 2h | |
319 | ||
320 | ${auto-upgrade-script} | |
321 | ''; | |
322 | ||
323 | startAt = cfg.dates; | |
324 | }; | |
325 | }; | |
326 | } |