git.scottworley.com Git - auto-upgrade-with-pinch/blob - modules/auto-upgrade.nix

   1 # auto-upgrade-with-pinch: Secure managed NixOS updates
   2 #
   3 # This program is free software: you can redistribute it and/or modify it
   4 # under the terms of the GNU General Public License as published by the
   5 # Free Software Foundation, version 3.
   6
   7 {
   8   config,
   9   lib,
  10   pkgs,
  11   ...
  12 }:
  13 with lib;
  14 let
  15   local-pkgs = import ../. { inherit pkgs; };
  16   cfg = config.system.autoUpgradeWithPinch;
  17   pull-repo-script = pkgs.writeShellScript "pull-repo" ''
  18     set -eo pipefail
  19
  20     path=$1
  21     config=$2
  22
  23     prop() {
  24       ${pkgs.jq}/bin/jq -r ".$1" <<< "$config"
  25     }
  26
  27     echo Pulling in "$path" >&2
  28
  29     if [[ ! -e "$path" ]];then
  30       d=$(mktemp -d)
  31       ${pkgs.git}/bin/git init "$d"
  32       ${pkgs.git}/bin/git -C "$d" checkout -b "$(prop localBranch)"
  33       ${pkgs.git}/bin/git -C "$d" remote add "$(prop remoteName)" "$(prop url)"
  34       ${pkgs.git}/bin/git -C "$d" branch -u "$(prop remoteBranch)"
  35       mkdir -p "$(${pkgs.coreutils}/bin/dirname "$path")"
  36       mv "$d" "$path"
  37     fi
  38
  39     cd "$path"
  40
  41     if [[ "$(${pkgs.git}/bin/git remote get-url "$(prop remoteName)")" != "$(prop url)" ]]; then
  42       echo Expected git remote "$(prop remoteName)" to point at "$(prop url)" \
  43         but it points at "$(${pkgs.git}/bin/git remote get-url "$(prop remoteName)")" >&2
  44       case "$(prop onRemoteURLMismatch)" in
  45         abort)  exit 1;;
  46         update) echo Updating it >&2
  47                 ${pkgs.git}/bin/git -C "$d" remote set-url "$(prop remoteName)" "$(prop url)";;
  48       esac
  49     fi
  50
  51     ${pkgs.git}/bin/git fetch "$(prop remoteName)" "$(prop remoteBranch)"
  52
  53     if [[ "$(${pkgs.git}/bin/git rev-parse --abbrev-ref HEAD)" != "$(prop localBranch)" ]];then
  54       echo Could not merge because currently-checked-out \
  55            \""$(${pkgs.git}/bin/git rev-parse --abbrev-ref HEAD)"\" is not \
  56            \""$(prop localBranch)"\"
  57       case "$(prop onBranchMismatch)" in
  58         abort) exit 1;;
  59         continue) exit 0;;
  60       esac
  61     fi
  62
  63     if [[ "$(prop requireSignature)" == true ]]; then
  64       ${pkgs.polite-merge}/bin/polite-merge \
  65         -c gpg.program=${escapeShellArg (local-pkgs.keyed-gpg cfg.signingKeys)} \
  66         merge --ff-only --verify-signatures
  67     else
  68       ${pkgs.polite-merge}/bin/polite-merge merge --ff-only
  69     fi
  70   '';
  71
  72   auto-upgrade-script = pkgs.writeShellScript "auto-upgrade" ''
  73     ${pkgs.coreutils}/bin/nice -n 17 \
  74     ${pkgs.util-linux}/bin/ionice -c 3 \
  75     ${pkgs.util-linux}/bin/flock /run/auto-upgrade-with-pinch ${pkgs.writeShellScript "auto-upgrade-with-lock-held" ''
  76       set -eo pipefail
  77
  78       dry_run=false
  79       pinch_args=()
  80       if [[ "$1" == --dry-run ]];then
  81         dry_run=true
  82         pinch_args=( --dry-run )
  83       fi
  84
  85       hydrate() {
  86         if "$dry_run";then
  87           echo "Would run: $*"
  88         else
  89           "$@"
  90         fi
  91       }
  92
  93       die() {
  94         echo "$*" >&2
  95         exit 1
  96       }
  97
  98       in_tmpdir() {
  99         d=$(${pkgs.coreutils}/bin/mktemp -d)
 100         pushd "$d"
 101         "$@"
 102         popd
 103         ${pkgs.coreutils}/bin/rm -r "$d"
 104       }
 105
 106       ${optionalString (cfg.upgradeConfigOwnershipPolicy != "any") (
 107         ''
 108           verify_ownership() {
 109             if [[ "$1" != /* ]];then
 110               die "Unexpected relative path: $1"
 111             fi
 112             if [[ "$1" != / ]];then
 113               verify_ownership "$(${pkgs.coreutils}/bin/dirname "$1")"
 114             fi
 115             if [[ ! -e "$1" ]];then
 116               die "Could not find upgrade config: $1 does not exist"
 117             fi
 118             if [[ -h "$1" ]];then
 119               verify_ownership "$(
 120                 ${pkgs.coreutils}/bin/realpath --no-symlinks \
 121                   "$(${pkgs.coreutils}/bin/dirname "$1")/$(${pkgs.coreutils}/bin/readlink "$1")"
 122               )"
 123             fi
 124             perms="$(${pkgs.findutils}/bin/find "$1" -maxdepth 0 -printf "%M")"
 125             if [[ "$perms" == d*t ]];then
 126               die "Will not use upgrade config in sticky directory $1"
 127             fi
 128             owner=$(${pkgs.findutils}/bin/find "$1" -maxdepth 0 -printf "%u")
 129             if [[ "$owner" != root ]];then
 130               die "Will not use upgrade config not owned by root in $1"
 131             fi
 132             if [[ "$perms" == l* ]];then
 133               return 0 # Root-owned symlinks are fine
 134             fi
 135             if [[ "$perms" == *w? ]];then
 136               die "Will not use world-writable upgrade config in $1"
 137             fi
 138             ${
 139               {
 140                 root = ''
 141                   if [[ "$perms" == *w???? ]];then
 142                     die "Will not use group-writable upgrade config in $1"
 143                   fi
 144                 '';
 145                 wheel = ''
 146                   if [[ "$perms" == *w???? ]];then
 147                     group=$(${pkgs.findutils}/bin/find "$1" -maxdepth 0 -printf "%g")
 148                     if [[ "$group" != wheel ]];then
 149                       die "Will not use non-wheel-group group-writable upgrade config in $1"
 150                     fi
 151                   fi
 152                 '';
 153               }
 154               ."${cfg.upgradeConfigOwnershipPolicy}"
 155             }
 156           }
 157         ''
 158         + concatMapStringsSep "\n" (f: "verify_ownership ${escapeShellArg f}") cfg.upgradeConfig
 159       )}
 160
 161       config=$(${pkgs.nix}/bin/nix-instantiate --eval --strict --json -A config \
 162         --arg upgradeConfig ${
 163           escapeShellArg (
 164             "[" + lib.concatMapStringsSep " " lib.strings.escapeNixString cfg.upgradeConfig + "]"
 165           )
 166         } ${../upgrade-config.nix})
 167
 168       config_query() {
 169         ${pkgs.jq}/bin/jq -r "$@" <<< "$config"
 170       }
 171
 172       repo_query() {
 173         config_query --arg path "$1" ".repos[\$ARGS.named.path]$2"
 174       }
 175
 176       userenv_query() {
 177         config_query --arg user "$1" ".userEnvironments[\$ARGS.named.user]$2"
 178       }
 179
 180       # Pull updates
 181       while read path;do
 182         hydrate /run/wrappers/bin/sudo -u "$(repo_query "$path" .user)" \
 183           ${pull-repo-script} "$path" "$(repo_query "$path" "")"
 184       done < <( config_query '.repos | keys []' )
 185
 186       # Update channels
 187       config_query '.pinchFiles[]' | ${pkgs.findutils}/bin/xargs --no-run-if-empty --delimiter=\\n ${pkgs.pinch}/bin/pinch update "''${pinch_args[@]}"
 188
 189       # Build
 190       in_tmpdir hydrate ${config.system.build.nixos-rebuild}/bin/nixos-rebuild build
 191       while read user;do
 192         pushd /
 193         hydrate /run/wrappers/bin/sudo -u "$user" \
 194           ${pkgs.nix}/bin/nix-build --no-out-link '<nixpkgs>' -A "$(userenv_query "$user" .package)"
 195         popd
 196       done < <( config_query '.userEnvironments | keys []' )
 197       sync
 198
 199       # Install
 200       hydrate ${config.system.build.nixos-rebuild}/bin/nixos-rebuild ${cfg.operation}
 201       sync
 202       while read user;do
 203         remove_arg=-r
 204         if [[ "$(userenv_query "$user" .otherPackagesAction)" == keep ]];then
 205           remove_arg=
 206         fi
 207         hydrate /run/wrappers/bin/sudo -u "$user" \
 208           ${pkgs.nix}/bin/nix-env -f '<nixpkgs>' $remove_arg -iA "$(userenv_query "$user" .package)"
 209         sync
 210       done < <( config_query '.userEnvironments | keys []' )
 211     ''}
 212   '';
 213
 214 in
 215 {
 216   options = {
 217     system.autoUpgradeWithPinch = {
 218
 219       enable = mkOption {
 220         type = types.bool;
 221         default = false;
 222         description = ''
 223           Whether to periodically upgrade NixOS to the latest version.
 224           Presumes that /etc/nixos is a git repo with a remote and
 225           contains a pinch file called "channels".
 226         '';
 227       };
 228
 229       dates = mkOption {
 230         default = "04:40";
 231         type = types.str;
 232         description = ''
 233           Specification (in the format described by
 234           <citerefentry><refentrytitle>systemd.time</refentrytitle>
 235           <manvolnum>7</manvolnum></citerefentry>) of the time at
 236           which the update will occur.
 237         '';
 238       };
 239
 240       operation = lib.mkOption {
 241         type = lib.types.enum [
 242           "switch"
 243           "boot"
 244         ];
 245         default = "switch";
 246         example = "boot";
 247         description = ''
 248           Whether to run
 249           `nixos-rebuild switch --upgrade` or run
 250           `nixos-rebuild boot --upgrade`
 251         '';
 252       };
 253
 254       signingKeys = mkOption {
 255         type = types.listOf types.path;
 256         description = ''
 257           Files containing GPG keys that are authorized to sign updates.
 258           Updates are only merged if the commit at the tip of the remote
 259           ref is signed with one of these keys.
 260         '';
 261       };
 262
 263       upgradeConfig = mkOption {
 264         type = types.listOf types.path;
 265         description = ''
 266           Configuration files that specify what git repo paths to pull, what
 267           pinch files to update from, and what user environments to update.
 268           These are specified in separate configuration files processed at
 269           update time so that changes to this configuration take effect in
 270           the same update cycle.
 271         '';
 272       };
 273
 274       upgradeConfigOwnershipPolicy = mkOption {
 275         type = types.enum [
 276           "root"
 277           "wheel"
 278           "any"
 279         ];
 280         default = "root";
 281         description = ''
 282           Verify ownership of upgrade config files before using them for
 283           system upgrades.
 284
 285           root = Config must be writable only by root.
 286           wheel = Config must be writable only by root and wheel.
 287           any = No checks.  Not recommended.
 288         '';
 289       };
 290     };
 291   };
 292
 293   config = lib.mkIf cfg.enable {
 294
 295     security.sudo.extraRules = lib.mkAfter [
 296       {
 297         groups = [ "users" ];
 298         runAs = "root";
 299         commands = [
 300           {
 301             command = "${auto-upgrade-script}";
 302             options = [
 303               "NOPASSWD"
 304               "NOSETENV"
 305             ];
 306           }
 307         ];
 308       }
 309     ];
 310     # NOSETENV above still allows through ~17 vars, including PATH.  Block those
 311     # as well:
 312     security.sudo.extraConfig = ''
 313       Defaults!${auto-upgrade-script} !env_check
 314       Defaults!${auto-upgrade-script} !env_keep
 315     '';
 316
 317     nixpkgs.overlays = [
 318       (import ../overlays/pinch.nix)
 319       (import ../overlays/polite-merge.nix)
 320       (self: super: {
 321         auto-upgrade = super.writeShellScriptBin "auto-upgrade" ''
 322           /run/wrappers/bin/sudo ${auto-upgrade-script}
 323         '';
 324       })
 325     ];
 326
 327     environment.systemPackages = [ pkgs.auto-upgrade ];
 328
 329     systemd.services.nixos-upgrade = {
 330       description = "NixOS Upgrade";
 331       restartIfChanged = false;
 332       unitConfig.X-StopOnRemoval = false;
 333       serviceConfig.Type = "oneshot";
 334       environment =
 335         config.nix.envVars
 336         // {
 337           inherit (config.environment.sessionVariables) NIX_PATH;
 338           HOME = "/root";
 339         }
 340         // config.networking.proxy.envVars;
 341
 342       path = with pkgs; [
 343         config.nix.package.out
 344         coreutils
 345         git
 346         gitMinimal
 347         gnutar
 348         gzip
 349         xz.bin
 350       ];
 351
 352       script = ''
 353         set -eo pipefail
 354
 355         # Chill for awhile before applying updates.  If applying an update
 356         # badly breaks things, we want a window in which an operator can
 357         # intervene either to fix the problem or disable automatic updates.
 358         sleep 2h
 359
 360         ${auto-upgrade-script}
 361       '';
 362
 363       startAt = cfg.dates;
 364     };
 365   };
 366 }