confctl 2.2.3 → 3.0.0

data/lib/confctl/inputs/git_commit.rb

@@ -0,0 +1,17 @@
+module ConfCtl
+  module Inputs
+    class GitCommit
+      def self.commit!(conf_dir:, message:, editor:, files:)
+        args = %w[git commit]
+        args << '-e' if editor && $stdout.tty?
+        args << '-m' << message
+        args.concat(files)
+
+        Dir.chdir(conf_dir) do
+          ok = Kernel.system(*args)
+          raise 'git commit failed' unless ok
+        end
+      end
+    end
+  end
+end

data/lib/confctl/inputs/nix_output_guard.rb

@@ -0,0 +1,37 @@
+module ConfCtl
+  module Inputs
+    module NixOutputGuard
+      GITHUB_API_CACHE_FALLBACK =
+        %r{unable to download 'https://api\.github\.com/.*using cached version}m
+      GITHUB_RATE_LIMIT = /rate limit exceeded/i
+
+      def self.check!(result)
+        output = [result&.stdout, result&.stderr].compact.join("\n")
+        return unless github_api_cache_fallback?(output)
+
+        if github_rate_limit?(output)
+          raise ConfCtl::Error, <<~MSG.strip
+            Nix could not refresh GitHub input metadata because the GitHub API rate limit was exceeded.
+            It used a cached version instead, so the selected input may not be the latest revision.
+            Configure a GitHub token in Nix access-tokens or retry later.
+          MSG
+        end
+
+        raise ConfCtl::Error, <<~MSG.strip
+          Nix could not refresh GitHub input metadata and used a cached version instead.
+          The selected input may not be the latest revision; retry after the GitHub API is reachable.
+        MSG
+      end
+
+      def self.github_api_cache_fallback?(output)
+        output.match?(GITHUB_API_CACHE_FALLBACK)
+      end
+
+      def self.github_rate_limit?(output)
+        output.match?(GITHUB_RATE_LIMIT)
+      end
+
+      private_class_method :github_api_cache_fallback?, :github_rate_limit?
+    end
+  end
+end

data/lib/confctl/inputs/setter.rb

@@ -0,0 +1,179 @@
+require 'confctl/flake_lock'
+require 'confctl/flake_lock_diff'
+require 'confctl/inputs/commit_message'
+require 'confctl/inputs/git_commit'
+require 'confctl/inputs/nix_output_guard'
+require 'confctl/system_command'
+require 'fileutils'
+require 'json'
+require 'securerandom'
+
+module ConfCtl
+  module Inputs
+    class Setter
+      def self.run!(conf_dir:, inputs:, rev:, commit:, changelog:, downgrade:, editor:)
+        raise ArgumentError, 'inputs empty' if inputs.nil? || inputs.empty?
+
+        lock_path = File.join(conf_dir, 'flake.lock')
+        unless File.exist?(lock_path)
+          raise ConfCtl::Error, 'flake.lock missing; run confctl inputs update first'
+        end
+
+        old_lock = ConfCtl::FlakeLock.load(lock_path)
+        old_lock_data = JSON.parse(File.read(lock_path))
+
+        saved_original = {}
+        override_urls = {}
+
+        inputs.each do |input|
+          node_id = resolve_node_id(old_lock_data, input)
+          saved_original[input] = deep_dup(old_lock_data.dig('nodes', node_id, 'original'))
+
+          input_info = old_lock.input_info(input)
+          type = input_info[:type]
+          unless %w[github git].include?(type)
+            raise ConfCtl::Error, "input '#{input}' has unsupported type '#{type}' for set"
+          end
+
+          override_urls[input] = build_override_url(input_info, rev)
+        end
+
+        apply_inputs!(conf_dir, inputs, override_urls, saved_original, lock_path)
+
+        new_lock = ConfCtl::FlakeLock.load(lock_path)
+        changes = ConfCtl::FlakeLockDiff.diff(old_lock, new_lock, inputs: inputs)
+
+        return { changed: false, changes: [] } if changes.empty?
+
+        if commit
+          msg = ConfCtl::Inputs::CommitMessage.build(
+            changes: changes,
+            changelog: changelog,
+            downgrade: downgrade,
+            action: :set
+          )
+          ConfCtl::Inputs::GitCommit.commit!(
+            conf_dir: conf_dir,
+            message: msg,
+            editor: editor,
+            files: ['flake.lock']
+          )
+        end
+
+        { changed: true, changes: changes }
+      end
+
+      def self.resolve_node_id(lock_data, input_name)
+        node_id = lock_data.dig('nodes', 'root', 'inputs', input_name)
+
+        return node_id if node_id.is_a?(String)
+        return node_id[0] if node_id.is_a?(Array) && node_id[0].is_a?(String)
+
+        raise ConfCtl::Error, "unknown input '#{input_name}'"
+      end
+
+      def self.build_override_url(input_info, rev)
+        locked = input_info[:locked] || {}
+        original = input_info[:original] || {}
+
+        case input_info[:type]
+        when 'github'
+          owner = locked['owner'] || original['owner']
+          repo = locked['repo'] || original['repo']
+          dir = locked['dir'] || original['dir']
+          raise ConfCtl::Error, 'missing github owner or repo' unless owner && repo
+
+          url = "github:#{owner}/#{repo}/#{rev}"
+          url += "?dir=#{dir}" if dir
+          url
+        when 'git'
+          url = locked['url'] || original['url']
+          raise ConfCtl::Error, 'missing git url' unless url
+
+          url = url.sub(/^git\+/, '')
+          separator = url.include?('?') ? '&' : '?'
+          "git+#{url}#{separator}rev=#{rev}"
+        else
+          raise ConfCtl::Error, "unsupported input type '#{input_info[:type]}'"
+        end
+      end
+
+      def self.run_nix_flake_lock!(conf_dir, input, override_url, tmpfile)
+        cmd = ConfCtl::SystemCommand.new
+        extra_experimental = false
+
+        loop do
+          args = ['nix']
+          if extra_experimental
+            args << '--extra-experimental-features' << 'nix-command'
+            args << '--extra-experimental-features' << 'flakes'
+          end
+          args << 'flake' << 'lock'
+          args << '--update-input' << input
+          args << '--override-input' << input << override_url
+          args << '--output-lock-file' << tmpfile
+
+          begin
+            result = Dir.chdir(conf_dir) { cmd.run(*args) }
+            ConfCtl::Inputs::NixOutputGuard.check!(result)
+            break
+          rescue TTY::Command::ExitError => e
+            if !extra_experimental && experimental_error?(e.message)
+              extra_experimental = true
+              next
+            end
+
+            raise
+          end
+        end
+      end
+
+      def self.experimental_error?(message)
+        message.match?(/experimental/i) && message.match?(/nix-command|flakes/i)
+      end
+
+      def self.apply_inputs!(conf_dir, inputs, override_urls, saved_original, lock_path)
+        inputs.each do |input|
+          tmpfile = build_tmp_lock_path(conf_dir)
+
+          begin
+            run_nix_flake_lock!(conf_dir, input, override_urls[input], tmpfile)
+
+            tmp_lock_data = JSON.parse(File.read(tmpfile))
+            inputs.each do |name|
+              node_id = resolve_node_id(tmp_lock_data, name)
+              node = tmp_lock_data.dig('nodes', node_id) || {}
+              original = saved_original[name]
+
+              if original.nil?
+                node.delete('original')
+              else
+                node['original'] = deep_dup(original)
+              end
+
+              tmp_lock_data['nodes'][node_id] = node
+            end
+
+            File.write(tmpfile, "#{JSON.pretty_generate(tmp_lock_data)}\n")
+            File.rename(tmpfile, lock_path)
+          ensure
+            FileUtils.rm_f(tmpfile) if tmpfile && File.exist?(tmpfile)
+          end
+        end
+      end
+
+      def self.deep_dup(obj)
+        return nil if obj.nil?
+
+        Marshal.load(Marshal.dump(obj))
+      end
+
+      def self.build_tmp_lock_path(conf_dir)
+        File.join(conf_dir, "flake.lock.tmp-#{Process.pid}-#{SecureRandom.hex(6)}")
+      end
+
+      private_class_method :resolve_node_id, :build_override_url, :run_nix_flake_lock!,
+                           :experimental_error?, :apply_inputs!, :deep_dup, :build_tmp_lock_path
+    end
+  end
+end

data/lib/confctl/inputs/updater.rb

@@ -0,0 +1,76 @@
+require 'confctl/flake_lock'
+require 'confctl/flake_lock_diff'
+require 'confctl/inputs/commit_message'
+require 'confctl/inputs/git_commit'
+require 'confctl/inputs/nix_output_guard'
+require 'confctl/system_command'
+
+module ConfCtl
+  module Inputs
+    class Updater
+      def self.run!(conf_dir:, inputs:, commit:, changelog:, downgrade:, editor:)
+        raise ArgumentError, 'inputs empty' if inputs.nil? || inputs.empty?
+
+        lock_path = File.join(conf_dir, 'flake.lock')
+        old_lock = ConfCtl::FlakeLock.load_optional(lock_path)
+
+        run_nix_flake_update!(conf_dir, inputs)
+
+        new_lock = ConfCtl::FlakeLock.load(lock_path)
+        changes = ConfCtl::FlakeLockDiff.diff(old_lock, new_lock, inputs: inputs)
+
+        return { changed: false, changes: [] } if changes.empty?
+
+        if commit
+          msg = ConfCtl::Inputs::CommitMessage.build(
+            changes: changes,
+            changelog: changelog,
+            downgrade: downgrade
+          )
+          ConfCtl::Inputs::GitCommit.commit!(
+            conf_dir: conf_dir,
+            message: msg,
+            editor: editor,
+            files: ['flake.lock']
+          )
+        end
+
+        { changed: true, changes: changes }
+      end
+
+      def self.run_nix_flake_update!(conf_dir, inputs)
+        cmd = ConfCtl::SystemCommand.new
+        extra_experimental = false
+
+        loop do
+          args = ['nix']
+          if extra_experimental
+            args << '--extra-experimental-features' << 'nix-command'
+            args << '--extra-experimental-features' << 'flakes'
+          end
+          args << 'flake' << 'update'
+          args.concat(inputs) if inputs
+
+          begin
+            result = Dir.chdir(conf_dir) { cmd.run(*args) }
+            ConfCtl::Inputs::NixOutputGuard.check!(result)
+            break
+          rescue TTY::Command::ExitError => e
+            if !extra_experimental && experimental_error?(e.message)
+              extra_experimental = true
+              next
+            end
+
+            raise
+          end
+        end
+      end
+
+      def self.experimental_error?(message)
+        message.match?(/experimental/i) && message.match?(/nix-command|flakes/i)
+      end
+
+      private_class_method :run_nix_flake_update!, :experimental_error?
+    end
+  end
+end

data/lib/confctl/inputs.rb

@@ -0,0 +1,5 @@
+module ConfCtl
+  module Inputs; end
+end
+
+require_rel 'inputs'

data/lib/confctl/inputs_info.rb

@@ -0,0 +1,50 @@
+require 'json'
+
+module ConfCtl
+  class InputsInfo
+    KEYS = %w[input url rev shortRev lastModified].freeze
+
+    def self.parse(json)
+      normalize(JSON.parse(json))
+    rescue JSON::ParserError => e
+      raise Error, "unable to parse inputs info: #{e.message}"
+    end
+
+    def self.normalize(hash)
+      return nil unless hash.is_a?(Hash)
+
+      hash.each_with_object({}) do |(role, info), acc|
+        acc[role.to_s] = normalize_info(info)
+      end
+    end
+
+    def self.normalize_info(info)
+      case info
+      when String
+        rev = info
+        data = { 'rev' => rev, 'shortRev' => rev && rev[0, 8] }
+        data.compact
+      when Hash
+        normalized = {}
+
+        info.each do |k, v|
+          key = k.to_s
+          case key
+          when 'input', 'url', 'rev', 'shortRev', 'lastModified'
+            normalized[key] = v
+          when 'short_rev'
+            normalized['shortRev'] = v
+          end
+        end
+
+        if normalized['shortRev'].nil? && normalized['rev']
+          normalized['shortRev'] = normalized['rev'][0, 8]
+        end
+
+        normalized
+      else
+        {}
+      end
+    end
+  end
+end

data/lib/confctl/line_buffer.rb

@@ -29,7 +29,7 @@ module ConfCtl
       return if nl.nil?
 
       line = buffer[0..nl]
-      @buffer = buffer[nl + 1..]
+      @buffer = buffer[(nl + 1)..]
       line
     end
 

data/lib/confctl/machine.rb

@@ -4,8 +4,7 @@ module ConfCtl
       :carrier,
       :name,
       :alias,
-      :attribute,
-      keyword_init: true
+      :attribute
     )
 
     # @return [String]
@@ -17,6 +16,9 @@ module ConfCtl
     # @return [Boolean]
     attr_reader :managed
 
+    # @return [String, nil]
+    attr_reader :key
+
     # @return [String]
     attr_reader :spin
 
@@ -47,6 +49,7 @@ module ConfCtl
       @name = opts['name']
       @safe_name = name.gsub('/', ':')
       @managed = meta['managed']
+      @key = opts['key'] || opts['machineKey'] || opts['flakeKey']
       @spin = meta['spin']
       @is_carrier = meta.fetch('carrier', {}).fetch('enable', false)
       @carrier_name = opts['carrier']
@@ -94,10 +97,18 @@ module ConfCtl
       meta.fetch('host', {}).fetch('target', name)
     end
 
+    def target_port
+      meta.fetch('host', {}).fetch('port', 22).to_i
+    end
+
     def localhost?
       target_host == 'localhost'
     end
 
+    def runnable?
+      !carried? && !target_host.nil?
+    end
+
     # @return [String] path to nix-env managed profile
     def profile
       if carried?
@@ -112,7 +123,7 @@ module ConfCtl
         eq = v.index('=')
         raise "'#{v}' is not a valid nix path entry " if eq.nil?
 
-        [v[0..eq - 1], v[eq + 1..]]
+        [v[0..(eq - 1)], v[(eq + 1)..]]
       end
     end
 
@@ -150,6 +161,8 @@ module ConfCtl
           end
 
         when 'builderCommands', 'machineCommands'
+          next if type == 'machineCommands' && !runnable?
+
           checks.each do |cmd|
             health_checks << HealthChecks::RunCommand.new(
               self,
@@ -171,6 +184,8 @@ module ConfCtl
         get(meta, key.split('.'))
       elsif key == 'name'
         name
+      elsif %w[key machineKey flakeKey].include?(key)
+        @key
       elsif key == 'checks'
         health_checks.length
       else

data/lib/confctl/machine_control.rb

@@ -1,4 +1,5 @@
 require 'etc'
+require 'shellwords'
 
 module ConfCtl
   class MachineControl
@@ -158,7 +159,7 @@ module ConfCtl
         if machine.localhost?
           command
         else
-          ssh_args + command
+          ssh_args + [Shellwords.join(command)]
         end
 
       cmd.method(method).call(*args, **kwargs, &)
@@ -174,7 +175,12 @@ module ConfCtl
     end
 
     def ssh_args
-      ['ssh', '-l', 'root'] + extra_ssh_opts + [machine.target_host]
+      ret = ['ssh']
+      ssh_config = ENV.fetch('CONFCTL_SSH_CONFIG', nil)
+      ret += ['-F', ssh_config] if ssh_config && !ssh_config.empty?
+      ret += ['-l', 'root']
+      ret += ['-p', machine.target_port.to_s] if machine.target_port != 22
+      ret + extra_ssh_opts + [machine.target_host]
     end
   end
 end

data/lib/confctl/machine_list.rb

@@ -64,7 +64,7 @@ module ConfCtl
 
     # @return [MachineList]
     def runnable
-      select { |_host, machine| !machine.carried? && machine.target_host }
+      select { |_host, machine| machine.runnable? }
     end
 
     # @param host [String]
@@ -99,7 +99,7 @@ module ConfCtl
       checks = []
 
       machines.each_value do |machine|
-        next if machine.carried?
+        next unless machine.runnable?
 
         checks.concat(machine.health_checks)
       end

data/lib/confctl/machine_status.rb

@@ -1,5 +1,6 @@
 require 'json'
 require 'tty-command'
+require 'confctl/inputs_info'
 
 module ConfCtl
   class MachineStatus
@@ -73,9 +74,15 @@ module ConfCtl
     # @return [Hash]
     attr_accessor :target_swpin_specs
 
+    # @return [Hash]
+    attr_accessor :target_inputs_info
+
     # @return [Hash]
     attr_reader :swpins_info
 
+    # @return [Hash]
+    attr_reader :inputs_info
+
     # @return [Hash]
     attr_reader :swpins_state
 
@@ -86,7 +93,7 @@ module ConfCtl
     end
 
     # Connect to the machine and query its state
-    def query(toplevel: true, generations: true)
+    def query(toplevel: true, generations: true, swpins: true, inputs: false)
       begin
         @uptime = mc.uptime
       rescue TTY::Command::ExitError
@@ -109,8 +116,18 @@ module ConfCtl
         end
       end
 
+      if swpins
+        begin
+          @swpins_info = query_swpins
+        rescue Error
+          nil
+        end
+      end
+
+      return unless inputs
+
       begin
-        @swpins_info = query_swpins
+        @inputs_info = query_inputs_info
       rescue Error
         nil
       end
@@ -145,12 +162,7 @@ module ConfCtl
     end
 
     def query_swpins
-      json =
-        if machine.carried?
-          query_carried_swpins
-        else
-          mc.read_file('/etc/confctl/swpins-info.json')
-        end
+      json = read_swpins_info_json
 
       case json
       when String
@@ -160,22 +172,53 @@ module ConfCtl
       end
     end
 
-    # @return [Hash, String]
-    def query_carried_swpins
-      begin
-        json = mc.read_file(File.join(machine.profile, 'machine.json'))
-        parsed = JSON.parse(json)
-        return parsed['swpins-info'] if parsed['swpins-info']
-      rescue TTY::Command::ExitError
-        # pass
+    def query_inputs_info
+      json = read_inputs_info_json
+
+      case json
+      when String
+        InputsInfo.parse(json)
+      when Hash
+        InputsInfo.normalize(json)
       end
+    end
 
-      begin
-        return mc.read_file(File.join(machine.profile, '/etc/confctl/swpins-info.json'))
-      rescue TTY::Command::ExitError
-        # pass
+    # @return [Hash, String, nil]
+    def read_swpins_info_json
+      if machine.carried?
+        read_carried_info_json('swpins-info', '/etc/confctl/swpins-info.json')
+      else
+        read_file('/etc/confctl/swpins-info.json')
+      end
+    end
+
+    # @return [Hash, String, nil]
+    def read_inputs_info_json
+      if machine.carried?
+        read_carried_info_json('inputs-info', '/etc/confctl/inputs-info.json')
+      else
+        read_file('/etc/confctl/inputs-info.json')
       end
+    end
+
+    def read_carried_info_json(key, path)
+      info = read_carried_machine_json(key)
+      return info if info
+
+      read_file(File.join(machine.profile, path))
+    end
+
+    def read_carried_machine_json(key)
+      json = mc.read_file(File.join(machine.profile, 'machine.json'))
+      parsed = JSON.parse(json)
+      parsed[key] if parsed[key]
+    rescue TTY::Command::ExitError, JSON::ParserError
+      nil
+    end
 
+    def read_file(path)
+      mc.read_file(path)
+    rescue TTY::Command::ExitError
       nil
     end
   end

data/lib/confctl/nix/args.rb

@@ -0,0 +1,48 @@
+module ConfCtl
+  class Nix
+    class Args
+      DEFAULT_LEGACY_NAMES = %w[nixpkgs vpsadminos vpsadmin].freeze
+
+      def initialize(settings:, impure: nil, no_update_lock_file: true)
+        @settings = settings || {}
+        @impure_override = impure
+        @no_update_lock_file = no_update_lock_file
+      end
+
+      def impure?
+        return @impure_override unless @impure_override.nil?
+
+        @settings.dig('nix', 'impureEval') == true
+      end
+
+      def legacy_nix_path?
+        @settings.dig('nix', 'legacyNixPath') == true
+      end
+
+      def legacy_names
+        names = @settings.dig('nix', 'legacyNixPathMap')
+        return DEFAULT_LEGACY_NAMES if names.nil?
+
+        names
+      end
+
+      def eval_args
+        base_args
+      end
+
+      def build_args
+        base_args
+      end
+
+      private
+
+      def base_args
+        args = []
+        args << '--impure' if impure?
+        args << '--no-write-lock-file'
+        args << '--no-update-lock-file' if @no_update_lock_file
+        args
+      end
+    end
+  end
+end