kamal-insecure 2.7.0

data/lib/kamal/configuration/validator/env.rb

@@ -0,0 +1,54 @@
+class Kamal::Configuration::Validator::Env < Kamal::Configuration::Validator
+  SPECIAL_KEYS = [ "clear", "secret", "tags" ]
+
+  def validate!
+    if known_keys.any?
+      validate_complex_env!
+    else
+      validate_simple_env!
+    end
+  end
+
+  private
+    def validate_simple_env!
+      validate_hash_of!(config, String)
+    end
+
+    def validate_complex_env!
+      unknown_keys_error unknown_keys if unknown_keys.any?
+
+      with_context("clear") { validate_hash_of!(config["clear"], String) } if config.key?("clear")
+      with_context("secret") { validate_array_of!(config["secret"], String) } if config.key?("secret")
+      validate_tags! if config.key?("tags")
+    end
+
+    def known_keys
+      @known_keys ||= config.keys & SPECIAL_KEYS
+    end
+
+    def unknown_keys
+      @unknown_keys ||= config.keys - SPECIAL_KEYS
+    end
+
+    def validate_tags!
+      if context == "env"
+        with_context("tags") do
+          validate_type! config["tags"], Hash
+
+          config["tags"].each do |tag, value|
+            with_context(tag) do
+              validate_type! value, Hash
+
+              Kamal::Configuration::Validator::Env.new(
+                value,
+                example: example["tags"].values[1],
+                context: context
+              ).validate!
+            end
+          end
+        end
+      else
+        error "tags are only allowed in the root env"
+      end
+    end
+end

data/lib/kamal/configuration/validator/proxy.rb

@@ -0,0 +1,25 @@
+class Kamal::Configuration::Validator::Proxy < Kamal::Configuration::Validator
+  def validate!
+    unless config.nil?
+      super
+
+      if config["host"].blank? && config["hosts"].blank? && config["ssl"]
+        error "Must set a host to enable automatic SSL"
+      end
+
+      if (config.keys & [ "host", "hosts" ]).size > 1
+        error "Specify one of 'host' or 'hosts', not both"
+      end
+
+      if config["ssl"].is_a?(Hash)
+        if config["ssl"]["certificate_pem"].present? && config["ssl"]["private_key_pem"].blank?
+          error "Missing private_key_pem setting (required when certificate_pem is present)"
+        end
+
+        if config["ssl"]["private_key_pem"].present? && config["ssl"]["certificate_pem"].blank?
+          error "Missing certificate_pem setting (required when private_key_pem is present)"
+        end
+      end
+    end
+  end
+end

data/lib/kamal/configuration/validator/registry.rb

@@ -0,0 +1,25 @@
+class Kamal::Configuration::Validator::Registry < Kamal::Configuration::Validator
+  STRING_OR_ONE_ITEM_ARRAY_KEYS = [ "username", "password" ]
+
+  def validate!
+    validate_against_example! \
+      config.except(*STRING_OR_ONE_ITEM_ARRAY_KEYS),
+      example.except(*STRING_OR_ONE_ITEM_ARRAY_KEYS)
+
+    validate_string_or_one_item_array! "username"
+    validate_string_or_one_item_array! "password"
+  end
+
+  private
+    def validate_string_or_one_item_array!(key)
+      with_context(key) do
+        value = config[key]
+
+        error "is required" unless value.present?
+
+        unless value.is_a?(String) || (value.is_a?(Array) && value.size == 1 && value.first.is_a?(String))
+          error "should be a string or an array with one string (for secret lookup)"
+        end
+      end
+    end
+end

data/lib/kamal/configuration/validator/role.rb

@@ -0,0 +1,13 @@
+class Kamal::Configuration::Validator::Role < Kamal::Configuration::Validator
+  def validate!
+    validate_type! config, Array, Hash
+
+    if config.is_a?(Array)
+      validate_servers!(config)
+    else
+      super
+      validate_labels!(config["labels"])
+      validate_docker_options!(config["options"])
+    end
+  end
+end

data/lib/kamal/configuration/validator/servers.rb

@@ -0,0 +1,7 @@
+class Kamal::Configuration::Validator::Servers < Kamal::Configuration::Validator
+  def validate!
+    validate_type! config, Array, Hash, NilClass
+
+    validate_servers! config if config.is_a?(Array)
+  end
+end

data/lib/kamal/configuration/validator.rb

@@ -0,0 +1,191 @@
+class Kamal::Configuration::Validator
+  attr_reader :config, :example, :context
+
+  def initialize(config, example:, context:)
+    @config = config
+    @example = example
+    @context = context
+  end
+
+  def validate!
+    validate_against_example! config, example
+  end
+
+  private
+    def validate_against_example!(validation_config, example)
+      validate_type! validation_config, example.class
+
+      if example.class == Hash
+        check_unknown_keys! validation_config, example
+
+        validation_config.each do |key, value|
+          next if extension?(key)
+          with_context(key) do
+            example_value = example[key]
+
+            if example_value == "..."
+              unless key.to_s == "proxy" && boolean?(value.class)
+                validate_type! value, *(Array if key == :servers), Hash
+              end
+            elsif key.to_s == "ssl"
+                validate_type! value, TrueClass, FalseClass, Hash
+            elsif key == "hosts"
+              validate_servers! value
+            elsif example_value.is_a?(Array)
+              if key == "arch"
+                validate_array_of_or_type! value, example_value.first.class
+              else
+                validate_array_of! value, example_value.first.class
+              end
+            elsif example_value.is_a?(Hash)
+              case key.to_s
+              when "options", "args"
+                validate_type! value, Hash
+              when "labels"
+                validate_hash_of! value, example_value.first[1].class
+              else
+                validate_against_example! value, example_value
+              end
+            else
+              validate_type! value, example_value.class
+            end
+          end
+        end
+      end
+    end
+
+
+    def valid_type?(value, type)
+      value.is_a?(type) ||
+        (type == String && stringish?(value)) ||
+        (boolean?(type) && boolean?(value.class))
+    end
+
+    def type_description(type)
+      if type == Integer || type == Array
+        "an #{type.name.downcase}"
+      elsif type == TrueClass || type == FalseClass
+        "a boolean"
+      else
+        "a #{type.name.downcase}"
+      end
+    end
+
+    def boolean?(type)
+      type == TrueClass || type == FalseClass
+    end
+
+    def stringish?(value)
+      value.is_a?(String) || value.is_a?(Symbol) || value.is_a?(Numeric) || value.is_a?(TrueClass) || value.is_a?(FalseClass)
+    end
+
+    def validate_array_of_or_type!(value, type)
+      if value.is_a?(Array)
+        validate_array_of! value, type
+      else
+        validate_type! value, type
+      end
+    rescue Kamal::ConfigurationError
+      type_error(Array, type)
+    end
+
+    def validate_array_of!(array, type)
+      validate_type! array, Array
+
+      array.each_with_index do |value, index|
+        with_context(index) do
+          validate_type! value, type
+        end
+      end
+    end
+
+    def validate_hash_of!(hash, type)
+      validate_type! hash, Hash
+
+      hash.each do |key, value|
+        with_context(key) do
+          validate_type! value, type
+        end
+      end
+    end
+
+    def validate_servers!(servers)
+      validate_type! servers, Array
+
+      servers.each_with_index do |server, index|
+        with_context(index) do
+          validate_type! server, String, Hash
+
+          if server.is_a?(Hash)
+            error "multiple hosts found" unless server.size == 1
+            host, tags = server.first
+
+            with_context(host) do
+              validate_type! tags, String, Array
+              validate_array_of! tags, String if tags.is_a?(Array)
+            end
+          end
+        end
+      end
+    end
+
+    def validate_type!(value, *types)
+      type_error(*types) unless types.any? { |type| valid_type?(value, type) }
+    end
+
+    def error(message)
+      raise Kamal::ConfigurationError, "#{error_context}#{message}"
+    end
+
+    def type_error(*expected_types)
+      error "should be #{expected_types.map { |type| type_description(type) }.join(" or ")}"
+    end
+
+    def unknown_keys_error(unknown_keys)
+      error "unknown #{"key".pluralize(unknown_keys.count)}: #{unknown_keys.join(", ")}"
+    end
+
+    def error_context
+      "#{context}: " if context.present?
+    end
+
+    def with_context(context)
+      old_context = @context
+      @context = [ @context, context ].select(&:present?).join("/")
+      yield
+    ensure
+      @context = old_context
+    end
+
+    def allow_extensions?
+      false
+    end
+
+    def extension?(key)
+      key.to_s.start_with?("x-")
+    end
+
+    def check_unknown_keys!(config, example)
+      unknown_keys = config.keys - example.keys
+      unknown_keys.reject! { |key| extension?(key) } if allow_extensions?
+      unknown_keys_error unknown_keys if unknown_keys.present?
+    end
+
+    def validate_labels!(labels)
+      return true if labels.blank?
+
+      with_context("labels") do
+        labels.each do |key, _|
+          with_context(key) do
+            error "invalid label. destination, role, and service are reserved labels" if %w[destination role service].include?(key)
+          end
+        end
+      end
+    end
+
+    def validate_docker_options!(options)
+      if options
+        error "Cannot set restart policy in docker options, unless-stopped is required" if options["restart"]
+      end
+    end
+end

data/lib/kamal/configuration/volume.rb

@@ -0,0 +1,22 @@
+class Kamal::Configuration::Volume
+  attr_reader :host_path, :container_path
+  delegate :argumentize, to: Kamal::Utils
+
+  def initialize(host_path:, container_path:)
+    @host_path = host_path
+    @container_path = container_path
+  end
+
+  def docker_args
+    argumentize "--volume", "#{host_path_for_docker_volume}:#{container_path}"
+  end
+
+  private
+    def host_path_for_docker_volume
+      if Pathname.new(host_path).absolute?
+        host_path
+      else
+        File.join "$(pwd)", host_path
+      end
+    end
+end

data/lib/kamal/configuration.rb

@@ -0,0 +1,372 @@
+require "active_support/ordered_options"
+require "active_support/core_ext/string/inquiry"
+require "active_support/core_ext/module/delegation"
+require "active_support/core_ext/hash/keys"
+require "erb"
+require "net/ssh/proxy/jump"
+
+class Kamal::Configuration
+  delegate :service, :image, :labels, :hooks_path, to: :raw_config, allow_nil: true
+  delegate :argumentize, :optionize, to: Kamal::Utils
+
+  attr_reader :destination, :raw_config, :secrets
+  attr_reader :accessories, :aliases, :boot, :builder, :env, :logging, :proxy, :proxy_boot, :servers, :ssh, :sshkit, :registry
+
+  include Validation
+
+  class << self
+    def create_from(config_file:, destination: nil, version: nil)
+      ENV["KAMAL_DESTINATION"] = destination
+
+      raw_config = load_config_files(config_file, *destination_config_file(config_file, destination))
+
+      new raw_config, destination: destination, version: version
+    end
+
+    private
+      def load_config_files(*files)
+        files.inject({}) { |config, file| config.deep_merge! load_config_file(file) }
+      end
+
+      def load_config_file(file)
+        if file.exist?
+          # Newer Psych doesn't load aliases by default
+          load_method = YAML.respond_to?(:unsafe_load) ? :unsafe_load : :load
+          YAML.send(load_method, ERB.new(File.read(file)).result).symbolize_keys
+        else
+          raise "Configuration file not found in #{file}"
+        end
+      end
+
+      def destination_config_file(base_config_file, destination)
+        base_config_file.sub_ext(".#{destination}.yml") if destination
+      end
+  end
+
+  def initialize(raw_config, destination: nil, version: nil, validate: true)
+    @raw_config = ActiveSupport::InheritableOptions.new(raw_config)
+    @destination = destination
+    @declared_version = version
+
+    validate! raw_config, example: validation_yml.symbolize_keys, context: "", with: Kamal::Configuration::Validator::Configuration
+
+    @secrets = Kamal::Secrets.new(destination: destination)
+
+    # Eager load config to validate it, these are first as they have dependencies later on
+    @servers = Servers.new(config: self)
+    @registry = Registry.new(config: @raw_config, secrets: secrets)
+
+    @accessories = @raw_config.accessories&.keys&.collect { |name| Accessory.new(name, config: self) } || []
+    @aliases = @raw_config.aliases&.keys&.to_h { |name| [ name, Alias.new(name, config: self) ] } || {}
+    @boot = Boot.new(config: self)
+    @builder = Builder.new(config: self)
+    @env = Env.new(config: @raw_config.env || {}, secrets: secrets)
+
+    @logging = Logging.new(logging_config: @raw_config.logging)
+    @proxy = Proxy.new(config: self, proxy_config: @raw_config.proxy, secrets: secrets)
+    @proxy_boot = Proxy::Boot.new(config: self)
+    @ssh = Ssh.new(config: self)
+    @sshkit = Sshkit.new(config: self)
+
+    ensure_destination_if_required
+    ensure_required_keys_present
+    ensure_valid_kamal_version
+    ensure_retain_containers_valid
+    ensure_valid_service_name
+    ensure_no_traefik_reboot_hooks
+    ensure_one_host_for_ssl_roles
+    ensure_unique_hosts_for_ssl_roles
+  end
+
+  def version=(version)
+    @declared_version = version
+  end
+
+  def version
+    @declared_version.presence || ENV["VERSION"] || git_version
+  end
+
+  def abbreviated_version
+    if version
+      # Don't abbreviate <sha>_uncommitted_<etc>
+      if version.include?("_")
+        version
+      else
+        version[0...7]
+      end
+    end
+  end
+
+  def minimum_version
+    raw_config.minimum_version
+  end
+
+  def service_and_destination
+    [ service, destination ].compact.join("-")
+  end
+
+  def roles
+    servers.roles
+  end
+
+  def role(name)
+    roles.detect { |r| r.name == name.to_s }
+  end
+
+  def accessory(name)
+    accessories.detect { |a| a.name == name.to_s }
+  end
+
+  def all_hosts
+    (roles + accessories).flat_map(&:hosts).uniq
+  end
+
+  def app_hosts
+    roles.flat_map(&:hosts).uniq
+  end
+
+  def primary_host
+    primary_role&.primary_host
+  end
+
+  def primary_role_name
+    raw_config.primary_role || "web"
+  end
+
+  def primary_role
+    role(primary_role_name)
+  end
+
+  def allow_empty_roles?
+    raw_config.allow_empty_roles
+  end
+
+  def proxy_roles
+    roles.select(&:running_proxy?)
+  end
+
+  def proxy_role_names
+    proxy_roles.flat_map(&:name)
+  end
+
+  def proxy_accessories
+    accessories.select(&:running_proxy?)
+  end
+
+  def proxy_hosts
+    (proxy_roles.flat_map(&:hosts) + proxy_accessories.flat_map(&:hosts)).uniq
+  end
+
+  def repository
+    [ registry.server, image ].compact.join("/")
+  end
+
+  def absolute_image
+    "#{repository}:#{version}"
+  end
+
+  def latest_image
+    "#{repository}:#{latest_tag}"
+  end
+
+  def latest_tag
+    [ "latest", *destination ].join("-")
+  end
+
+  def service_with_version
+    "#{service}-#{version}"
+  end
+
+  def require_destination?
+    raw_config.require_destination
+  end
+
+  def retain_containers
+    raw_config.retain_containers || 5
+  end
+
+  def volume_args
+    if raw_config.volumes.present?
+      argumentize "--volume", raw_config.volumes
+    else
+      []
+    end
+  end
+
+  def logging_args
+    logging.args
+  end
+
+  def readiness_delay
+    raw_config.readiness_delay || 7
+  end
+
+  def deploy_timeout
+    raw_config.deploy_timeout || 30
+  end
+
+  def drain_timeout
+    raw_config.drain_timeout || 30
+  end
+
+  def run_directory
+    ".kamal"
+  end
+
+  def apps_directory
+    File.join run_directory, "apps"
+  end
+
+  def app_directory
+    File.join apps_directory, service_and_destination
+  end
+
+  def env_directory
+    File.join app_directory, "env"
+  end
+
+  def assets_directory
+    File.join app_directory, "assets"
+  end
+
+  def hooks_path
+    raw_config.hooks_path || ".kamal/hooks"
+  end
+
+  def asset_path
+    raw_config.asset_path
+  end
+
+  def error_pages_path
+    raw_config.error_pages_path
+  end
+
+  def env_tags
+    @env_tags ||= if (tags = raw_config.env["tags"])
+      tags.collect { |name, config| Env::Tag.new(name, config: config, secrets: secrets) }
+    else
+      []
+    end
+  end
+
+  def env_tag(name)
+    env_tags.detect { |t| t.name == name.to_s }
+  end
+
+  def to_h
+    {
+      roles: role_names,
+      hosts: all_hosts,
+      primary_host: primary_host,
+      version: version,
+      repository: repository,
+      absolute_image: absolute_image,
+      service_with_version: service_with_version,
+      volume_args: volume_args,
+      ssh_options: ssh.to_h,
+      sshkit: sshkit.to_h,
+      builder: builder.to_h,
+      accessories: raw_config.accessories,
+      logging: logging_args
+    }.compact
+  end
+
+  private
+    # Will raise ArgumentError if any required config keys are missing
+    def ensure_destination_if_required
+      if require_destination? && destination.nil?
+        raise ArgumentError, "You must specify a destination"
+      end
+
+      true
+    end
+
+    def ensure_required_keys_present
+      %i[ service image registry ].each do |key|
+        raise Kamal::ConfigurationError, "Missing required configuration for #{key}" unless raw_config[key].present?
+      end
+
+      if raw_config.servers.nil?
+        raise Kamal::ConfigurationError, "No servers or accessories specified" unless raw_config.accessories.present?
+      else
+        unless role(primary_role_name).present?
+          raise Kamal::ConfigurationError, "The primary_role #{primary_role_name} isn't defined"
+        end
+
+        if primary_role.hosts.empty?
+          raise Kamal::ConfigurationError, "No servers specified for the #{primary_role.name} primary_role"
+        end
+
+        unless allow_empty_roles?
+          roles.each do |role|
+            if role.hosts.empty?
+              raise Kamal::ConfigurationError, "No servers specified for the #{role.name} role. You can ignore this with allow_empty_roles: true"
+            end
+          end
+        end
+      end
+
+      true
+    end
+
+    def ensure_valid_service_name
+      raise Kamal::ConfigurationError, "Service name can only include alphanumeric characters, hyphens, and underscores" unless raw_config[:service] =~ /^[a-z0-9_-]+$/i
+
+      true
+    end
+
+    def ensure_valid_kamal_version
+      if minimum_version && Gem::Version.new(minimum_version) > Gem::Version.new(Kamal::VERSION)
+        raise Kamal::ConfigurationError, "Current version is #{Kamal::VERSION}, minimum required is #{minimum_version}"
+      end
+
+      true
+    end
+
+    def ensure_retain_containers_valid
+      raise Kamal::ConfigurationError, "Must retain at least 1 container" if retain_containers < 1
+
+      true
+    end
+
+    def ensure_no_traefik_reboot_hooks
+      hooks = %w[ pre-traefik-reboot post-traefik-reboot ].select { |hook_file| File.exist?(File.join(hooks_path, hook_file)) }
+
+      if hooks.any?
+        raise Kamal::ConfigurationError, "Found #{hooks.join(", ")}, these should be renamed to (pre|post)-proxy-reboot"
+      end
+
+      true
+    end
+
+    def ensure_one_host_for_ssl_roles
+      roles.each(&:ensure_one_host_for_ssl)
+
+      true
+    end
+
+    def ensure_unique_hosts_for_ssl_roles
+      hosts = roles.select(&:ssl?).flat_map { |role| role.proxy.hosts }
+      duplicates = hosts.tally.filter_map { |host, count| host if count > 1 }
+
+      raise Kamal::ConfigurationError, "Different roles can't share the same host for SSL: #{duplicates.join(", ")}" if duplicates.any?
+
+      true
+    end
+
+    def role_names
+      raw_config.servers.is_a?(Array) ? [ "web" ] : raw_config.servers.keys.sort
+    end
+
+    def git_version
+      @git_version ||=
+        if Kamal::Git.used?
+          if Kamal::Git.uncommitted_changes.present? && !builder.git_clone?
+            uncommitted_suffix = "_uncommitted_#{SecureRandom.hex(8)}"
+          end
+          [ Kamal::Git.revision, uncommitted_suffix ].compact.join
+        else
+          raise "Can't use commit hash as version, no git repository found in #{Dir.pwd}"
+        end
+    end
+end