kitsune-kit 0.4.1 → 0.6.0

data/lib/kitsune/kit/adapters/fake_state_store.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+require "time"
+require_relative "../errors"
+require_relative "../state_stores/store"
+
+module Kitsune
+  module Kit
+    module Adapters
+      class FakeStateStore < StateStores::Store
+        SCHEMA_VERSION = 1
+
+        def initialize
+          super
+          @states = {}
+          @mutex = Mutex.new
+          @operation_mutexes = Hash.new { |hash, key| hash[key] = Mutex.new }
+        end
+
+        def read(environment)
+          name = safe_environment(environment)
+          @mutex.synchronize { copy(@states.fetch(name) { empty_state(name) }) }
+        end
+
+        def update(environment)
+          name = safe_environment(environment)
+          @mutex.synchronize do
+            updated = yield(copy(@states.fetch(name) { empty_state(name) }))
+            updated["updated_at"] = Time.now.utc.iso8601(6)
+            validate!(updated, name)
+            @states[name] = copy(updated)
+          end
+          read(name)
+        end
+
+        def write(environment, state) = update(environment) { state }
+
+        def delete(environment)
+          name = safe_environment(environment)
+          @mutex.synchronize { @states.delete(name) ? true : nil }
+        end
+
+        def with_execution_lock(environment)
+          name = safe_environment(environment)
+          lock = @mutex.synchronize { @operation_mutexes[name] }
+          unless lock.try_lock
+            raise Errors::UnsafeOperationError.new(
+              "another mutating operation is active for #{name}",
+              hint: "Wait for it to finish or stop it safely before retrying."
+            )
+          end
+          yield
+        ensure
+          lock&.unlock if lock&.owned?
+        end
+
+        private
+
+        def empty_state(environment)
+          {
+            "version" => SCHEMA_VERSION, "environment" => environment, "updated_at" => nil,
+            "resources" => {}, "operations" => [], "runs" => {}
+          }
+        end
+
+        def safe_environment(environment)
+          value = environment.to_s
+          return value if value.match?(/\A[a-zA-Z0-9_-]+\z/)
+
+          raise Errors::ConfigurationError, "environment name has an invalid format"
+        end
+
+        def validate!(state, environment)
+          raise Errors::ConfigurationError, "state must be an object" unless state.is_a?(Hash)
+          unless state["version"] == SCHEMA_VERSION
+            raise Errors::ConfigurationError,
+                  "unsupported state schema version #{state['version'].inspect}; expected #{SCHEMA_VERSION}"
+          end
+          raise Errors::ConfigurationError, "state environment mismatch" unless state["environment"] == environment
+          raise Errors::ConfigurationError, "state resources must be an object" unless state["resources"].is_a?(Hash)
+          raise Errors::ConfigurationError, "state operations must be an array" unless state["operations"].is_a?(Array)
+          raise Errors::ConfigurationError, "state runs must be an object" unless state["runs"].is_a?(Hash)
+
+          state
+        end
+
+        def copy(value) = Marshal.load(Marshal.dump(value))
+      end
+    end
+  end
+end

data/lib/kitsune/kit/adapters/fake_transport.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+require_relative "transport"
+
+module Kitsune
+  module Kit
+    module Adapters
+      class FakeTransport < Transport
+        attr_reader :calls, :uploads
+
+        def initialize(reachable: true, failures: {})
+          super()
+          @reachable = reachable
+          @failures = failures
+          @stubs = {}
+          @calls = []
+          @uploads = {}
+        end
+
+        def stub(command, arguments: [], stdout: "", stderr: "", exit_status: 0, duration_ms: 1)
+          @stubs[[command, arguments]] = CommandResult.new(
+            stdout: stdout,
+            stderr: stderr,
+            exit_status: exit_status,
+            duration_ms: duration_ms
+          )
+        end
+
+        def reachable?
+          @calls << [:reachable, {}]
+          raise @failures[:reachable] if @failures[:reachable]
+
+          @reachable
+        end
+
+        def execute(command, arguments: [], timeout: 30, stdin: nil)
+          @calls << [:execute, { command: command, arguments: arguments, timeout: timeout, stdin: stdin }]
+          raise @failures[:execute] if @failures[:execute]
+
+          @stubs.fetch([command, arguments]) do
+            status = command == "test" ? 1 : 0
+            CommandResult.new(stdout: "", stderr: "", exit_status: status, duration_ms: 1)
+          end
+        end
+
+        def upload(content:, remote_path:, mode: "0600")
+          @calls << [:upload, { remote_path: remote_path, mode: mode }]
+          raise @failures[:upload] if @failures[:upload]
+
+          @uploads[remote_path] = { content: content, mode: mode }
+          true
+        end
+      end
+    end
+  end
+end

data/lib/kitsune/kit/adapters/net_ssh_transport.rb

@@ -0,0 +1,155 @@
+# frozen_string_literal: true
+
+require "base64"
+require "net/ssh"
+require "shellwords"
+require "timeout"
+require_relative "../errors"
+require_relative "transport"
+
+module Kitsune
+  module Kit
+    module Adapters
+      class NetSshTransport < Transport
+        def initialize(host:, user:, port:, key_path:, known_hosts: nil, verify_host_key: :always,
+                       maximum_timeout: nil)
+          super()
+          @host = host
+          @user = user
+          @port = Integer(port)
+          @key_path = key_path
+          @known_hosts = known_hosts
+          @verify_host_key = verify_host_key
+          @maximum_timeout = maximum_timeout
+        end
+
+        def reachable?
+          with_connection { true }
+        rescue Errors::ConnectionError
+          false
+        end
+
+        def with_session
+          return yield if @persistent_session
+
+          open_connection do |ssh|
+            @persistent_session = ssh
+            yield
+          ensure
+            @persistent_session = nil
+          end
+        end
+
+        def execute(command, arguments: [], timeout: 30, stdin: nil)
+          validate_command!(command)
+          shell_command = ([command] + arguments.map { |argument| Shellwords.escape(argument.to_s) }).join(" ")
+          started_at = monotonic_time
+          stdout = +""
+          stderr = +""
+          exit_status = nil
+
+          effective_timeout = @maximum_timeout ? [timeout, @maximum_timeout].min : timeout
+          Timeout.timeout(effective_timeout) do
+            with_connection do |ssh|
+              ssh.open_channel do |channel|
+                channel.exec(shell_command) do |_exec_channel, success|
+                  raise Errors::RemoteCommandError, "remote command could not be started" unless success
+
+                  channel.send_data(stdin) if stdin
+                  channel.eof! if stdin
+                  channel.on_data { |_data_channel, data| stdout << data }
+                  channel.on_extended_data { |_data_channel, _type, data| stderr << data }
+                  channel.on_request("exit-status") { |_status_channel, data| exit_status = data.read_long }
+                end
+              end
+              ssh.loop
+            end
+          end
+
+          command_result(stdout, stderr, exit_status, started_at)
+        rescue Timeout::Error
+          raise Errors::TimeoutError.new("remote command timed out after #{effective_timeout || timeout} seconds",
+                                         context: { command: command })
+        end
+
+        def upload(content:, remote_path:, mode: "0600")
+          validate_remote_path!(remote_path)
+          validate_mode!(mode)
+          encoded = Base64.strict_encode64(content)
+          result = execute(
+            "sh",
+            arguments: ["-c", "base64 --decode > \"$1\" && chmod \"$2\" \"$1\"", "kitsune-upload", remote_path, mode],
+            stdin: encoded,
+            timeout: 30
+          )
+          raise_remote_failure!(result, "upload #{remote_path}") unless result.success?
+
+          true
+        end
+
+        private
+
+        def command_result(stdout, stderr, exit_status, started_at)
+          CommandResult.new(
+            stdout: stdout,
+            stderr: stderr,
+            exit_status: exit_status || 255,
+            duration_ms: ((monotonic_time - started_at) * 1000).round
+          )
+        end
+
+        def with_connection
+          return yield(@persistent_session) if @persistent_session
+
+          open_connection { |ssh| return yield(ssh) }
+        end
+
+        def open_connection
+          options = {
+            port: @port,
+            keys: [@key_path],
+            non_interactive: true,
+            timeout: @maximum_timeout ? [10, @maximum_timeout].min : 10,
+            verify_host_key: @verify_host_key
+          }
+          options[:user_known_hosts_file] = [@known_hosts] if @known_hosts
+          Net::SSH.start(@host, @user, **options) { |ssh| return yield(ssh) }
+        rescue Net::SSH::Exception, SystemCallError, SocketError => e
+          raise Errors::ConnectionError.new(
+            "SSH connection to #{@user}@#{@host}:#{@port} failed",
+            hint: "Verify the address, key, host fingerprint and firewall rules.",
+            context: { cause: e.class.name },
+            retryable: true
+          )
+        end
+
+        def validate_command!(command)
+          return if command.to_s.match?(%r{\A[\w./-]+\z})
+
+          raise Errors::ConfigurationError, "remote command has an invalid format"
+        end
+
+        def validate_remote_path!(path)
+          return if path.to_s.match?(%r{\A/[a-zA-Z0-9_./-]+\z}) && !path.to_s.include?("..")
+
+          raise Errors::ConfigurationError, "remote path has an invalid format"
+        end
+
+        def validate_mode!(mode)
+          return if mode.to_s.match?(/\A0[0-7]{3}\z/)
+
+          raise Errors::ConfigurationError, "file mode has an invalid format"
+        end
+
+        def raise_remote_failure!(result, operation)
+          raise Errors::RemoteCommandError.new(
+            "remote #{operation} failed with status #{result.exit_status}",
+            context: { stderr: result.stderr }
+          )
+        end
+
+        def monotonic_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      end
+    end
+  end
+end

data/lib/kitsune/kit/adapters/provider.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+module Kitsune
+  module Kit
+    module Adapters
+      API_VERSION = 1
+
+      ServerRecord = Data.define(:id, :name, :status, :public_ip, :region, :size, :image, :tags) do
+        def to_h
+          members.to_h { |member| [member, public_send(member)] }
+        end
+      end
+
+      DnsRecord = Data.define(:id, :zone, :name, :type, :data, :ttl) do
+        def to_h
+          members.to_h { |member| [member, public_send(member)] }
+        end
+      end
+
+      class Provider
+        def validate_credentials! = raise NotImplementedError
+        def validate_server_spec!(spec:) = raise NotImplementedError
+        def find_server(name:, tags: []) = raise NotImplementedError
+        def find_server_by_id(id:) = raise NotImplementedError
+        def create_server(spec:) = raise NotImplementedError
+        def wait_until_ready(id:, timeout:) = raise NotImplementedError
+        def delete_server(id:) = raise NotImplementedError
+        def find_dns_record(zone:, name:, type:) = raise NotImplementedError
+        def upsert_dns_record(record:) = raise NotImplementedError
+        def delete_dns_record(id:, zone:) = raise NotImplementedError
+      end
+    end
+  end
+end

data/lib/kitsune/kit/adapters/transport.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module Kitsune
+  module Kit
+    module Adapters
+      CommandResult = Data.define(:stdout, :stderr, :exit_status, :duration_ms) do
+        def success? = exit_status.zero?
+
+        def to_h
+          { stdout: stdout, stderr: stderr, exit_status: exit_status, duration_ms: duration_ms }
+        end
+      end
+
+      class Transport
+        def with_session = yield
+        def reachable? = raise NotImplementedError
+        def execute(command, arguments: [], timeout: 30, stdin: nil) = raise NotImplementedError
+        def upload(content:, remote_path:, mode: "0600") = raise NotImplementedError
+      end
+    end
+  end
+end

data/lib/kitsune/kit/adapters/transport_factory.rb

@@ -0,0 +1,116 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require_relative "../errors"
+require_relative "net_ssh_transport"
+require_relative "confirming_host_key_verifier"
+
+module Kitsune
+  module Kit
+    module Adapters
+      class TransportFactory
+        BOOTSTRAP_TIMEOUT = 120
+        BOOTSTRAP_RETRY_INTERVAL = 5
+
+        def initialize(config:, provider:, root: Dir.pwd, host_key_confirmation: nil, maximum_timeout: nil,
+                       sleeper: Kernel, monotonic_clock: nil, bootstrap_timeout: BOOTSTRAP_TIMEOUT)
+          if maximum_timeout && maximum_timeout <= 0
+            raise Errors::ConfigurationError, "timeout must be greater than zero"
+          end
+          raise Errors::ConfigurationError, "SSH bootstrap timeout must be greater than zero" if bootstrap_timeout <= 0
+
+          @config = config
+          @provider = provider
+          @known_hosts = File.expand_path(".kitsune/known_hosts", root)
+          @host_key_verifier = ConfirmingHostKeyVerifier.new(&host_key_confirmation)
+          @maximum_timeout = maximum_timeout
+          @bootstrap_timeout = [bootstrap_timeout, maximum_timeout].compact.min
+          @sleeper = sleeper
+          @monotonic_clock = monotonic_clock || -> { Process.clock_gettime(Process::CLOCK_MONOTONIC) }
+        end
+
+        def server
+          @provider.find_server(name: @config.server.name, tags: @config.server.tags)
+        end
+
+        def for(user:)
+          current = server
+          unless current&.public_ip
+            raise Errors::ConnectionError.new(
+              "server is not ready for SSH",
+              hint: "Apply the server operation first, then resume."
+            )
+          end
+          FileUtils.mkdir_p(File.dirname(@known_hosts), mode: 0o700)
+          FileUtils.touch(@known_hosts)
+          File.chmod(0o600, @known_hosts)
+          NetSshTransport.new(
+            host: current.public_ip,
+            user: user,
+            port: @config.ssh.port,
+            key_path: @config.ssh.key_path,
+            known_hosts: @known_hosts,
+            verify_host_key: @host_key_verifier,
+            maximum_timeout: @maximum_timeout
+          )
+        end
+
+        def deploy = self.for(user: @config.ssh.user)
+        def root = self.for(user: "root")
+
+        def bootstrap
+          candidate = deploy
+          return candidate if candidate.reachable?
+
+          candidate = root
+          return candidate if candidate.reachable?
+
+          raise Errors::ConnectionError.new(
+            "neither #{@config.ssh.user} nor root can access the server",
+            hint: "Verify the SSH key and provider console before changing SSH policy."
+          )
+        end
+
+        def wait_for_bootstrap
+          deadline = monotonic_time + @bootstrap_timeout
+          loop do
+            return bootstrap
+          rescue Errors::ConnectionError
+            remaining = deadline - monotonic_time
+            break if remaining <= 0
+
+            @sleeper.sleep([BOOTSTRAP_RETRY_INTERVAL, remaining].min)
+          end
+
+          raise Errors::ConnectionError.new(
+            "SSH did not become reachable within #{@bootstrap_timeout} seconds",
+            hint: "Wait for Ubuntu to finish booting and verify that the uploaded public key matches ssh.key_path.",
+            context: { timeout: @bootstrap_timeout },
+            retryable: true
+          )
+        end
+
+        private
+
+        def monotonic_time = @monotonic_clock.call
+      end
+
+      class FakeTransportFactory
+        attr_reader :server_record
+
+        def initialize(transport:, server: nil, root_transport: nil, deploy_transport: nil)
+          @transport = transport
+          @root_transport = root_transport || transport
+          @deploy_transport = deploy_transport || transport
+          @server_record = server
+        end
+
+        def server = @server_record
+        def deploy = @deploy_transport
+        def root = @root_transport
+        def bootstrap = @deploy_transport.reachable? ? @deploy_transport : @root_transport
+        def wait_for_bootstrap = bootstrap
+      end
+    end
+  end
+end

data/lib/kitsune/kit/application.rb

@@ -0,0 +1,170 @@
+# frozen_string_literal: true
+
+require_relative "adapters/digitalocean_provider"
+require_relative "adapters/transport_factory"
+require_relative "configuration"
+require_relative "events"
+require_relative "operations/ensure_server"
+require_relative "operations/ensure_dns_records"
+require_relative "operations/ensure_service"
+require_relative "state_store"
+
+module Kitsune
+  module Kit
+    class Application
+      attr_reader :config, :event_bus, :provider, :state_store, :transport_factory, :secret_store
+
+      def self.build(root:, environment:, config_path: nil, overrides: {}, env: ENV, event_bus: Events::Bus.new,
+                     host_key_confirmation: nil, maximum_timeout: nil)
+        config = Configuration::Loader.new(root: root, env: env, config_path: config_path)
+                                      .load(environment: environment, overrides: overrides)
+        token = env.fetch(config.provider.token_env, "")
+        provider = Adapters::DigitalOceanProvider.new(token: token, maximum_timeout: maximum_timeout)
+        state_store = StateStore.new(root: root)
+        transport_factory = Adapters::TransportFactory.new(
+          config: config,
+          provider: provider,
+          root: root,
+          host_key_confirmation: host_key_confirmation,
+          maximum_timeout: maximum_timeout
+        )
+        new(
+          config: config,
+          provider: provider,
+          state_store: state_store,
+          transport_factory: transport_factory,
+          secret_store: SecretStores::Environment.new(env: env),
+          event_bus: event_bus,
+          maximum_timeout: maximum_timeout
+        )
+      end
+
+      def initialize(config:, provider:, state_store:, transport_factory: nil, event_bus: Events::Bus.new,
+                     secret_store: SecretStores::Environment.new, maximum_timeout: nil)
+        @config = config
+        @provider = provider
+        @state_store = state_store
+        @transport_factory = transport_factory
+        @secret_store = secret_store
+        @event_bus = event_bus
+        @maximum_timeout = maximum_timeout
+      end
+
+      def operations
+        values = [Operations::EnsureServer.new(
+          config: config, provider: provider, state_store: state_store, maximum_timeout: @maximum_timeout
+        )]
+        values.concat(remote_operations) if @transport_factory
+        values.concat(service_operations) if @transport_factory
+        if config.dns.domains.any?
+          values << Operations::EnsureDnsRecords.new(config: config, provider: provider, state_store: state_store)
+        end
+        values
+      end
+
+      def service_operation(type)
+        Operations::EnsureService.new(
+          config: config,
+          type: type,
+          transport_factory: @transport_factory,
+          state_store: state_store,
+          secret_store: secret_store
+        )
+      end
+
+      private
+
+      def remote_operations
+        values = [user_operation, ssh_operation, firewall_operation]
+        if config.system.unattended_upgrades
+          values << remote(resource: "unattended_upgrades",
+                           script: script("unattended.sh"))
+        end
+        values << swap_operation
+        values << docker_operation
+        if config.system.metrics
+          values << remote(resource: "metrics", script: script("metrics.sh"),
+                           arguments: [config.system.metrics_installer_sha256])
+        end
+        values
+      end
+
+      def user_operation
+        remote(
+          resource: "user.#{config.ssh.user}",
+          script: script("user.sh"),
+          arguments: [config.ssh.user],
+          role: :wait_for_bootstrap,
+          rollback_role: :root,
+          post_verify: method(:verify_deploy_connection)
+        )
+      end
+
+      def ssh_operation
+        remote(
+          resource: "ssh.policy", script: script("ssh.sh"), arguments: [config.ssh.user],
+          post_verify: method(:verify_deploy_connection), finalize_action: "finalize", rollback_on_failure: true
+        )
+      end
+
+      def firewall_operation
+        remote(
+          resource: "firewall",
+          script: script("firewall.sh"),
+          arguments: [config.ssh.port, *config.ssh.allowed_cidrs],
+          post_verify: method(:verify_deploy_connection),
+          finalize_action: "finalize",
+          rollback_on_failure: true
+        )
+      end
+
+      def swap_operation
+        remote(
+          resource: "swap",
+          script: script("swap.sh"),
+          arguments: [config.system.swap_size_gb, config.system.swap_swappiness]
+        )
+      end
+
+      def docker_operation
+        remote(resource: "docker", script: script("docker.sh"), arguments: [config.ssh.user])
+      end
+
+      def verify_deploy_connection
+        return if @transport_factory.deploy.reachable?
+
+        raise Errors::VerificationError.new(
+          "the deploy user cannot open a second SSH connection",
+          hint: "Root access remains enabled; inspect authorized_keys and retry."
+        )
+      end
+
+      def script(name) = File.expand_path("scripts/#{name}", __dir__)
+
+      def remote(resource:, script:, arguments: [], role: :deploy, rollback_role: nil, post_verify: nil,
+                 finalize_action: nil, rollback_on_failure: false)
+        Operations::RemoteScript.new(
+          config: config,
+          transport_factory: @transport_factory,
+          state_store: state_store,
+          resource: resource,
+          script_path: script,
+          arguments: arguments,
+          transport_roles: { apply: role, rollback: rollback_role || role },
+          verification: {
+            callback: post_verify, finalize_action: finalize_action, rollback_on_failure: rollback_on_failure
+          }
+        )
+      end
+
+      def service_operations
+        %w[postgres redis].filter_map do |type|
+          service = config.services.public_send(type)
+          next unless service.enabled && service.mode == "managed"
+
+          service_operation(type)
+        end
+      end
+    end
+  end
+end

data/lib/kitsune/kit/cancellation.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Kitsune
+  module Kit
+    class Cancellation
+      class Cancelled < StandardError; end
+
+      def initialize
+        @cancelled = false
+        @mutex = Mutex.new
+      end
+
+      def cancel! = @mutex.synchronize { @cancelled = true }
+      def cancelled? = @mutex.synchronize { @cancelled }
+
+      def check!
+        raise Cancelled, "operation cancelled" if cancelled?
+      end
+    end
+  end
+end