1 ;;; GNU Guix --- Functional package management for GNU
2 ;;; Copyright © 2019 Jakob L. Kreuze <zerodaysfordays@sdf.lonestar.org>
4 ;;; This file is part of GNU Guix.
6 ;;; GNU Guix is free software; you can redistribute it and/or modify it
7 ;;; under the terms of the GNU General Public License as published by
8 ;;; the Free Software Foundation; either version 3 of the License, or (at
9 ;;; your option) any later version.
11 ;;; GNU Guix is distributed in the hope that it will be useful, but
12 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
13 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 ;;; GNU General Public License for more details.
16 ;;; You should have received a copy of the GNU General Public License
17 ;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
19 (define-module (gnu machine ssh)
20 #:use-module (gnu machine)
21 #:autoload (gnu packages gnupg) (guile-gcrypt)
22 #:use-module (gnu system)
23 #:use-module (gnu system file-systems)
24 #:use-module (gnu system uuid)
25 #:use-module (guix diagnostics)
26 #:use-module (guix gexp)
27 #:use-module (guix i18n)
28 #:use-module (guix modules)
29 #:use-module (guix monads)
30 #:use-module (guix records)
31 #:use-module (guix remote)
32 #:use-module (guix scripts system reconfigure)
33 #:use-module (guix ssh)
34 #:use-module (guix store)
35 #:use-module (guix utils)
36 #:use-module (ice-9 match)
37 #:use-module (srfi srfi-19)
38 #:use-module (srfi srfi-26)
39 #:use-module (srfi srfi-34)
40 #:use-module (srfi srfi-35)
41 #:export (managed-host-environment-type
43 machine-ssh-configuration
44 machine-ssh-configuration?
45 machine-ssh-configuration
47 machine-ssh-configuration-host-name
48 machine-ssh-configuration-build-locally?
49 machine-ssh-configuration-port
50 machine-ssh-configuration-user
51 machine-ssh-configuration-session))
55 ;;; This module implements remote evaluation and system deployment for
56 ;;; machines that are accessible over SSH and have a known host-name. In the
57 ;;; sense of the broader "machine" interface, we describe the environment for
58 ;;; such machines as 'managed-host.
64 ;;; Parameters for the SSH client.
67 (define-record-type* <machine-ssh-configuration> machine-ssh-configuration
68 make-machine-ssh-configuration
69 machine-ssh-configuration?
70 this-machine-ssh-configuration
71 (host-name machine-ssh-configuration-host-name) ; string
72 (system machine-ssh-configuration-system) ; string
73 (build-locally? machine-ssh-configuration-build-locally?
75 (port machine-ssh-configuration-port ; integer
77 (user machine-ssh-configuration-user ; string
79 (identity machine-ssh-configuration-identity ; path to a private key
81 (session machine-ssh-configuration-session ; session
84 (define (machine-ssh-session machine)
85 "Return the SSH session that was given in MACHINE's configuration, or create
86 one from the configuration's parameters if one was not provided."
87 (maybe-raise-unsupported-configuration-error machine)
88 (let ((config (machine-configuration machine)))
89 (or (machine-ssh-configuration-session config)
90 (let ((host-name (machine-ssh-configuration-host-name config))
91 (user (machine-ssh-configuration-user config))
92 (port (machine-ssh-configuration-port config))
93 (identity (machine-ssh-configuration-identity config)))
94 (open-ssh-session host-name
97 #:identity identity)))))
101 ;;; Remote evaluation.
104 (define (machine-become-command machine)
105 "Return as a list of strings the program and arguments necessary to run a
106 shell command with escalated privileges for MACHINE's configuration."
107 (if (string= "root" (machine-ssh-configuration-user
108 (machine-configuration machine)))
110 '("/run/setuid-programs/sudo" "-n" "--")))
112 (define (managed-host-remote-eval machine exp)
113 "Internal implementation of 'machine-remote-eval' for MACHINE instances with
114 an environment type of 'managed-host."
115 (maybe-raise-unsupported-configuration-error machine)
116 (let ((config (machine-configuration machine)))
117 (remote-eval exp (machine-ssh-session machine)
119 (machine-ssh-configuration-build-locally? config)
121 (machine-ssh-configuration-system config))))
128 (define (machine-check-file-system-availability machine)
129 "Raise a '&message' error condition if any of the file-systems specified in
130 MACHINE's 'system' declaration do not exist on the machine."
133 (and (file-system-mount? fs)
134 (not (member (file-system-type fs)
135 %pseudo-file-system-types))
136 (not (memq 'bind-mount (file-system-flags fs)))))
137 (operating-system-file-systems (machine-operating-system machine))))
139 (define (check-literal-file-system fs)
141 #~(catch 'system-error
143 (stat #$(file-system-device fs))
146 (system-error-errno args))))
148 (mlet %store-monad ((errno (machine-remote-eval machine remote-exp)))
149 (when (number? errno)
152 (message (format #f (G_ "device '~a' not found: ~a")
153 (file-system-device fs)
154 (strerror errno)))))))
157 (define (check-labeled-file-system fs)
159 (with-imported-modules '((gnu build file-systems))
161 (use-modules (gnu build file-systems))
162 (find-partition-by-label #$(file-system-label->string
163 (file-system-device fs))))))
165 (mlet %store-monad ((result (machine-remote-eval machine remote-exp)))
169 (message (format #f (G_ "no file system with label '~a'")
170 (file-system-label->string
171 (file-system-device fs))))))))
174 (define (check-uuid-file-system fs)
176 (with-imported-modules (source-module-closure
177 '((gnu build file-systems)
180 (use-modules (gnu build file-systems)
184 (string->uuid #$(uuid->string (file-system-device fs))))
186 (find-partition-by-uuid uuid))))
188 (mlet %store-monad ((result (machine-remote-eval machine remote-exp)))
192 (message (format #f (G_ "no file system with UUID '~a'")
193 (uuid->string (file-system-device fs))))))))
197 (mapm %store-monad check-literal-file-system
199 (string? (file-system-device fs)))
201 (mapm %store-monad check-labeled-file-system
203 (file-system-label? (file-system-device fs)))
205 (mapm %store-monad check-uuid-file-system
207 (uuid? (file-system-device fs)))
210 (define (machine-check-initrd-modules machine)
211 "Raise a '&message' error condition if any of the modules needed by
212 'needed-for-boot' file systems in MACHINE are not available in the initrd."
214 (filter file-system-needed-for-boot?
215 (operating-system-file-systems (machine-operating-system machine))))
217 (define (missing-modules fs)
219 (let ((device (file-system-device fs)))
220 (with-imported-modules (source-module-closure
221 '((gnu build file-systems)
222 (gnu build linux-modules)
225 (use-modules (gnu build file-systems)
226 (gnu build linux-modules)
230 #$(cond ((string? device) device)
231 ((uuid? device) #~(find-partition-by-uuid
233 #$(uuid->string device))))
234 ((file-system-label? device)
235 #~(find-partition-by-label
236 (file-system-label->string #$device)))))
238 (missing-modules dev '#$(operating-system-initrd-modules
239 (machine-operating-system machine)))))))
240 (mlet %store-monad ((missing (machine-remote-eval machine remote-exp)))
241 (return (list fs missing))))
243 (mlet %store-monad ((device (mapm %store-monad missing-modules file-systems)))
244 (for-each (match-lambda
246 (unless (null? missing)
249 (message (format #f (G_ "~a missing modules ~{ ~a~}~%")
250 (file-system-device fs)
255 (define (machine-check-building-for-appropriate-system machine)
256 "Raise a '&message' error condition if MACHINE is configured to be built
257 locally and the 'system' field does not match the '%current-system' reported
259 (let ((config (machine-configuration machine))
260 (system (remote-system (machine-ssh-session machine))))
261 (when (and (machine-ssh-configuration-build-locally? config)
262 (not (string= system (machine-ssh-configuration-system config))))
265 (message (format #f (G_ "incorrect target system \
266 ('~a' was given, while the system reports that it is '~a')~%")
267 (machine-ssh-configuration-system config)
269 (with-monad %store-monad (return #t)))
271 (define (check-deployment-sanity machine)
272 "Raise a '&message' error condition if it is clear that deploying MACHINE's
273 'system' declaration would fail."
274 ;; Order is important here -- an incorrect value for 'system' will cause
275 ;; invocations of 'remote-eval' to fail.
277 (machine-check-building-for-appropriate-system machine)
278 (machine-check-file-system-availability machine)
279 (machine-check-initrd-modules machine)))
283 ;;; System deployment.
286 (define (machine-boot-parameters machine)
287 "Monadic procedure returning a list of 'boot-parameters' for the generations
288 of MACHINE's system profile, ordered from most recent to oldest."
289 (define bootable-kernel-arguments
290 (@@ (gnu system) bootable-kernel-arguments))
293 (with-extensions (list guile-gcrypt)
294 (with-imported-modules (source-module-closure '((guix config)
297 (use-modules (guix config)
299 (ice-9 textual-ports))
301 (define %system-profile
302 (string-append %state-directory "/profiles/system"))
304 (define (read-file path)
305 (call-with-input-file path
307 (get-string-all port))))
309 (map (lambda (generation)
310 (let* ((system-path (generation-file-name %system-profile
312 (boot-parameters-path (string-append system-path
314 (time (stat:mtime (lstat system-path))))
318 (read-file boot-parameters-path))))
319 (reverse (generation-numbers %system-profile)))))))
321 (mlet* %store-monad ((generations (machine-remote-eval machine remote-exp)))
323 (map (lambda (generation)
325 ((generation system-path time serialized-params)
326 (let* ((params (call-with-input-string serialized-params
327 read-boot-parameters))
328 (root (boot-parameters-root-device params))
329 (label (boot-parameters-label params)))
333 (string-append label " (#"
334 (number->string generation) ", "
335 (let ((time (make-time time-utc 0 time)))
336 (date->string (time-utc->date time)
340 (append (bootable-kernel-arguments system-path root)
341 (boot-parameters-kernel-arguments params))))))))
344 (define (deploy-managed-host machine)
345 "Internal implementation of 'deploy-machine' for MACHINE instances with an
346 environment type of 'managed-host."
347 (maybe-raise-unsupported-configuration-error machine)
348 (mlet %store-monad ((_ (check-deployment-sanity machine))
349 (boot-parameters (machine-boot-parameters machine)))
350 (let* ((os (machine-operating-system machine))
351 (eval (cut machine-remote-eval machine <>))
352 (menu-entries (map boot-parameters->menu-entry boot-parameters))
353 (bootloader-configuration (operating-system-bootloader os))
354 (bootcfg (operating-system-bootcfg os menu-entries)))
356 (switch-to-system eval os)
357 (upgrade-shepherd-services eval os)
358 (install-bootloader eval bootloader-configuration bootcfg)))))
362 ;;; Environment type.
365 (define managed-host-environment-type
367 (machine-remote-eval managed-host-remote-eval)
368 (deploy-machine deploy-managed-host)
369 (name 'managed-host-environment-type)
370 (description "Provisioning for machines that are accessible over SSH
371 and have a known host-name. This entails little more than maintaining an SSH
372 connection to the host.")))
374 (define (maybe-raise-unsupported-configuration-error machine)
375 "Raise an error if MACHINE's configuration is not an instance of
376 <machine-ssh-configuration>."
377 (let ((config (machine-configuration machine))
378 (environment (environment-type-name (machine-environment machine))))
379 (unless (and config (machine-ssh-configuration? config))
382 (message (format #f (G_ "unsupported machine configuration '~a'
383 for environment of type '~a'")