319 lines
14 KiB
Text
319 lines
14 KiB
Text
|
use std
|
|||
|
|
use ops.nu *
|
|||
|
|
use ../../../../catalog/providers/prov_lib/middleware.nu mw_get_ip
|
|||
|
|
use platform/config/accessor.nu *
|
|||
|
|
use primitives/infra/init.nu [provisioning_init get-provisioning-args get-provisioning-name get-provisioning-infra-path get-provisioning-resources get-workspace-path]
|
|||
|
|
use platform/settings/loader.nu [find_get_settings]
|
|||
|
|
use primitives/io/interface.nu [set-provisioning-no-terminal set-provisioning-out get-provisioning-out _ansi _print end_run show_clip_to]
|
|||
|
|
use primitives/io/logging.nu [set-debug-enabled set-metadata-enabled is-debug-enabled]
|
|||
|
|
use primitives/io/undefined.nu [invalid_task]
|
|||
|
|
# --check (-c) # Only check mode no servers will be created
|
|||
|
|
# --wait (-w) # Wait servers to be created
|
|||
|
|
# --select: string # Select with task as option
|
|||
|
|
# --xc # Debuc for task and services locally PROVISIONING_DEBUG_CHECK
|
|||
|
|
# --xr # Debug for remote servers PROVISIONING_DEBUG_REMOTE
|
|||
|
|
|
|||
|
|
# Helper to check if sudo password is cached
|
|||
|
|
def check_sudo_cached [] {
|
|||
|
|
let result = (do --ignore-errors { ^sudo -n true } | complete)
|
|||
|
|
$result.exit_code == 0
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
# Helper to run sudo command with CTRL-C handling
|
|||
|
|
# Returns true on success, false on cancellation, throws error on other failures
|
|||
|
|
def run_sudo_with_interrupt_check [
|
|||
|
|
command: closure
|
|||
|
|
operation_name: string
|
|||
|
|
] {
|
|||
|
|
let result = (do --ignore-errors { do $command } | complete)
|
|||
|
|
if $result.exit_code == 1 and ($result.stderr | str contains "password is required") {
|
|||
|
|
print $"\n(_ansi yellow)⚠ Operation cancelled - sudo password required but not provided(_ansi reset)"
|
|||
|
|
print $"(_ansi blue)ℹ Run 'sudo -v' first to cache credentials, or run without --fix-local-hosts(_ansi reset)"
|
|||
|
|
return false # Return false instead of exit, let caller handle
|
|||
|
|
} else if $result.exit_code != 0 and $result.exit_code != 1 {
|
|||
|
|
error make {msg: $"($operation_name) failed: ($result.stderr)"}
|
|||
|
|
}
|
|||
|
|
true
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
# SSH for server connections
|
|||
|
|
export def "main ssh" [
|
|||
|
|
name?: string # Server hostname in settings
|
|||
|
|
iptype: string = "public" # Ip type to connect
|
|||
|
|
...args # Args for create command
|
|||
|
|
--run # Run ssh on 'name'
|
|||
|
|
--infra (-i): string # Infra directory
|
|||
|
|
--settings (-s): string # Settings path
|
|||
|
|
--serverpos (-p): int # Server position in settings
|
|||
|
|
--debug (-x) # Use Debug mode
|
|||
|
|
--xm # Debug with PROVISIONING_METADATA
|
|||
|
|
--xld # Log level with DEBUG PROVISIONING_LOG_LEVEL=debug
|
|||
|
|
--metadata # Error with metadata (-xm)
|
|||
|
|
--notitles # not tittles
|
|||
|
|
--helpinfo (-h) # For more details use options "help" (no dashes)
|
|||
|
|
--out: string # Print Output format: json, yaml, text (default)
|
|||
|
|
] {
|
|||
|
|
if ($out | is-not-empty) {
|
|||
|
|
set-provisioning-out $out
|
|||
|
|
set-provisioning-no-terminal true
|
|||
|
|
}
|
|||
|
|
provisioning_init $helpinfo "server ssh" $args
|
|||
|
|
if $debug { set-debug-enabled true }
|
|||
|
|
if $metadata { set-metadata-enabled true }
|
|||
|
|
if $name != null and $name != "h" and $name != "help" {
|
|||
|
|
let curr_settings = (find_get_settings --infra $infra --settings $settings)
|
|||
|
|
if ($curr_settings | describe) == "nothing" or $curr_settings == null {
|
|||
|
|
_print $"🛑 Cannot load infrastructure settings. Pass --infra <name> to specify."
|
|||
|
|
exit 1
|
|||
|
|
}
|
|||
|
|
if ($curr_settings.data.servers | find $name| length) == 0 {
|
|||
|
|
_print $"🛑 invalid name ($name)"
|
|||
|
|
exit 1
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
let task = if ($args | length) > 0 {
|
|||
|
|
($args| get 0)
|
|||
|
|
} else {
|
|||
|
|
let str_task = (((get-provisioning-args) | str replace "ssh " " " ))
|
|||
|
|
let str_task = if $name != null {
|
|||
|
|
($str_task | str replace $name "")
|
|||
|
|
} else {
|
|||
|
|
$str_task
|
|||
|
|
}
|
|||
|
|
let first_part = ($str_task | str trim | split row " " | first | default "")
|
|||
|
|
($first_part | split row "-" | first | default "" | str trim)
|
|||
|
|
}
|
|||
|
|
let other = if ($args | length) > 0 { ($args| skip 1) } else { "" }
|
|||
|
|
let ops = $"((get-provisioning-args)) " | str replace $"($task) " "" | str trim
|
|||
|
|
match $task {
|
|||
|
|
"" if $name == "h" => {
|
|||
|
|
^$"(get-provisioning-name)" -mod server ssh help --notitles
|
|||
|
|
},
|
|||
|
|
"" if $name == "help" => {
|
|||
|
|
^$"(get-provisioning-name)" -mod server ssh --help
|
|||
|
|
print (provisioning_options "create")
|
|||
|
|
},
|
|||
|
|
"" | "ssh" => {
|
|||
|
|
let curr_settings = (find_get_settings --infra $infra --settings $settings)
|
|||
|
|
if ($curr_settings | describe) == "nothing" or $curr_settings == null {
|
|||
|
|
_print $"🛑 Cannot load infrastructure settings. Pass --infra <name> to specify."
|
|||
|
|
exit 1
|
|||
|
|
}
|
|||
|
|
let should_run = $run
|
|||
|
|
server_ssh $curr_settings "" $iptype $should_run $name
|
|||
|
|
},
|
|||
|
|
_ => {
|
|||
|
|
invalid_task "servers ssh" $task --end
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
if not (is-debug-enabled) { end_run "" }
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
export def server_ssh_addr [
|
|||
|
|
settings: record
|
|||
|
|
server: record
|
|||
|
|
] {
|
|||
|
|
#use (prov-middleware) mw_get_ip
|
|||
|
|
let connect_ip = (mw_get_ip $settings $server ($server | get -o liveness_ip | default "public") false)
|
|||
|
|
if $connect_ip == "" { return "" }
|
|||
|
|
$"($server | get -o installer_user | default "root")@($connect_ip)"
|
|||
|
|
}
|
|||
|
|
export def server_ssh_id [
|
|||
|
|
server: record
|
|||
|
|
] {
|
|||
|
|
let raw = ($server | get -o ssh_key_path | default "")
|
|||
|
|
if ($raw | is-empty) { return "" }
|
|||
|
|
($raw | str replace ".pub" "" | path expand)
|
|||
|
|
}
|
|||
|
|
export def server_ssh [
|
|||
|
|
settings: record
|
|||
|
|
request_from: string
|
|||
|
|
ip_type: string
|
|||
|
|
run: bool
|
|||
|
|
text_match?: string
|
|||
|
|
check: bool = false # Check mode - skip actual changes
|
|||
|
|
] {
|
|||
|
|
let default_port = 22
|
|||
|
|
# Use reduce instead of each to track success status
|
|||
|
|
let all_succeeded = ($settings.data.servers | reduce -f true { |server, acc|
|
|||
|
|
if $text_match == null or $server.hostname == $text_match {
|
|||
|
|
let result = (on_server_ssh $settings $server $ip_type $request_from $run $check)
|
|||
|
|
$acc and $result
|
|||
|
|
} else {
|
|||
|
|
$acc
|
|||
|
|
}
|
|||
|
|
})
|
|||
|
|
$all_succeeded
|
|||
|
|
}
|
|||
|
|
def ssh_config_entry [
|
|||
|
|
server: record
|
|||
|
|
ssh_key_path: string
|
|||
|
|
] {
|
|||
|
|
$"
|
|||
|
|
Host ($server.hostname)
|
|||
|
|
User ($server.installer_user | default "root")
|
|||
|
|
HostName ($server.hostname)
|
|||
|
|
IdentityFile ($ssh_key_path)
|
|||
|
|
ServerAliveInterval 239
|
|||
|
|
StrictHostKeyChecking accept-new
|
|||
|
|
Port ($server | get -o user_ssh_port | default 22)
|
|||
|
|
"
|
|||
|
|
}
|
|||
|
|
export def on_server_ssh [
|
|||
|
|
settings: record
|
|||
|
|
server: record
|
|||
|
|
ip_type: string
|
|||
|
|
request_from: string
|
|||
|
|
run: bool
|
|||
|
|
check: bool = false # Check mode - skip actual changes
|
|||
|
|
] {
|
|||
|
|
#use (prov-middleware) mw_get_ip
|
|||
|
|
let connect_ip = (mw_get_ip $settings $server ($server | get -o liveness_ip | default "public") false)
|
|||
|
|
if $connect_ip == "" {
|
|||
|
|
_print ($"\n🛑 (_ansi red)Error(_ansi reset) no (_ansi red)($server | get -o liveness_ip | default "public")(_ansi reset) " +
|
|||
|
|
$"found for (_ansi green)($server.hostname)(_ansi reset)"
|
|||
|
|
)
|
|||
|
|
return false
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
# Pre-check: if fix_local_hosts is enabled, verify sudo access upfront
|
|||
|
|
# Skip in check mode since we're not making actual changes
|
|||
|
|
if ($server | get -o fix_local_hosts | default false) and not $check and not (check_sudo_cached) {
|
|||
|
|
print $"\n(_ansi yellow)⚠ Sudo access required for --fix-local-hosts(_ansi reset)"
|
|||
|
|
print $"(_ansi blue)ℹ You will be prompted for your password, or press CTRL-C to cancel(_ansi reset)"
|
|||
|
|
print $"(_ansi white_dimmed) Tip: Run 'sudo -v' beforehand to cache credentials(_ansi reset)\n"
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
let hosts_path = "/etc/hosts"
|
|||
|
|
let ssh_key_path = ($server | get -o ssh_key_path | default "" | str replace ".pub" "" | path expand)
|
|||
|
|
# Skip fix_local_hosts operations in check mode
|
|||
|
|
if ($server | get -o fix_local_hosts | default false) and not $check {
|
|||
|
|
let ips = (
|
|||
|
|
open /etc/hosts
|
|||
|
|
| lines
|
|||
|
|
| where {|l| ($l | str contains $server.hostname) and not ($l | str starts-with "#")}
|
|||
|
|
| each {|l| $l | split row " " | first | str trim}
|
|||
|
|
| where {|ip| $ip | is-not-empty}
|
|||
|
|
)
|
|||
|
|
for ip in $ips {
|
|||
|
|
if ($ip | is-not-empty) and $ip != $connect_ip {
|
|||
|
|
let sed_del_result = (do --ignore-errors { ^sudo sed -ie $"/^($ip)/d" $hosts_path } | complete)
|
|||
|
|
# Check for cancellation: exit code 1 (no password) or 130 (CTRL-C/SIGINT)
|
|||
|
|
if ($sed_del_result.exit_code == 1 and ($sed_del_result.stderr | str contains "password is required")) or $sed_del_result.exit_code == 130 {
|
|||
|
|
print $"\n(_ansi yellow)⚠ Operation cancelled - sudo password required but not provided(_ansi reset)"
|
|||
|
|
print $"(_ansi blue)ℹ Run 'sudo -v' first to cache credentials, or run without --fix-local-hosts(_ansi reset)"
|
|||
|
|
return false # Return false to signal cancellation
|
|||
|
|
} else if $sed_del_result.exit_code != 0 and $sed_del_result.exit_code != 1 and $sed_del_result.exit_code != 130 {
|
|||
|
|
error make {msg: $"sed delete command failed: ($sed_del_result.stderr)"}
|
|||
|
|
}
|
|||
|
|
_print $"Delete ($ip) entry in ($hosts_path)"
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
if ($server | get -o fix_local_hosts | default false) and (
|
|||
|
|
open /etc/hosts
|
|||
|
|
| lines
|
|||
|
|
| where {|l| ($l | str contains $connect_ip) and not ($l | str starts-with "#")}
|
|||
|
|
| is-empty
|
|||
|
|
) {
|
|||
|
|
if ($server.hostname | is-not-empty) {
|
|||
|
|
# macOS sed requires -i '' (empty string for in-place edit without backup)
|
|||
|
|
let sed_result = (do --ignore-errors { ^sudo sed -i '' $"/($server.hostname)/d" $hosts_path } | complete)
|
|||
|
|
# Check for cancellation: exit code 1 (no password) or 130 (CTRL-C/SIGINT)
|
|||
|
|
if ($sed_result.exit_code == 1 and ($sed_result.stderr | str contains "password is required")) or $sed_result.exit_code == 130 {
|
|||
|
|
print $"\n(_ansi yellow)⚠ Operation cancelled - sudo password required but not provided(_ansi reset)"
|
|||
|
|
print $"(_ansi blue)ℹ Run 'sudo -v' first to cache credentials, or run without --fix-local-hosts(_ansi reset)"
|
|||
|
|
return false # Return false to signal cancellation
|
|||
|
|
} else if $sed_result.exit_code != 0 and $sed_result.exit_code != 1 and $sed_result.exit_code != 130 {
|
|||
|
|
error make {msg: $"sed command failed: ($sed_result.stderr)"}
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
let extra_hostnames = ($server.extra_hostnames | default [] | str join " ")
|
|||
|
|
let tee_result = (do --ignore-errors { $"($connect_ip) ($server.hostname) ($extra_hostnames)\n" | ^sudo tee -a $hosts_path } | complete)
|
|||
|
|
# Check for cancellation: exit code 1 (no password) or 130 (CTRL-C/SIGINT)
|
|||
|
|
if ($tee_result.exit_code == 1 and ($tee_result.stderr | str contains "password is required")) or $tee_result.exit_code == 130 {
|
|||
|
|
print $"\n(_ansi yellow)⚠ Operation cancelled - sudo password required but not provided(_ansi reset)"
|
|||
|
|
print $"(_ansi blue)ℹ Run 'sudo -v' first to cache credentials, or run without --fix-local-hosts(_ansi reset)"
|
|||
|
|
return false # Return false to signal cancellation
|
|||
|
|
} else if $tee_result.exit_code != 0 and $tee_result.exit_code != 1 and $tee_result.exit_code != 130 {
|
|||
|
|
error make {msg: $"tee command failed: ($tee_result.stderr)"}
|
|||
|
|
}
|
|||
|
|
^ssh-keygen -f $"($env.HOME)/.ssh/known_hosts" -R $server.hostname err> (if $nu.os-info.name == "windows" { "NUL" } else { "/dev/null" })
|
|||
|
|
_print $"(_ansi green)($server.hostname)(_ansi reset) entry in ($hosts_path) added"
|
|||
|
|
}
|
|||
|
|
if ($server | get -o fix_local_hosts | default false) and (
|
|||
|
|
not ($"($env.HOME)/.ssh/config" | path exists) or (
|
|||
|
|
open $"($env.HOME)/.ssh/config"
|
|||
|
|
| lines
|
|||
|
|
| where {|l| ($l | str contains $"HostName ($server.hostname)") and not ($l | str starts-with "#")}
|
|||
|
|
| is-empty
|
|||
|
|
)
|
|||
|
|
) {
|
|||
|
|
(ssh_config_entry $server $ssh_key_path) | save -a $"($env.HOME)/.ssh/config"
|
|||
|
|
_print $"(_ansi green)($server.hostname)(_ansi reset) entry in ($env.HOME)/.ssh/config for added"
|
|||
|
|
}
|
|||
|
|
let hosts_entry = (
|
|||
|
|
open /etc/hosts
|
|||
|
|
| lines
|
|||
|
|
| where {|l| ($l | str contains $connect_ip) and not ($l | str starts-with "#")}
|
|||
|
|
| str join "\n"
|
|||
|
|
)
|
|||
|
|
let ssh_config_path = $"($env.HOME)/.ssh/config"
|
|||
|
|
let ssh_config_entry = if ($ssh_config_path | path exists) {
|
|||
|
|
open $ssh_config_path
|
|||
|
|
| lines
|
|||
|
|
| where {|l| ($l | str contains $"HostName ($server.hostname)") and not ($l | str starts-with "#")}
|
|||
|
|
| str join "\n"
|
|||
|
|
} else { "" }
|
|||
|
|
if $run {
|
|||
|
|
let key_id = (server_ssh_id $server)
|
|||
|
|
if ($key_id | is-empty) {
|
|||
|
|
print $"🛑 No ssh_key_path for ($server.hostname) — check settings"
|
|||
|
|
return false
|
|||
|
|
}
|
|||
|
|
if not ($key_id | path exists) {
|
|||
|
|
print $"🛑 SSH key not found: ($key_id)"
|
|||
|
|
return false
|
|||
|
|
}
|
|||
|
|
let addr = (server_ssh_addr $settings $server)
|
|||
|
|
if ($addr | is-empty) {
|
|||
|
|
print $"🛑 Could not resolve address for ($server.hostname)"
|
|||
|
|
return false
|
|||
|
|
}
|
|||
|
|
print $"Connecting to server ($server.hostname) → ($addr)\n"
|
|||
|
|
^ssh -o StrictHostKeyChecking=accept-new -o ServerAliveInterval=30 -i $key_id $addr
|
|||
|
|
return true
|
|||
|
|
}
|
|||
|
|
match $request_from {
|
|||
|
|
"error" | "end" => {
|
|||
|
|
_print $"(_ansi default_dimmed)To connect server ($server.hostname) use:(_ansi reset)\n"
|
|||
|
|
if $ssh_config_entry != "" and $hosts_entry != "" { print $"ssh ($server.hostname) or " }
|
|||
|
|
show_clip_to $"ssh -i (server_ssh_id $server) (server_ssh_addr $settings $server) " true
|
|||
|
|
},
|
|||
|
|
"create" => {
|
|||
|
|
_print (
|
|||
|
|
(if $ssh_config_entry != "" and $hosts_entry != "" { $"ssh ($server.hostname) or " } else { "" }) +
|
|||
|
|
$"ssh -i (server_ssh_id $server) (server_ssh_addr $settings $server)"
|
|||
|
|
)
|
|||
|
|
}
|
|||
|
|
_ => {
|
|||
|
|
_print $"\n✅ To connect server (_ansi green_bold)($server.hostname)(_ansi reset) use:"
|
|||
|
|
if $hosts_entry == "" {
|
|||
|
|
_print $"(_ansi default_dimmed)\nAdd to /etc/hosts or DNS:(_ansi reset) ($connect_ip) ($server.hostname)"
|
|||
|
|
} else if (is-debug-enabled) {
|
|||
|
|
_print $"Entry for ($server.hostname) via ($connect_ip) is in ($hosts_path)"
|
|||
|
|
}
|
|||
|
|
if $ssh_config_entry == "" {
|
|||
|
|
_print $"\nVia (_ansi blue).ssh/config(_ansi reset) add entry:\n (ssh_config_entry $server $ssh_key_path)"
|
|||
|
|
} else if (is-debug-enabled) {
|
|||
|
|
_print $"ssh config entry for ($server.hostname) via ($connect_ip) is in ($env.HOME)/.ssh/config"
|
|||
|
|
}
|
|||
|
|
if $ssh_config_entry != "" and $hosts_entry != "" { _print $"ssh ($server.hostname) " }
|
|||
|
|
if (get-provisioning-out | is-empty) {
|
|||
|
|
show_clip_to $"ssh -i (server_ssh_id $server) (server_ssh_addr $settings $server) " true
|
|||
|
|
}
|
|||
|
|
},
|
|||
|
|
}
|
|||
|
|
true
|
|||
|
|
}
|