mesh-host/internal/bootstrap/rootsecrets.go

package bootstrap

import (
	"bytes"
	"crypto/rand"
	"encoding/base64"
	"fmt"
	"os"
	"path/filepath"
	"strings"

	"github.com/novox/mesh-host/internal/declaration"
)

// The mesh's root credentials, made at genesis rather than copied from the template.
//
// **The template carries `bootstrap` and `guest`, and a mesh raised from it kept them** (novox/hq
// issue 071). The store's superuser and the broker's administrator are the two credentials every
// other one rests on, and they were the two that were not secret: constants in a file anybody can
// read, carried into the mesh by `secret accept` and marked as something the mesh must never
// replace — which is correct for a credential that already created the databases, and made the
// well-known value permanent.
//
// So the installer makes them. Two random values, **made once and kept on this machine** at the
// paths the postgres and lavinmq modules declare as their own secrets — so that when phase three
// adopts the store and the broker, `secret accept` carries in exactly the value the servers were
// raised with, and the host's later write of the sealed secret lands the same bytes in the same
// file. A second run finds the files and changes nothing, which is what lets the installer say
// "already done" about a store it must not restart.
//
// **The store reads its password from a file, not its environment.** `POSTGRES_PASSWORD` in a
// container's environment is in `docker inspect` for ever; the module that adopts the store
// declares the same file mount, so the two specs are one and the applier reconciles rather than
// recreates (phase3.go). The broker has no such file: its image's default administrator is changed
// in place by an action once the broker answers, and the produced bundle carries that action.
const (
	// StoreSuperuserFile is where the store's superuser password lives on the machine — the
	// postgres module's own-secret path, so genesis and adoption write the same file.
	StoreSuperuserFile = "/var/lib/postgres/superuser.secret"
	// BrokerAdminFile is the same for the broker's administrator — the lavinmq module's.
	BrokerAdminFile = "/var/lib/lavinmq-module/admin.secret"
	// BrokerAdminUser is the broker's administrator. The image's default account, kept by name
	// and given a password that is not the image's default; a renamed account would have to be
	// created before anything can authenticate, and the thing that creates accounts is the thing
	// that has to authenticate first.
	BrokerAdminUser = "guest"

	storeSuperuserMount = "/run/secrets/superuser"

	// What the template says, matched exactly. A template that says something else is a template
	// this installer does not know how to make safe, and it says so rather than guessing.
	templateStorePassword = `"POSTGRES_PASSWORD": "bootstrap"`
	templateStoreVolumes  = `"volumes": ["mesh-store-data:/var/lib/postgresql/data"]`
	templateStoreURL      = "postgres:bootstrap@"
	templateBrokerURL     = "guest:guest@"
	templateBrokerReady   = "\"verify\": [\"lavinmqctl\", \"status\"]\n    },"
	brokerAdminMarker     = "/var/lib/lavinmq/.mesh-admin"
)

// RootCredentials are the two values, and whether this run made them.
type RootCredentials struct {
	Store, Broker         string
	StoreMade, BrokerMade bool
}

// RootSecrets reads the credentials this machine already holds, or makes them.
//
// A dry run makes them in memory and writes nothing — so the bundle it reports is the shape of the
// real one, and a machine that was only asked is not left holding half a genesis.
func RootSecrets(dryRun bool) (RootCredentials, error) {
	var out RootCredentials
	var err error
	if out.Store, out.StoreMade, err = keptOrMade(StoreSuperuserFile, dryRun); err != nil {
		return out, err
	}
	if out.Broker, out.BrokerMade, err = keptOrMade(BrokerAdminFile, dryRun); err != nil {
		return out, err
	}
	return out, nil
}

func keptOrMade(path string, dryRun bool) (value string, made bool, err error) {
	raw, err := os.ReadFile(path)
	if err == nil {
		value = strings.TrimRight(string(raw), "\r\n")
		if value == "" {
			return "", false, fmt.Errorf("%s exists and is empty; move it aside to have one made", path)
		}
		return value, false, nil
	}
	if !os.IsNotExist(err) {
		return "", false, err
	}
	value, err = freshSecret()
	if err != nil {
		return "", false, err
	}
	if dryRun {
		return value, true, nil
	}
	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
		return "", false, err
	}
	// Written whole and renamed into place, at 0600, owned by whoever runs the installer — root,
	// which is also who the host runs as when it later writes the sealed copy here.
	tmp := path + ".genesis"
	if err := os.WriteFile(tmp, []byte(value+"\n"), 0o600); err != nil {
		return "", false, err
	}
	if err := os.Rename(tmp, path); err != nil {
		return "", false, err
	}
	return value, true, nil
}

// freshSecret is the same shape the controller mints: 30 random bytes as unpadded base64url, 40
// characters, URL-safe — it lands inside connection strings.
func freshSecret() (string, error) {
	b := make([]byte, 30)
	if _, err := rand.Read(b); err != nil {
		return "", err
	}
	return base64.RawURLEncoding.EncodeToString(b), nil
}

// RootRewrite says what RewriteRoot did to the bundle.
type RootRewrite struct {
	StoreURLs, BrokerURLs int
}

// RewriteRoot puts the made credentials into the produced bundle, in place of the template's.
//
// Byte for byte, like the image rewrite, so the file keeps its comments and a person can read what
// was applied. Every replacement is counted and a count of zero is refused: a template that no
// longer says what this expects is one whose credentials this would silently leave at the
// well-known values, which is the fault this exists to remove.
func RewriteRoot(r *Rewritten, c RootCredentials) (RootRewrite, error) {
	var out RootRewrite
	bundle := r.Bundle

	// The store: a file, not an environment variable.
	var err error
	if bundle, err = replaceOnce(bundle, templateStorePassword,
		`"POSTGRES_PASSWORD_FILE": "`+storeSuperuserMount+`"`, "the store's password"); err != nil {
		return out, err
	}
	if bundle, err = replaceOnce(bundle, templateStoreVolumes,
		`"volumes": ["mesh-store-data:/var/lib/postgresql/data", "`+StoreSuperuserFile+":"+storeSuperuserMount+`:ro"]`,
		"the store's volumes"); err != nil {
		return out, err
	}
	// Everything that dials the store or the broker with the template's credentials.
	out.StoreURLs = bytes.Count(bundle, []byte(templateStoreURL))
	if out.StoreURLs == 0 {
		return out, fmt.Errorf("the template names no %q connection, so this installer cannot tell what it would be leaving well-known", templateStoreURL)
	}
	bundle = bytes.ReplaceAll(bundle, []byte(templateStoreURL), []byte("postgres:"+c.Store+"@"))
	out.BrokerURLs = bytes.Count(bundle, []byte(templateBrokerURL))
	if out.BrokerURLs == 0 {
		return out, fmt.Errorf("the template names no %q connection, so this installer cannot tell what it would be leaving well-known", templateBrokerURL)
	}
	bundle = bytes.ReplaceAll(bundle, []byte(templateBrokerURL), []byte(BrokerAdminUser+":"+c.Broker+"@"))

	// The broker's administrator, changed once the broker answers and before anything dials it.
	// Verified by a marker on the broker's own data volume, because the image carries nothing that
	// can try a password from inside; what proves the password is the control plane answering
	// over it, a few resources later.
	action := templateBrokerReady + "\n" +
		"    {\n" +
		"      \"id\": \"broker-admin\",\n" +
		"      \"type\": \"action\",\n" +
		"      \"in\": \"mesh-broker\",\n" +
		"      \"command\": [\"sh\", \"-c\", \"lavinmqctl change_password " + BrokerAdminUser + " '" + c.Broker + "' && touch " + brokerAdminMarker + "\"],\n" +
		"      \"verify\": [\"sh\", \"-c\", \"test -f " + brokerAdminMarker + "\"]\n" +
		"    },"
	if bundle, err = replaceOnce(bundle, templateBrokerReady, action, "the broker's readiness check"); err != nil {
		return out, err
	}

	parsed, err := declaration.ParseFileTrusted(bundle)
	if err != nil {
		return out, fmt.Errorf("the bundle stopped being a declaration after its credentials were rewritten, which is this installer's fault: %w", err)
	}
	r.Bundle, r.Declaration, r.Resources = bundle, parsed, len(parsed.Resources)
	return out, nil
}

func replaceOnce(in []byte, from, to, what string) ([]byte, error) {
	switch n := bytes.Count(in, []byte(from)); n {
	case 1:
		return bytes.Replace(in, []byte(from), []byte(to), 1), nil
	case 0:
		return nil, fmt.Errorf("the template does not say %s the way this installer expects (%s), so it cannot be made safe here", what, from)
	default:
		return nil, fmt.Errorf("the template says %s %d times, and this installer expected once", what, n)
	}
}