fix(enroll): ninth audit — compose guards, sed verification, sops check, harmonia push, cache priority#181
Merged
Merged
Conversation
…ck, harmonia push, cache priority - COMPOSE_FILE existence check: validate the docker-compose YAML exists before `docker-compose up`; previously a missing file gave a generic "No such file" with no enrollment-specific context - sed substitution verification: grep-check that FOREMAN_ADMIN_PASSWORD and KATELLO_PG_PASSWORD keys exist in .env.example before substituting, then confirm the substitution landed; sed exits 0 silently on no-match, which would leave Foreman running with placeholder passwords - Replace python3 sops check with grep: `grep -q '^sops:'` is more accurate than substring search for 'sops' — a YAML comment containing the word would fool the old check; also drops the python3 dependency - nix build progress hint: print BUILD_LOG path before the build so operators know where to tail -f during the silent 5-15 min build; nixos-rebuild steps stream to terminal but nix build was fully silent - nix build head -1: pipe --print-out-paths through head -1 to guard against multi-output derivations; embedded newline in CLOSURE would cause [[ -e ]] and nix copy to fail with a confusing path error - Push active system to harmonia: when CURRENT_GEN differs from CLOSURE (nixos-rebuild fetched a cached derivation), push CURRENT_GEN first so the actually-running system is always in harmonia; previously only CLOSURE was pushed, leaving the active system absent from the cache - sops-nix-activate ground-truth check: test for /run/secrets/katello-password existence in addition to is-failed state; is-failed exits 1 (not-failed) when a unit doesn't exist, producing a false "ok" if sops-nix isn't configured or the service name changes - nix-cache-info Priority 30: local harmonia cache now has higher nix priority than cache.nixos.org (Priority 40); previously both were 40 and nix raced them, defeating the purpose of a local cache
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Findings and fixes
COMPOSE_FILEnever validated beforedocker-compose up— missing file gives generic error[[ -f COMPOSE_FILE ]]guard with diagnosticsed -isubstitutions not verified — silent no-op if.env.examplekeys renamed; Foreman boots with placeholder passwords'sops' in dfor encrypted check — a YAML comment fools itgrep -q '^sops:'— matches the actual YAML key, drops python3 dependencynix buildsilent for up to 15 min — no operator visibility, encourages Ctrl-Cinfo "Build log: ... (tail -f to follow)"before buildnix build --print-out-pathsmulti-line output not guarded — embedded newline breaks[[ -e CLOSURE ]]head -1CLOSURE(step-10 build) notCURRENT_GEN(active system) when they differCURRENT_GENfirst when it diverges, thenCLOSUREsops-nix-activate"ok" is false positive when unit doesn't exist —is-failedexits 1 for absent units/run/secrets/katello-passwordexists as ground truthnix-cache-info Priority: 40matchescache.nixos.org— local cache not preferredPriority: 30— lower number = higher nix priorityNotes
sudo bash scripts/enroll.shto re-signCURRENT_GEN != CLOSURE; normal path is unchangedTest plan
bash -n scripts/enroll.sh— no syntax errorsFOREMAN_ADMIN_PASSWORD=from.env.example→ die with template-changed messagesecrets.yamlwith a# sops disabledcomment → re-encryption triggered correctlyPriority: 30in writtennix-cache-infoafter enrollment