nxd_core/

config.rs

use std::path::{Path, PathBuf};
use std::sync::OnceLock;

pub const DEFAULT_SECRETS_REPO: &str = "secrets";
pub const DEFAULT_SECRETS_SITE_ENV: &str = "DEFAULT_SECRETS_SITE";
pub const DEFAULT_BUILDER: &str = "";

pub const DEFAULT_NIX_CFG: &str = "nxd-source";
pub const APP_NAME: &str = "nxd";
pub const SECRET_INPUT_NAME: &str = "installer-secret";
pub const CHECKOUT_EXCLUDES: &[&str] =
	&[".git", "result", ".DS_Store", "target", "apps/nxd/target", "secrets"];

pub const FALLBACK_TARGET_NIXOS_CHANNEL: &str = "nixos-26.05";

// Note: We deliberately pin the default kexec installer channel to a stable, older release
// (nixos-25.05) rather than matching the target NixOS version (26.05).
// Newer kexec kernels/initrds can fail to load on older target hosts (e.g. Ubuntu VMs)
// due to compatibility issues with host-level `kexec-tools`.
pub const PRIMARY_KEXEC_INSTALLER_CHANNEL: &str = "nixos-25.05";

pub struct HostSopsSource {
	pub path: PathBuf,
	pub description: String,
}

fn is_valid_site(site: &str) -> bool {
	!site.is_empty()
		&& site.len() <= 64
		&& site.bytes().all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_'))
}

/// Site prefix holding `hostname`'s secrets.
///
/// `DEFAULT_SECRETS_SITE` is per-invocation, so it cannot describe a consumer
/// whose hosts span several sites. When it does not hold the host, discover the
/// site from the repository layout instead. Ambiguity is refused rather than
/// guessed: picking the wrong site writes a second identity for a host that
/// already has one.
pub fn resolve_secrets_site(hostname: &str) -> Result<String, String> {
	let repo = get_secrets_repo();
	let configured = get_runtime_options().secrets_site.clone().unwrap_or_default();
	if is_valid_site(&configured) && repo.join(&configured).join("hosts").join(hostname).is_dir() {
		return Ok(configured);
	}

	let mut found: Vec<String> = std::fs::read_dir(&repo)
		.map_err(|error| format!("cannot read secrets repository {}: {error}", repo.display()))?
		.filter_map(Result::ok)
		.filter_map(|entry| entry.file_name().into_string().ok())
		.filter(|name| is_valid_site(name))
		.filter(|name| repo.join(name).join("hosts").join(hostname).is_dir())
		.collect();
	found.sort();

	match found.as_slice() {
		[site] => Ok(site.clone()),
		[] if is_valid_site(&configured) => Ok(configured),
		[] => Err(format!("no secrets site in {} holds host {hostname}", repo.display())),
		sites => Err(format!(
			"host {hostname} exists under several secrets sites ({}); \
			 set DEFAULT_SECRETS_SITE or remove the duplicates",
			sites.join(", ")
		)),
	}
}

pub fn host_sops_path(hostname: &str) -> PathBuf {
	let site = resolve_secrets_site(hostname).unwrap_or_default();
	get_secrets_repo().join(site).join("hosts").join(hostname).join(format!("{}.yaml", hostname))
}

#[derive(serde::Deserialize, Debug, Default, Clone)]
struct Defines {
	#[serde(rename = "myRepoName")]
	my_repo_name: String,
	#[serde(rename = "mySshAuthKey")]
	my_ssh_auth_key: String,
	#[serde(rename = "defaultNetworks")]
	default_networks: Vec<String>,
}

fn load_defines() -> &'static Defines {
	static DEFINES: OnceLock<Defines> = OnceLock::new();
	DEFINES.get_or_init(|| {
		let defines_path = if let Some(dir) = get_flake_dir() {
			dir.join("defines.nix").to_string_lossy().to_string()
		} else {
			"./defines.nix".to_string()
		};

		if !std::path::Path::new(&defines_path).exists() {
			return Defines::default();
		}

		let expr = format!(
			r#"
            let
              defs = import {};
            in
            {{
              myRepoName = defs.myRepoName or "";
              mySshAuthKey = defs.mySshAuthKey or "";
              defaultNetworks = defs.defaultNetworks or [];
            }}
            "#,
			defines_path
		);

		let output = crate::process::sanitized_command("nix")
			.args(["eval", "--json", "--impure", "--expr", &expr])
			.output();
		match output {
			Ok(out) if out.status.success() => serde_json::from_slice(&out.stdout).unwrap_or_default(),
			_ => Defines::default(),
		}
	})
}

fn define_value(attr: &str) -> Option<String> {
	let definitions = load_defines();
	let value = match attr {
		"myRepoName" => &definitions.my_repo_name,
		"mySshAuthKey" => &definitions.my_ssh_auth_key,
		_ => return None,
	};
	(!value.is_empty()).then(|| value.clone())
}

/// Resolves the secrets repository absolute path.
pub fn get_secrets_repo() -> PathBuf {
	let opts = get_runtime_options();
	if let Some(ref secrets_ref) = opts.secrets_repo
		&& !secrets_ref.is_empty()
	{
		return Path::new(secrets_ref).to_path_buf();
	}

	if let Ok(repo) = std::env::var("DEFAULT_SECRETS_REPO") {
		Path::new(&repo).to_path_buf()
	} else {
		PathBuf::from(DEFAULT_SECRETS_REPO)
	}
}

/// Walks up from `start` looking for a `flake.nix`, returning the first
/// directory that contains one. Returns `None` if the filesystem root is
/// reached without finding one.
fn find_flake_root(start: &std::path::Path) -> Option<std::path::PathBuf> {
	let mut dir = start;
	loop {
		if dir.join("flake.nix").exists() {
			return Some(dir.to_path_buf());
		}
		match dir.parent() {
			Some(parent) => dir = parent,
			None => return None,
		}
	}
}

/// Resolves the configuration flake directory path.
pub fn get_flake_dir() -> Option<PathBuf> {
	let opts = get_runtime_options();
	if let Some(ref flake_ref) = opts.flake
		&& !flake_ref.is_empty()
		&& let Some(local_path) = local_flake_path(flake_ref)
		&& local_path.exists()
	{
		return Some(local_path);
	}

	if let Ok(repo) = std::env::var("DEFAULT_FLAKE_REPO") {
		Some(PathBuf::from(repo))
	} else if let Ok(cwd) = std::env::current_dir()
		&& let Some(root) = find_flake_root(&cwd)
	{
		Some(root)
	} else {
		None
	}
}

pub fn resolve_flake(flake_arg: Option<&str>) -> String {
	match flake_arg {
		Some(val) if !val.is_empty() => val.to_string(),
		_ => {
			if let Some(root) = get_flake_dir() {
				format!("path:{}", root.display())
			} else {
				"path:.".to_string()
			}
		}
	}
}

pub fn flake_uri() -> String {
	let opts = get_runtime_options();
	resolve_flake(opts.flake.as_deref())
}

pub fn is_local_flake(flake_ref: &str) -> bool {
	flake_ref.starts_with("path:")
		|| flake_ref.starts_with("git+file:")
		|| flake_ref == "."
		|| flake_ref == ".."
		|| flake_ref.starts_with("./")
		|| flake_ref.starts_with("../")
		|| flake_ref.starts_with('/')
}

pub fn local_flake_path(flake_ref: &str) -> Option<PathBuf> {
	let path = if let Some(path) = flake_ref.strip_prefix("path:") {
		path
	} else if let Some(path) = flake_ref.strip_prefix("git+file:") {
		path.strip_prefix("//").unwrap_or(path).split('?').next().unwrap_or(path)
	} else if is_local_flake(flake_ref) {
		flake_ref
	} else {
		return None;
	};
	Some(PathBuf::from(path))
}

pub fn resolve_host_sops_source(hostname: &str) -> Option<HostSopsSource> {
	resolve_secrets_site(hostname).ok()?;
	let path = host_sops_path(hostname);
	path.exists().then(|| HostSopsSource {
		description: format!("Using configured host secrets: {}", path.display()),
		path,
	})
}

/// Get the configuration repository name.
pub fn nix_cfg() -> String {
	static VALUE: OnceLock<String> = OnceLock::new();
	VALUE
		.get_or_init(|| define_value("myRepoName").unwrap_or_else(|| DEFAULT_NIX_CFG.to_string()))
		.clone()
}

/// Get the SSH authorized key.
pub fn ssh_auth_key() -> String {
	static VALUE: OnceLock<String> = OnceLock::new();
	VALUE.get_or_init(|| define_value("mySshAuthKey").unwrap_or_default()).clone()
}

/// Retrieve approved scan subnets from defines.nix.
pub fn default_networks() -> Vec<String> {
	load_defines().default_networks.clone()
}

fn parse_nixpkgs_version_from_flake() -> Option<String> {
	let flake_dir = get_flake_dir()?;
	let flake_path = flake_dir.join("flake.nix");
	if let Ok(content) = std::fs::read_to_string(&flake_path) {
		for line in content.lines() {
			if let Some(pos) = line.find("github:nixos/nixpkgs/nixos-") {
				let start = pos + "github:nixos/nixpkgs/nixos-".len();
				let end_chars = ['"', '\'', ';', ' ', '\t'];
				if let Some(end_offset) = line[start..].find(|c| end_chars.contains(&c)) {
					let version = line[start..start + end_offset].trim().to_string();
					if !version.is_empty() {
						return Some(version);
					}
				}
			}
		}
	}
	None
}

fn channel_release(channel: &str) -> &str {
	channel.strip_prefix("nixos-").unwrap_or(channel)
}

/// Get the stable NixOS release used in generated ISO artifact names.
pub fn nixos_iso_version() -> String {
	channel_release(&nixos_channel()).to_string()
}

/// Get the NixOS Channel dynamically by querying the flake metadata.
pub fn nixos_channel() -> String {
	static CHANNEL: OnceLock<String> = OnceLock::new();
	CHANNEL
		.get_or_init(|| {
			// 1. Try local parser first
			if let Some(version) = parse_nixpkgs_version_from_flake() {
				return format!("nixos-{}", version);
			}

			// 2. Fall back to nix eval --offline
			let flake_ref = if let Some(local_path) = local_flake_path(&flake_uri()) {
				format!(
					"{}#nixosConfigurations.minimal-iso-x86.config.system.nixos.release",
					local_path.display()
				)
			} else {
				".#nixosConfigurations.minimal-iso-x86.config.system.nixos.release".to_string()
			};
			let output = crate::process::sanitized_command("nix")
				.args(["eval", &flake_ref, "--raw", "--offline"])
				.output();
			if let Ok(out) = output
				&& out.status.success()
			{
				let release = String::from_utf8_lossy(&out.stdout).trim().to_string();
				if !release.is_empty() {
					return format!("nixos-{}", release);
				}
			}

			// 3. Fall back to hardcoded default
			FALLBACK_TARGET_NIXOS_CHANNEL.to_string()
		})
		.clone()
}

/// Get the NixOS Channel for the kexec installer, prioritizing environment override.
pub fn kexec_channel() -> String {
	std::env::var("DEFAULT_KEXEC_INSTALLER_CHANNEL")
		.or_else(|_| std::env::var("DEFAULT_KEXEC_CHANNEL"))
		.unwrap_or_else(|_| PRIMARY_KEXEC_INSTALLER_CHANNEL.to_string())
}

/// Dynamically construct the kexec image download URL based on the configured kexec channel.
pub fn kexec_url(arch: &str) -> String {
	let channel = kexec_channel();
	format!(
		"https://github.com/nix-community/nixos-images/releases/download/{}/nixos-kexec-installer-noninteractive-{}-linux.tar.gz",
		channel, arch
	)
}

/// Get the default Proxmox ISO storage pool
pub fn proxmox_default_iso_storage() -> String {
	String::new()
}

/// Get the default Proxmox disk storage pool
pub fn proxmox_default_disk_storage() -> String {
	String::new()
}

/// Get the default Proxmox network net0 configuration
pub fn proxmox_default_network() -> String {
	String::new()
}

pub fn local_cache_config() -> Result<Option<(String, String)>, Box<dyn std::error::Error>> {
	let url = std::env::var("NXD_LOCAL_CACHE_URL").unwrap_or_default();
	let public_key = std::env::var("NXD_LOCAL_CACHE_PUBLIC_KEY").unwrap_or_default();
	if url.is_empty() && public_key.is_empty() {
		return Ok(None);
	}
	if url.is_empty() || public_key.is_empty() {
		return Err(
			"Local cache requires both NXD_LOCAL_CACHE_URL and NXD_LOCAL_CACHE_PUBLIC_KEY".into(),
		);
	}
	if !url.starts_with("https://")
		|| url.chars().any(char::is_whitespace)
		|| public_key.chars().any(char::is_whitespace)
		|| !public_key.contains(':')
	{
		return Err("Local cache URL or public key is malformed".into());
	}
	Ok(Some((url, public_key)))
}

/// Finds a custom own-built NixOS ISO in the current workspace.
pub fn find_custom_iso(flavor: &str) -> Option<PathBuf> {
	let workspace_flavor = match flavor {
		"x86_64" => "x86",
		"qemu" => "x86",
		other => other,
	};
	let result_link = format!("result-iso-{}", workspace_flavor);
	let result_path = Path::new(&result_link).join("iso");
	if result_path.exists()
		&& let Ok(entries) = std::fs::read_dir(result_path)
	{
		for entry in entries.flatten() {
			let path = entry.path();
			if path.is_file()
				&& let Some(ext) = path.extension().and_then(|e| e.to_str())
				&& ext == "iso"
			{
				return Some(path);
			}
		}
	}
	None
}

/// Process-level operator options injected once by the CLI composition root.
///
/// Production code must not invent values from scattered environment reads for
/// these fields. The only writer outside tests is `nxd-cli` `main` via
/// [`set_runtime_options`]. Prefer threading values on `RuntimeContext` when
/// adding new call paths.
#[derive(Clone, Debug)]
pub struct RuntimeOptions {
	pub debug: bool,
	/// Request host plane enrollment replace on switch (operator surface: --reenroll).
	pub reenroll: bool,
	pub low_mem: Option<bool>,
	pub builder: Option<String>,
	pub flake: Option<String>,
	pub secrets_repo: Option<String>,
	pub secrets_site: Option<String>,
	/// Max concurrent independent deployment-target apply workers (and legacy batch ops).
	pub parallel: usize,
	pub reactivate: bool,
}

impl Default for RuntimeOptions {
	fn default() -> Self {
		Self {
			debug: false,
			reenroll: false,
			low_mem: None,
			builder: None,
			flake: None,
			secrets_repo: None,
			secrets_site: std::env::var(DEFAULT_SECRETS_SITE_ENV).ok(),
			parallel: 5,
			reactivate: false,
		}
	}
}

#[cfg(not(test))]
static RUNTIME_OPTIONS: OnceLock<RuntimeOptions> = OnceLock::new();

#[cfg(not(test))]
pub fn set_runtime_options(opts: RuntimeOptions) {
	let _ = RUNTIME_OPTIONS.set(opts);
}

#[cfg(not(test))]
pub fn get_runtime_options() -> &'static RuntimeOptions {
	RUNTIME_OPTIONS.get_or_init(RuntimeOptions::default)
}

#[cfg(test)]
thread_local! {
		static TEST_RUNTIME_OPTIONS: std::cell::RefCell<Option<&'static RuntimeOptions>> =
				const { std::cell::RefCell::new(None) };
}

#[cfg(test)]
pub fn set_runtime_options(opts: RuntimeOptions) {
	let leaked = Box::leak(Box::new(opts));
	TEST_RUNTIME_OPTIONS.with(|cell| {
		*cell.borrow_mut() = Some(leaked);
	});
}

#[cfg(test)]
pub fn get_runtime_options() -> &'static RuntimeOptions {
	TEST_RUNTIME_OPTIONS.with(|cell| {
		if let Some(opts) = *cell.borrow() {
			opts
		} else {
			static DEFAULT_OPTS: OnceLock<RuntimeOptions> = OnceLock::new();
			DEFAULT_OPTS.get_or_init(RuntimeOptions::default)
		}
	})
}

pub fn nix_token_args() -> Vec<String> {
	Vec::new()
}

pub fn redact_token(input: &str) -> String {
	crate::progress::redaction::redact_sensitive_text(input)
}

#[cfg(test)]
#[allow(unsafe_code)] // Environment override tests are serialized by ENV_MUTEX.
mod tests {
	use super::*;

	static ENV_MUTEX: std::sync::Mutex<()> = std::sync::Mutex::new(());

	#[test]
	fn nxd_never_constructs_secret_bearing_nix_arguments() {
		assert!(nix_token_args().is_empty());
	}

	#[test]
	fn test_env_var_overrides() {
		let _guard = ENV_MUTEX.lock().unwrap();
		unsafe {
			std::env::set_var("DEFAULT_SECRETS_REPO", "/tmp/mock-secrets");
		}
		assert_eq!(get_secrets_repo(), PathBuf::from("/tmp/mock-secrets"));
		unsafe {
			std::env::remove_var("DEFAULT_SECRETS_REPO");
		}

		unsafe {
			std::env::set_var("DEFAULT_FLAKE_REPO", "/tmp/mock-flake");
		}
		assert_eq!(get_flake_dir(), Some(PathBuf::from("/tmp/mock-flake")));
		unsafe {
			std::env::remove_var("DEFAULT_FLAKE_REPO");
		}
	}

	#[test]
	fn test_parse_nixpkgs_version() {
		let _guard = ENV_MUTEX.lock().unwrap();
		let temp_dir = std::env::temp_dir().join("nxd-test-flake");
		std::fs::create_dir_all(&temp_dir).unwrap();
		let flake_path = temp_dir.join("flake.nix");
		std::fs::write(
			&flake_path,
			r#"{
  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-26.05";
  };
}"#,
		)
		.unwrap();

		unsafe {
			std::env::set_var("DEFAULT_FLAKE_REPO", temp_dir.to_str().unwrap());
		}
		assert_eq!(parse_nixpkgs_version_from_flake(), Some("26.05".to_string()));

		// Test with single quotes and different spaces
		std::fs::write(
			&flake_path,
			r#"{
  inputs = {
    nixpkgs.url = 'github:nixos/nixpkgs/nixos-27.05';
  };
}"#,
		)
		.unwrap();
		assert_eq!(parse_nixpkgs_version_from_flake(), Some("27.05".to_string()));

		unsafe {
			std::env::remove_var("DEFAULT_FLAKE_REPO");
		}
		let _ = std::fs::remove_dir_all(&temp_dir);
	}

	#[test]
	fn test_channel_release_for_iso_artifact_names() {
		assert_eq!(channel_release("nixos-26.05"), "26.05");
		assert_eq!(channel_release("26.05"), "26.05");
	}

	/// Builds a secrets repo containing `<site>/hosts/<host>/` for each pair.
	fn secrets_repo_fixture(layout: &[(&str, &str)]) -> PathBuf {
		let root = std::env::temp_dir().join(format!(
			"nxd-site-{}-{:?}",
			std::process::id(),
			std::thread::current().id()
		));
		let _ = std::fs::remove_dir_all(&root);
		for (site, host) in layout {
			std::fs::create_dir_all(root.join(site).join("hosts").join(host)).unwrap();
		}
		root
	}

	#[test]
	fn secrets_site_is_discovered_when_the_configured_one_lacks_the_host() {
		let _guard = ENV_MUTEX.lock().unwrap();
		let repo = secrets_repo_fixture(&[("bar", "medo"), ("fcm", "fcmbuilder")]);
		set_runtime_options(RuntimeOptions {
			secrets_repo: Some(repo.to_string_lossy().into_owned()),
			secrets_site: Some("bar".to_string()),
			..Default::default()
		});

		assert_eq!(resolve_secrets_site("medo").unwrap(), "bar");
		assert_eq!(resolve_secrets_site("fcmbuilder").unwrap(), "fcm");

		set_runtime_options(RuntimeOptions::default());
		let _ = std::fs::remove_dir_all(&repo);
	}

	/// Guessing here would write a second identity for a host that already has
	/// one, so an ambiguous layout must refuse.
	#[test]
	fn a_host_under_several_sites_is_refused() {
		let _guard = ENV_MUTEX.lock().unwrap();
		let repo = secrets_repo_fixture(&[("bar", "fcmbuilder"), ("fcm", "fcmbuilder")]);
		set_runtime_options(RuntimeOptions {
			secrets_repo: Some(repo.to_string_lossy().into_owned()),
			secrets_site: Some("nonexistent".to_string()),
			..Default::default()
		});

		let error = resolve_secrets_site("fcmbuilder").unwrap_err();
		assert!(error.contains("bar, fcm"), "{error}");

		set_runtime_options(RuntimeOptions::default());
		let _ = std::fs::remove_dir_all(&repo);
	}

	/// A configured site that holds the host wins outright, so an operator can
	/// still disambiguate the case above.
	#[test]
	fn the_configured_site_wins_when_it_holds_the_host() {
		let _guard = ENV_MUTEX.lock().unwrap();
		let repo = secrets_repo_fixture(&[("bar", "fcmbuilder"), ("fcm", "fcmbuilder")]);
		set_runtime_options(RuntimeOptions {
			secrets_repo: Some(repo.to_string_lossy().into_owned()),
			secrets_site: Some("fcm".to_string()),
			..Default::default()
		});

		assert_eq!(resolve_secrets_site("fcmbuilder").unwrap(), "fcm");

		set_runtime_options(RuntimeOptions::default());
		let _ = std::fs::remove_dir_all(&repo);
	}

	#[test]
	fn test_secrets_repo_cli_override() {
		set_runtime_options(RuntimeOptions {
			secrets_repo: Some("/tmp/cli-mock-secrets".to_string()),
			..Default::default()
		});
		assert_eq!(get_secrets_repo(), PathBuf::from("/tmp/cli-mock-secrets"));

		set_runtime_options(RuntimeOptions::default());
	}
}