chore: implement sudo_password decryption with sops

weriomat · weriomat · commit 133de1dac2cb · 2025-06-05T13:55:49.000+02:00
diff --git a/interface.json b/interface.json
@@ -38,6 +38,12 @@
                 },
                 "interactiveSudo": {
                     "type": "boolean"
+                },
+                "sudoFile": {
+                    "type": "path"
+                },
+                "sudoSecret": {
+                    "type": "string"
                 }
             }
         },
diff --git a/src/cli.rs b/src/cli.rs
@@ -5,6 +5,7 @@
 
 use std::collections::HashMap;
 use std::io::{stdin, stdout, Write};
+use std::str::Utf8Error;
 
 use clap::{ArgMatches, Parser, FromArgMatches};
 
@@ -17,6 +18,7 @@ use serde::Serialize;
 use std::path::PathBuf;
 use std::process::Stdio;
 use thiserror::Error;
+use tokio::fs::try_exists;
 use tokio::process::Command;
 
 /// Simple Rust rewrite of a simple Nix Flake deployment tool
@@ -404,7 +406,9 @@ pub enum RunDeployError {
     #[error("Failed to revoke profile for node {0}: {1}")]
     RevokeProfile(String, deploy::deploy::RevokeProfileError),
     #[error("Deployment to node {0} failed, rolled back to previous generation")]
-    Rollback(String)
+    Rollback(String),
+    #[error("Failed to get the password from sops: {0}")]
+    Sops(#[from] deploy::cli::SopsError),
 }
 
 type ToDeploy<'a> = Vec<(
@@ -548,21 +552,103 @@ async fn run_deploy(
 
         let mut deploy_defs = deploy_data.defs()?;
 
-        if deploy_data.merged_settings.interactive_sudo.unwrap_or(false) {
+        if deploy_data.merged_settings.sudo.is_some()
+            && (deploy_data.merged_settings.interactive_sudo.is_some()
+                || deploy_data.merged_settings.sudo_secret.is_some())
+        {
+            warn!("Custom sudo commands should be configured to accept password input from stdin when using the 'interactive sudo' or 'password File' option. Deployment may fail if the custom command ignores stdin.");
+        } else {
+            // this configures sudo to hide the password prompt and accept input from stdin
+            // at the time of writing, deploy_defs.sudo defaults to 'sudo -u root' when using user=root and sshUser as non-root
+            let original = deploy_defs.sudo.unwrap_or("sudo".to_string());
+            deploy_defs.sudo = Some(format!("{} -S -p \"\"", original));
+        }
+
+        if deploy_data
+            .merged_settings
+            .interactive_sudo
+            .unwrap_or(false)
+        {
             warn!("Interactive sudo is enabled! Using a sudo password is less secure than correctly configured SSH keys.\nPlease use keys in production environments.");
 
-            if deploy_data.merged_settings.sudo.is_some() {
-                warn!("Custom sudo commands should be configured to accept password input from stdin when using the 'interactive sudo' option. Deployment may fail if the custom command ignores stdin.");
-            } else {
-                // this configures sudo to hide the password prompt and accept input from stdin
-                // at the time of writing, deploy_defs.sudo defaults to 'sudo -u root' when using user=root and sshUser as non-root
-                let original = deploy_defs.sudo.unwrap_or("sudo".to_string());
-                deploy_defs.sudo = Some(format!("{} -S -p \"\"", original));
-            }
+            info!(
+                "You will now be prompted for the sudo password for {}.",
+                node.node_settings.hostname
+            );
+
+            let sudo_password = rpassword::prompt_password(format!(
+                "(sudo for {}) Password: ",
+                node.node_settings.hostname
+            ))
+            .unwrap_or("".to_string());
 
-            info!("You will now be prompted for the sudo password for {}.", node.node_settings.hostname);
-            let sudo_password = rpassword::prompt_password(format!("(sudo for {}) Password: ", node.node_settings.hostname)).unwrap_or("".to_string());
+            deploy_defs.sudo_password = Some(sudo_password);
+        } else if deploy_data.merged_settings.sudo_file.is_some()
+            && deploy_data.merged_settings.sudo_secret.is_some()
+        {
+            // SAFETY: we already checked if it is some
+            let path = deploy_data.merged_settings.sudo_file.clone().unwrap();
+            let key = deploy_data.merged_settings.sudo_secret.clone().unwrap();
+
+            if !try_exists(&path).await.unwrap() {
+                return Err(RunDeployError::Sops(SopsError::SopsFileNotFound(format!(
+                    "{path:?} not found"
+                ))));
+            }
 
+            // We deserialze to json
+            let out = Command::new("sops")
+                .arg("--output-type")
+                .arg("json")
+                .arg("-d")
+                .arg(&path)
+                .output()
+                .await
+                .map_err(|err| {
+                    RunDeployError::Sops(SopsError::SopsFailedDecryption(
+                        path.to_string_lossy().into(),
+                        err,
+                    ))
+                })?;
+
+            let conv_out = std::str::from_utf8(&out.stdout)
+                .map_err(|err| RunDeployError::Sops(SopsError::SopsCannotConvert(err)))?;
+
+            let mut m: serde_json::Map<String, serde_json::Value> = serde_json::from_str(conv_out)
+                .map_err(|err| RunDeployError::Sops(SopsError::SerdeDeserialize(err)))?;
+
+            let mut sudo_password = String::new();
+
+            // We support nested keys like a/b/c
+            for i in key.split('/') {
+                match m.get(i) {
+                    Some(v) => match v {
+                        serde_json::Value::String(s) => {
+                            sudo_password = s.into();
+                        }
+                        serde_json::Value::Bool(b) => {
+                            sudo_password = b.to_string();
+                        }
+                        serde_json::Value::Number(n) => {
+                            sudo_password = n.to_string();
+                        }
+                        serde_json::Value::Object(map) => {
+                            m = map.clone();
+                        }
+                        _ => {
+                            return Err(RunDeployError::Sops(SopsError::SerdeUnexpectedType(
+                                "We dont handle Arrays, Bools, None, Numbers".into(),
+                            )));
+                        }
+                    },
+                    None => {
+                        return Err(RunDeployError::Sops(SopsError::SopsKeyNotFound(format!(
+                            "Did not find {} in Map",
+                            i
+                        ))));
+                    }
+                }
+            }
             deploy_defs.sudo_password = Some(sudo_password);
         }
 
@@ -639,6 +725,22 @@ async fn run_deploy(
     Ok(())
 }
 
+#[derive(Error, Debug)]
+pub enum SopsError {
+    #[error("Failed to decrypt file {0}: {1}")]
+    SopsFailedDecryption(String, std::io::Error),
+    #[error("Failed to find sops file: {0}")]
+    SopsFileNotFound(String),
+    #[error("Failed to convert the output of sops to a str: {0}")]
+    SopsCannotConvert(Utf8Error),
+    #[error("Failed to deserialize: {0}")]
+    SerdeDeserialize(serde_json::Error),
+    #[error("Error unexpected type: {0}")]
+    SerdeUnexpectedType(String),
+    #[error("Failed to find key: {0}")]
+    SopsKeyNotFound(String),
+}
+
 #[derive(Error, Debug)]
 pub enum RunError {
     #[error("Failed to deploy profile: {0}")]
diff --git a/src/data.rs b/src/data.rs
@@ -37,6 +37,11 @@ pub struct GenericSettings {
     pub remote_build: Option<bool>,
     #[serde(rename(deserialize = "interactiveSudo"))]
     pub interactive_sudo: Option<bool>,
+    // sops integration for secrets
+    #[serde(rename(deserialize = "sudoFile"))]
+    pub sudo_file: Option<PathBuf>,
+    #[serde(rename(deserialize = "sudoSecret"))]
+    pub sudo_secret: Option<String>,
 }
 
 #[derive(Deserialize, Debug, Clone)]
diff --git a/src/deploy.rs b/src/deploy.rs
@@ -301,7 +301,12 @@ pub async fn confirm_profile(
         .spawn()
         .map_err(ConfirmProfileError::SSHConfirm)?;
     
-    if deploy_data.merged_settings.interactive_sudo.unwrap_or(false) {
+    if deploy_data
+        .merged_settings
+        .interactive_sudo
+        .unwrap_or(false)
+        || deploy_data.merged_settings.sudo_secret.is_some()
+    {
         trace!("[confirm] Piping in sudo password");
         handle_sudo_stdin(&mut ssh_confirm_child, deploy_defs)
             .await
@@ -413,7 +418,12 @@ pub async fn deploy_profile(
             .spawn()
             .map_err(DeployProfileError::SSHSpawnActivate)?;
 
-        if deploy_data.merged_settings.interactive_sudo.unwrap_or(false) {
+        if deploy_data
+            .merged_settings
+            .interactive_sudo
+            .unwrap_or(false)
+            || deploy_data.merged_settings.sudo_secret.is_some()
+        {
             trace!("[activate] Piping in sudo password");
             handle_sudo_stdin(&mut ssh_activate_child, deploy_defs)
                 .await
@@ -454,7 +464,12 @@ pub async fn deploy_profile(
             .spawn()
             .map_err(DeployProfileError::SSHSpawnActivate)?;
 
-        if deploy_data.merged_settings.interactive_sudo.unwrap_or(false) {
+        if deploy_data
+            .merged_settings
+            .interactive_sudo
+            .unwrap_or(false)
+            || deploy_data.merged_settings.sudo_secret.is_some()
+        {
             trace!("[activate] Piping in sudo password");
             handle_sudo_stdin(&mut ssh_activate_child, deploy_defs)
                 .await
@@ -498,7 +513,12 @@ pub async fn deploy_profile(
             .spawn()
             .map_err(DeployProfileError::SSHWait)?;
 
-        if deploy_data.merged_settings.interactive_sudo.unwrap_or(false) {
+        if deploy_data
+            .merged_settings
+            .interactive_sudo
+            .unwrap_or(false)
+            || deploy_data.merged_settings.sudo_secret.is_some()
+        {
             trace!("[wait] Piping in sudo password");
             handle_sudo_stdin(&mut ssh_wait_child, deploy_defs)
                 .await
@@ -581,7 +601,12 @@ pub async fn revoke(
         .spawn()
         .map_err(RevokeProfileError::SSHSpawnRevoke)?;
 
-    if deploy_data.merged_settings.interactive_sudo.unwrap_or(false) {
+    if deploy_data
+        .merged_settings
+        .interactive_sudo
+        .unwrap_or(false)
+        || deploy_data.merged_settings.sudo_secret.is_some()
+    {
         trace!("[revoke] Piping in sudo password");
         handle_sudo_stdin(&mut ssh_revoke_child, deploy_defs)
             .await

Original file line number	Diff line number	Diff line change
`@@ -38,6 +38,12 @@`
`38`	`38`	`},`
`39`	`39`	`"interactiveSudo": {`
`40`	`40`	`"type": "boolean"`
	`41`	`+ },`
	`42`	`+ "sudoFile": {`
	`43`	`+ "type": "path"`
	`44`	`+ },`
	`45`	`+ "sudoSecret": {`
	`46`	`+ "type": "string"`
`41`	`47`	`}`
`42`	`48`	`}`
`43`	`49`	`},`