ephemeral state is automatically provisioned #314

New issue

Open

opened 2025-04-19 13:03:25 +02:00 by kiara · 1 comment

kiara commented

2025-04-19 13:03:25 +02:00

Owner

our current setup has left many things hard-coded, whereas in practice there is quite some ephemeral state that should likely be generated, whether sensitive or not.

this includes at least:

automating generate-vars
implement vars openbao back-end (c.f. #493)
needed to facilitate contributions (#288)
- name servers - make configurable (offering a default)?
- users (developers, shared account) - see clan modules root-password / user-password
needed for security (#291)
- SSL credentials (see selfhostblocks' SSL contract or openbao's PKI secrets engine (#87)
- garage credentials
- machine SSH keys ((test-)machines/) - see clan module sshd or openbao's PKI secrets engine)
- service credentials (current age secrets)
needed to streamline dev-ops (#224)
- NixOS system.stateVersion - see clan module state-version
~~#116: needed to automatically test proxmox~~
prevent clashes between applications
- ports: alloc?

state scenarios:

destination	sensitive	storage	distribution
orchestration	*	openbao	nimbolus
build	no	(depends on source)	build
system	no	on-machine	vars
system	yes	on-machine (vars) -> openbao	vars -> openbao?
service	no	on-machine	(nix-templating +) vars
service	yes	on-machine (vars) -> openbao	(nix-templating +) vars -> systemd-openbao

destination	unsensitive	sensitive
orchestration	TF state	TF state
build		n/a
system	vars	openbao?
service (nix-templating +)	vars	systemd-openbao

info	sensitive	destination	source	goal
MAC address	no	build	provisioning	#116 provisioning
IP address	no	build	provisioning	#116 provisioning
architecture	no	build	provisioning	#116 provisioning
gateway	no	build	provisioning	#116 provisioning
hardware	no?	build	`nixos-facter`	#116 provisioning
authorized SSH keys	no	system	config: host	#116 provisioning
TLS/SSL certificates	yes	service	bao PKI	#116 provisioning
SSH keys	yes	system	bao PKI / vars `sshd`	#291 security
service credentials	yes	service	vars?	#291 security
`system.stateVersion`	no	build	vars `state-version`	#224 devops
name servers	no	build	config: operator	#288 contributions
user credentials	yes	build?	vars `{root,user}-password`	#288 contributions

our current setup has left many things hard-coded, whereas in practice there is quite some ephemeral state that should likely be generated, whether sensitive or not. this includes at least: - [x] [automating `generate-vars`](https://github.com/Lassulus/vars/issues/5) - [ ] implement vars openbao back-end (c.f. #493) - [ ] needed to facilitate contributions (#288) - [ ] name servers - make configurable (offering a default)? - [ ] users (developers, shared account) - see clan modules `root-password` / `user-password` - [ ] needed for security (#291) - [ ] SSL credentials (see selfhostblocks' [SSL contract](https://shb.skarabox.com/contracts-ssl.html) or openbao's [PKI secrets engine](https://openbao.org/docs/secrets/pki/) (#87) - [ ] garage credentials - [ ] machine SSH keys ((`test-`)`machines/`) - see clan module `sshd` or openbao's [PKI secrets engine](https://openbao.org/docs/secrets/pki/)) - [ ] service credentials (current `age` secrets) - [ ] needed to streamline dev-ops (#224) - [ ] NixOS `system.stateVersion` - see clan module `state-version` - ~~#116: needed to automatically test proxmox~~ - [ ] prevent clashes between applications - [ ] ports: [alloc](https://discourse.nixos.org/t/alloc-nix-a-tool-to-help-you-allocate-ranges-to-services/72603)? state scenarios: | destination | sensitive | storage | distribution | |---|---|---|---| | orchestration | * | openbao | nimbolus | | build | no | (depends on source) | build | | system | no | on-machine | vars | | system | yes | on-machine (vars) -> openbao | vars -> openbao? | | service | no | on-machine | (nix-templating +) vars | | service | yes | on-machine (vars) -> openbao | (nix-templating +) vars -> systemd-openbao | | destination | unsensitive | sensitive | |-|-|-| | orchestration | TF state | TF state | | build | | n/a | | system | vars | openbao? | | service (nix-templating +) | vars | systemd-openbao | | info | sensitive | destination | source | goal | |-|-|-|-|-| | MAC address | no | build | provisioning | #116 provisioning | | IP address | no | build | provisioning | #116 provisioning | | architecture | no | build | provisioning | #116 provisioning | | gateway | no | build | provisioning | #116 provisioning | | hardware | no? | build | `nixos-facter` | #116 provisioning | | authorized SSH keys | no | system | config: host | #116 provisioning | | TLS/SSL certificates | yes | service | bao PKI | #116 provisioning | | SSH keys | yes | system | bao PKI / vars `sshd` | #291 security | | service credentials | yes | service | vars? | #291 security | | `system.stateVersion` | no | build | vars `state-version` | #224 devops | | name servers | no | build | config: operator | #288 contributions | | user credentials | yes | build? | vars `{root,user}-password` | #288 contributions |

kiara commented

2025-04-19 13:08:45 +02:00

Author

Owner

clan's vars (+ templating) may help generate these, and supports different back-ends (could be used with openbao / even TF state?).

clan further implemented modules using this like:

general
- state-version
- machine-id
- disk-id
- root-password
- user-password
service-specific
- sshd
- garage

edit: (untested) ~~attempt~~ PR to decouple those modules from clan using vars

mrVanDalo/clan-vars-generators contains:

matrix-synapse
nix-serve
openssh
syncthing
tinc
tor
wireguard
xkcdpass
zfs

clan's [vars](https://clan.lol/blog/vars/) (+ [templating](https://github.com/Lassulus/nix-templating)) may help generate these, and supports different [back-ends](https://docs.clan.lol/manual/vars-backend/) (could be used with openbao / even TF state?). clan further implemented [modules](https://docs.clan.lol/reference/clanModules/) using this like: - general - `state-version` - `machine-id` - `disk-id` - `root-password` - `user-password` - service-specific - `sshd` - `garage` edit: (untested) ~~[attempt](https://git.clan.lol/clan/clan-core/compare/main...kiara/clan-core:decouple-ephemeral)~~ [PR](https://github.com/Lassulus/vars/pull/12) to decouple those modules from clan using [vars](https://github.com/Lassulus/vars) `mrVanDalo/clan-vars-generators` [contains](https://github.com/mrVanDalo/clan-vars-generators/tree/main/lib/generators): - `matrix-synapse` - `nix-serve` - `openssh` - `syncthing` - `tinc` - `tor` - `wireguard` - `xkcdpass` - `zfs`

👍 1