add toplevel machines-json that can deploy all hosts

pkgs/clan-cli/clan_cli/secrets/generate.py

@@ -2,6 +2,7 @@ import argparse
 import os
 import shlex
 import subprocess
+from pathlib import Path
 
 from clan_cli.errors import ClanError
 
@@ -9,11 +10,7 @@ from ..dirs import get_clan_flake_toplevel, module_root
 from ..nix import nix_build, nix_config
 
 
-def generate_secrets(machine: str) -> None:
-    clan_dir = get_clan_flake_toplevel().as_posix().strip()
-    env = os.environ.copy()
-    env["CLAN_DIR"] = clan_dir
-    env["PYTHONPATH"] = str(module_root().parent)  # TODO do this in the clanCore module
+def build_generate_script(machine: str, clan_dir: Path) -> str:
     config = nix_config()
     system = config["system"]
 
@@ -28,21 +25,32 @@ def generate_secrets(machine: str) -> None:
             f"failed to generate secrets:\n{shlex.join(cmd)}\nexited with {proc.returncode}"
         )
 
-    secret_generator_script = proc.stdout.strip()
-    print(secret_generator_script)
-    secret_generator = subprocess.run(
+    return proc.stdout.strip()
+
+
+def run_generate_secrets(secret_generator_script: str, clan_dir: Path) -> None:
+    env = os.environ.copy()
+    env["CLAN_DIR"] = str(clan_dir)
+    env["PYTHONPATH"] = str(module_root().parent)  # TODO do this in the clanCore module
+    print(f"generating secrets... {secret_generator_script}")
+    proc = subprocess.run(
         [secret_generator_script],
         env=env,
     )
 
-    if secret_generator.returncode != 0:
+    if proc.returncode != 0:
         raise ClanError("failed to generate secrets")
     else:
         print("successfully generated secrets")
 
 
+def generate(machine: str) -> None:
+    clan_dir = get_clan_flake_toplevel()
+    run_generate_secrets(build_generate_script(machine, clan_dir), clan_dir)
+
+
 def generate_command(args: argparse.Namespace) -> None:
-    generate_secrets(args.machine)
+    generate(args.machine)
 
 
 def register_generate_parser(parser: argparse.ArgumentParser) -> None:

pkgs/clan-cli/clan_cli/secrets/sops_generate.py

@@ -44,8 +44,8 @@ def generate_secrets_group(
 
         text = f"""\
 set -euo pipefail
-facts={shlex.quote(str(facts_dir))}
-secrets={shlex.quote(str(secrets_dir))}
+export facts={shlex.quote(str(facts_dir))}
+export secrets={shlex.quote(str(secrets_dir))}
 {generator}
         """
         try:

pkgs/clan-cli/clan_cli/secrets/upload.py

@@ -1,57 +1,51 @@
 import argparse
-import json
 import os
+import shlex
 import subprocess
+from pathlib import Path
 
 from ..dirs import get_clan_flake_toplevel, module_root
 from ..errors import ClanError
-from ..nix import nix_build, nix_config, nix_eval
+from ..nix import nix_build, nix_config
 
 
-def upload_secrets(machine: str) -> None:
-    clan_dir = get_clan_flake_toplevel().as_posix()
+def build_upload_script(machine: str, clan_dir: Path) -> str:
     config = nix_config()
     system = config["system"]
 
-    proc = subprocess.run(
-        nix_build(
-            [f'{clan_dir}#clanInternals.machines."{system}"."{machine}".uploadSecrets']
-        ),
-        stdout=subprocess.PIPE,
-        text=True,
-        check=True,
+    cmd = nix_build(
+        [f'{clan_dir}#clanInternals.machines."{system}"."{machine}".uploadSecrets']
     )
+    proc = subprocess.run(cmd, stdout=subprocess.PIPE, text=True)
+    if proc.returncode != 0:
+        raise ClanError(
+            f"failed to upload secrets:\n{shlex.join(cmd)}\nexited with {proc.returncode}"
+        )
 
+    return proc.stdout.strip()
+
+
+def run_upload_secrets(flake_attr: str, clan_dir: Path) -> None:
     env = os.environ.copy()
+    env["CLAN_DIR"] = str(clan_dir)
     env["PYTHONPATH"] = str(module_root().parent)  # TODO do this in the clanCore module
-    host = json.loads(
-        subprocess.run(
-            nix_eval(
-                [
-                    f'{clan_dir}#clanInternals.machines."{system}"."{machine}".deploymentAddress'
-                ]
-            ),
-            stdout=subprocess.PIPE,
-            text=True,
-            check=True,
-        ).stdout
-    )
-
-    secret_upload_script = proc.stdout.strip()
-    secret_upload = subprocess.run(
-        [
-            secret_upload_script,
-            host,
-        ],
+    print(f"uploading secrets... {flake_attr}")
+    proc = subprocess.run(
+        [flake_attr],
         env=env,
     )
 
-    if secret_upload.returncode != 0:
+    if proc.returncode != 0:
         raise ClanError("failed to upload secrets")
     else:
         print("successfully uploaded secrets")
 
 
+def upload_secrets(machine: str) -> None:
+    clan_dir = get_clan_flake_toplevel()
+    run_upload_secrets(build_upload_script(machine, clan_dir), clan_dir)
+
+
 def upload_command(args: argparse.Namespace) -> None:
     upload_secrets(args.machine)