Merge branch 'main' into update-templates-services-2

.gitea/workflows/update-flake-inputs.yml

@@ -1,27 +0,0 @@
-name: Update Flake Inputs
-
-on:
-  schedule:
-    # Run weekly on Sunday at 4:00 AM UTC
-    - cron: "0 4 * * 0"
-  workflow_dispatch:
-  repository_dispatch:
-
-jobs:
-  update-flake-inputs:
-    runs-on: nix
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Configure git
-        run: |
-          git config --global user.email "clan-bot@clan.lol"
-          git config --global user.name "clan-bot"
-
-      - name: Update flake inputs
-        uses: Mic92/update-flake-inputs-gitea@main
-        env:
-          # Exclude private flakes and update-clan-core checks flake
-          EXCLUDE_PATTERNS: "devFlake/private/flake.nix,checks/impure/flake.nix"

devFlake/private/flake.lock

@@ -66,11 +66,11 @@
     },
     "nixpkgs-dev": {
       "locked": {
-        "lastModified": 1752467518,
+        "lastModified": 1752039390,
-        "narHash": "sha256-7SSvjNlM5ZsFZMP7Nw2uUa7EKYhB6Ny9iNtxtPPhWYY=",
+        "narHash": "sha256-DTHMN6kh1cGoc5hc9O0pYN+VAOnjsyy0wxq4YO5ZRvg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2f21cef1d1dc734a2dd89f535427cf291aebc8ef",
+        "rev": "6ec4d5f023c3c000cda569255a3486e8710c39bf",
         "type": "github"
       },
       "original": {

nixosModules/clanCore/vars/interface.nix

@@ -22,7 +22,6 @@ let
     package
     path
     str
-    strMatching
     submoduleWith
     ;
   # the original types.submodule has strange behavior
@@ -48,7 +47,7 @@ in
           imports = [ ./generator.nix ];
           options = {
             name = lib.mkOption {
-              type = str;
+              type = lib.types.str;
               description = ''
                 The name of the generator.
                 This name will be used to refer to the generator in other generators.
@@ -154,7 +153,7 @@ in
                   options =
                     {
                       name = lib.mkOption {
-                        type = str;
+                        type = lib.types.str;
                         description = ''
                           name of the public fact
                         '';
@@ -163,7 +162,7 @@ in
                         defaultText = "Name of the file";
                       };
                       generatorName = lib.mkOption {
-                        type = str;
+                        type = lib.types.str;
                         description = ''
                           name of the generator
                         '';
@@ -172,7 +171,7 @@ in
                         defaultText = "Name of the generator that generates this file";
                       };
                       share = lib.mkOption {
-                        type = bool;
+                        type = lib.types.bool;
                         description = ''
                           Whether the generated vars should be shared between machines.
                           Shared vars are only generated once, when the first machine using it is deployed.
@@ -234,7 +233,7 @@ in
                           By setting this to `user`, the secret will be deployed prior to users and groups are created, allowing
                           users' passwords to be managed by vars. The secret will be stored in `/run/secrets-for-users` and `owner` and `group` must be `root`.
                         '';
-                        type = enum [
+                        type = lib.types.enum [
                           "partitioning"
                           "activation"
                           "users"
@@ -252,7 +251,7 @@ in
                         defaultText = lib.literalExpression ''if _class == "darwin" then "wheel" else "root"'';
                       };
                       mode = lib.mkOption {
-                        type = strMatching "^[0-7]{4}$";
+                        type = lib.types.strMatching "^[0-7]{4}$";
                         description = "The unix file mode of the file. Must be a 4-digit octal number.";
                         default = "0400";
                       };
@@ -376,7 +375,7 @@ in
                   - all required programs are in PATH
                   - sandbox is set up correctly
               '';
-              type = path;
+              type = lib.types.path;
               readOnly = true;
               internal = true;
             };

pkgs/clan-cli/clan_cli/cli.py

@@ -250,12 +250,12 @@ This subcommand allows seamless ssh access to the nixos-image builders or a mach
 
 Examples:
 
-  $ clan ssh berlin
+  $ clan ssh [ssh_args ...] berlin`
 
   Will ssh in to the machine called `berlin`, using the
   `clan.core.networking.targetHost` specified in its configuration
 
-  $ clan ssh --json [JSON] --host-key-check none
+  $ clan ssh [ssh_args ...] --json [JSON]
   Will ssh in to the machine based on the deployment information contained in
   the json string. [JSON] can either be a json formatted string itself, or point
   towards a file containing the deployment information

pkgs/clan-cli/clan_cli/machines/install.py

@@ -24,14 +24,12 @@ def install_command(args: argparse.Namespace) -> None:
         # Only if the caller did not specify a target_host via args.target_host
         # Find a suitable target_host that is reachable
         target_host_str = args.target_host
-        deploy_info: DeployInfo | None = (
+        deploy_info: DeployInfo | None = ssh_command_parse(args)
-            ssh_command_parse(args) if target_host_str is None else None
-        )
 
         use_tor = False
-        if deploy_info:
+        if deploy_info and not args.target_host:
             host = find_reachable_host(deploy_info)
-            if host is None or host.tor_socks:
+            if host is None:
                 use_tor = True
                 target_host_str = deploy_info.tor.target
             else:

pkgs/clan-cli/clan_cli/ssh/deploy_info.py

@@ -1,14 +1,12 @@
 import argparse
 import json
 import logging
-import textwrap
 from dataclasses import dataclass
 from pathlib import Path
 from typing import Any
 
 from clan_lib.cmd import run
 from clan_lib.errors import ClanError
-from clan_lib.machines.machines import Machine
 from clan_lib.nix import nix_shell
 from clan_lib.ssh.remote import HostKeyCheck, Remote
 
@@ -39,23 +37,20 @@ class DeployInfo:
             raise ClanError(msg)
         return addrs[0]
 
-    def overwrite_remotes(
+    @staticmethod
-        self,
+    def from_hostnames(
-        host_key_check: HostKeyCheck | None = None,
+        hostname: list[str], host_key_check: HostKeyCheck
-        private_key: Path | None = None,
-        ssh_options: dict[str, str] | None = None,
     ) -> "DeployInfo":
-        """Return a new DeployInfo with all Remotes overridden with the given host_key_check."""
+        remotes = []
-        return DeployInfo(
+        for host in hostname:
-            addrs=[
+            if not host:
-                addr.override(
+                msg = "Hostname cannot be empty."
-                    host_key_check=host_key_check,
+                raise ClanError(msg)
-                    private_key=private_key,
+            remote = Remote.from_ssh_uri(
-                    ssh_options=ssh_options,
+                machine_name="clan-installer", address=host
-                )
+            ).override(host_key_check=host_key_check)
-                for addr in self.addrs
+            remotes.append(remote)
-            ]
+        return DeployInfo(addrs=remotes)
-        )
 
     @staticmethod
     def from_json(data: dict[str, Any], host_key_check: HostKeyCheck) -> "DeployInfo":
@@ -108,22 +103,9 @@ def find_reachable_host(deploy_info: DeployInfo) -> Remote | None:
     return None
 
 
-def ssh_shell_from_deploy(
+def ssh_shell_from_deploy(deploy_info: DeployInfo) -> None:
-    deploy_info: DeployInfo, command: list[str] | None = None
-) -> None:
-    if command and len(command) == 1 and command[0].count(" ") > 0:
-        msg = (
-            textwrap.dedent("""
-            It looks like you quoted the remote command.
-            The first argument should be the command to run, not a quoted string.
-        """)
-            .lstrip("\n")
-            .rstrip("\n")
-        )
-        raise ClanError(msg)
-
     if host := find_reachable_host(deploy_info):
-        host.interactive_ssh(command)
+        host.interactive_ssh()
         return
 
     log.info("Could not reach host via clearnet 'addrs'")
@@ -145,7 +127,7 @@ def ssh_shell_from_deploy(
                 log.info(
                     "Host reachable via tor address, starting interactive ssh session."
                 )
-                tor_addr.interactive_ssh(command)
+                tor_addr.interactive_ssh()
                 return
 
         log.error("Could not reach host via tor address.")
@@ -153,35 +135,19 @@ def ssh_shell_from_deploy(
 
 def ssh_command_parse(args: argparse.Namespace) -> DeployInfo | None:
     host_key_check = args.host_key_check
-    deploy = None
-
     if args.json:
         json_file = Path(args.json)
         if json_file.is_file():
             data = json.loads(json_file.read_text())
             return DeployInfo.from_json(data, host_key_check)
         data = json.loads(args.json)
-        deploy = DeployInfo.from_json(data, host_key_check)
+        return DeployInfo.from_json(data, host_key_check)
-    elif args.png:
+    if args.png:
-        deploy = DeployInfo.from_qr_code(Path(args.png), host_key_check)
+        return DeployInfo.from_qr_code(Path(args.png), host_key_check)
-    elif hasattr(args, "machine") and args.machine:
-        machine = Machine(args.machine, args.flake)
-        target = machine.target_host().override(
-            command_prefix=machine.name, host_key_check=host_key_check
-        )
-        deploy = DeployInfo(addrs=[target])
-    else:
-        return None
 
-    ssh_options = None
+    if hasattr(args, "machines"):
-    if hasattr(args, "ssh_option") and args.ssh_option:
+        return DeployInfo.from_hostnames(args.machines, host_key_check)
-        for name, value in args.ssh_option:
+    return None
-            ssh_options = {}
-            ssh_options[name] = value
-
-    deploy = deploy.overwrite_remotes(ssh_options=ssh_options)
-
-    return deploy
 
 
 def ssh_command(args: argparse.Namespace) -> None:
@@ -189,63 +155,36 @@ def ssh_command(args: argparse.Namespace) -> None:
     if not deploy_info:
         msg = "No MACHINE, --json or --png data provided"
         raise ClanError(msg)
-    ssh_shell_from_deploy(deploy_info, args.remote_command)
+
+    ssh_shell_from_deploy(deploy_info)
 
 
 def register_parser(parser: argparse.ArgumentParser) -> None:
-    group = parser.add_mutually_exclusive_group()
+    group = parser.add_mutually_exclusive_group(required=True)
-    group.add_argument(
+    machines_parser = group.add_argument(
-        "machine",
+        "machines",
         type=str,
-        nargs="?",
+        nargs="*",
+        default=[],
         metavar="MACHINE",
-        help="Machine to ssh into (uses clan.core.networking.targetHost from configuration).",
+        help="Machine to ssh into.",
     )
+    add_dynamic_completer(machines_parser, complete_machines)
 
     group.add_argument(
         "-j",
         "--json",
-        type=str,
+        help="specify the json file for ssh data (generated by starting the clan installer)",
-        help=(
-            "Deployment information as a JSON string or path to a JSON file "
-            "(generated by starting the clan installer)."
-        ),
     )
     group.add_argument(
         "-P",
         "--png",
-        type=str,
+        help="specify the json file for ssh data as the qrcode image (generated by starting the clan installer)",
-        help="Deployment information as a QR code image file (generated by starting the clan installer).",
     )
-
     parser.add_argument(
         "--host-key-check",
         choices=["strict", "ask", "tofu", "none"],
         default="tofu",
         help="Host key (.ssh/known_hosts) check mode.",
     )
-
-    parser.add_argument(
-        "--ssh-option",
-        help="SSH option to set (can be specified multiple times)",
-        nargs=2,
-        metavar=("name", "value"),
-        action="append",
-        default=[],
-    )
-
-    parser.add_argument(
-        "-c",
-        "--remote-command",
-        type=str,
-        metavar="COMMAND",
-        nargs=argparse.REMAINDER,
-        help="Command to execute on the remote host, needs to be the LAST argument as it takes all remaining arguments.",
-    )
-
-    add_dynamic_completer(
-        parser._actions[1],  # noqa: SLF001
-        complete_machines,
-    )  # assumes 'machine' is the first positional
-
     parser.set_defaults(func=ssh_command)

pkgs/clan-cli/clan_cli/ssh/test_deploy_info.py

@@ -7,8 +7,6 @@ from clan_lib.nix import nix_shell
 from clan_lib.ssh.remote import Remote
 
 from clan_cli.ssh.deploy_info import DeployInfo, find_reachable_host
-from clan_cli.tests.fixtures_flakes import ClanFlake
-from clan_cli.tests.helpers import cli
 
 
 def test_qrcode_scan(temp_dir: Path) -> None:
@@ -71,10 +69,7 @@ def test_from_json() -> None:
 @pytest.mark.with_core
 def test_find_reachable_host(hosts: list[Remote]) -> None:
     host = hosts[0]
-
+    deploy_info = DeployInfo.from_hostnames(["172.19.1.2", host.ssh_url()], "none")
-    uris = ["172.19.1.2", host.ssh_url()]
-    remotes = [Remote.from_ssh_uri(machine_name="some", address=uri) for uri in uris]
-    deploy_info = DeployInfo(addrs=remotes)
 
     assert deploy_info.addrs[0].address == "172.19.1.2"
 
@@ -82,40 +77,3 @@ def test_find_reachable_host(hosts: list[Remote]) -> None:
 
     assert remote is not None
     assert remote.ssh_url() == host.ssh_url()
-
-
-@pytest.mark.with_core
-def test_ssh_shell_from_deploy(
-    hosts: list[Remote],
-    flake: ClanFlake,
-) -> None:
-    host = hosts[0]
-
-    machine1_config = flake.machines["m1_machine"]
-    machine1_config["nixpkgs"]["hostPlatform"] = "x86_64-linux"
-    machine1_config["clan"]["networking"]["targetHost"] = host.ssh_url()
-    flake.refresh()
-
-    assert host.private_key
-
-    success_txt = flake.path / "success.txt"
-    assert not success_txt.exists()
-    cli.run(
-        [
-            "ssh",
-            "--flake",
-            str(flake.path),
-            "m1_machine",
-            "--host-key-check=none",
-            "--ssh-option",
-            "IdentityFile",
-            str(host.private_key),
-            "--remote-command",
-            "touch",
-            str(success_txt),
-            "&&",
-            "exit 0",
-        ]
-    )
-
-    assert success_txt.exists()

pkgs/clan-cli/clan_lib/ssh/remote.py

@@ -16,7 +16,7 @@ from tempfile import TemporaryDirectory
 from clan_lib.api import API
 from clan_lib.cmd import ClanCmdError, ClanCmdTimeoutError, CmdOut, RunOpts, run
 from clan_lib.colors import AnsiColor
-from clan_lib.errors import ClanError, indent_command  # Assuming these are available
+from clan_lib.errors import ClanError  # Assuming these are available
 from clan_lib.nix import nix_shell
 from clan_lib.ssh.host_key import HostKeyCheck, hostkey_to_ssh_opts
 from clan_lib.ssh.parse import parse_ssh_uri
@@ -61,9 +61,6 @@ class Remote:
         private_key: Path | None = None,
         password: str | None = None,
         tor_socks: bool | None = None,
-        command_prefix: str | None = None,
-        port: int | None = None,
-        ssh_options: dict[str, str] | None = None,
     ) -> "Remote":
         """
         Returns a new Remote instance with the same data but with a different host_key_check.
@@ -71,8 +68,8 @@ class Remote:
         return Remote(
             address=self.address,
             user=self.user,
-            command_prefix=command_prefix or self.command_prefix,
+            command_prefix=self.command_prefix,
-            port=port or self.port,
+            port=self.port,
             private_key=private_key if private_key is not None else self.private_key,
             password=password if password is not None else self.password,
             forward_agent=self.forward_agent,
@@ -80,7 +77,7 @@ class Remote:
                 host_key_check if host_key_check is not None else self.host_key_check
             ),
             verbose_ssh=self.verbose_ssh,
-            ssh_options=ssh_options or self.ssh_options,
+            ssh_options=self.ssh_options,
             tor_socks=tor_socks if tor_socks is not None else self.tor_socks,
             _control_path_dir=self._control_path_dir,
             _askpass_path=self._askpass_path,
@@ -421,31 +418,11 @@ class Remote:
                 msg = f"SSH command failed with return code {res.returncode}"
                 raise ClanError(msg)
 
-    def interactive_ssh(self, command: list[str] | None = None) -> None:
+    def interactive_ssh(self) -> None:
-        ssh_cmd = self.ssh_cmd(tty=True, control_master=False)
+        cmd_list = self.ssh_cmd(tty=True, control_master=False)
-        if command:
+        res = subprocess.run(cmd_list, check=False)
-            ssh_cmd = [
-                *self.ssh_cmd(tty=True, control_master=False),
-                "--",
-                "bash",
-                "-c",
-                quote('exec "$@"'),
-                "--",
-                " ".join(map(quote, command)),
-            ]
-        cmdlog.info(
-            f"{indent_command(ssh_cmd)}",
-            extra={
-                "command_prefix": self.command_prefix,
-                "color": AnsiColor.GREEN.value,
-            },
-        )
-        res = subprocess.run(ssh_cmd, check=False)
 
-        # We only check the error code if a password is set, as sshpass is used.
+        self.check_sshpass_errorcode(res)
-        # AS sshpass swallows all output.
-        if self.password:
-            self.check_sshpass_errorcode(res)
 
     def check_machine_ssh_reachable(self) -> bool:
         return check_machine_ssh_reachable(self).ok
@@ -454,7 +431,7 @@ class Remote:
 @dataclass(frozen=True)
 class ConnectionOptions:
     timeout: int = 2
-    retries: int = 5
+    retries: int = 10
 
 
 @dataclass
@@ -527,10 +504,6 @@ def check_machine_ssh_reachable(
     if opts is None:
         opts = ConnectionOptions()
 
-    cmdlog.debug(
-        f"Checking SSH reachability for {remote.target} on port {remote.port or 22}",
-    )
-
     address_family = socket.AF_INET6 if ":" in remote.address else socket.AF_INET
     for _ in range(opts.retries):
         with socket.socket(address_family, socket.SOCK_STREAM) as sock:

renovate.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "lockFileMaintenance": { "enabled": true },
+  "nix": {
+    "enabled": true
+  },
+  "packageRules": [
+    {
+      "matchManagers": ["npm"],
+      "matchPaths": ["pkgs/clan-app/ui/**"],
+      "enabled": false
+    }
+  ]
+}