nixo
/
guix-devel
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

machine: Implement safety checks. 

* gnu/machine/ssh.scm (machine-check-file-system-availability)
(machine-check-initrd-modules, check-deployment-sanity): New variable.
(deploy-managed-host): Perform safety checks before deploying.
master
Jakob L. Kreuze 2019-07-31 10:38:29 -04:00 committed by Christopher Lemmer Webber
parent 5f04e9f962
commit fd3119db4f
No known key found for this signature in database
GPG Key ID: 4BC025925FF8F4D3
1 changed files with 145 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

146
gnu/machine/ssh.scm
View File

@ -20,6 +20,9 @@
#:use-module (gnu machine)
#:autoload (gnu packages gnupg) (guile-gcrypt)
#:use-module (gnu system)
#:use-module (gnu system file-systems)
#:use-module (gnu system uuid)
#:use-module (guix diagnostics)
#:use-module (guix gexp)
#:use-module (guix i18n)
#:use-module (guix modules)
@ -29,6 +32,7 @@
#:use-module (guix scripts system reconfigure)
#:use-module (guix ssh)
#:use-module (guix store)
#:use-module (guix utils)
#:use-module (ice-9 match)
#:use-module (srfi srfi-19)
#:use-module (srfi srfi-26)
@ -98,6 +102,145 @@ an environment type of 'managed-host."
(maybe-raise-unsupported-configuration-error machine)
(remote-eval exp (machine-ssh-session machine)))
;;;
;;; Safety checks.
;;;
(define (machine-check-file-system-availability machine)
"Raise a '&message' error condition if any of the file-systems specified in
MACHINE's 'system' declaration do not exist on the machine."
(define file-systems
(filter (lambda (fs)
(and (file-system-mount? fs)
(not (member (file-system-type fs)
%pseudo-file-system-types))
(not (memq 'bind-mount (file-system-flags fs)))))
(operating-system-file-systems (machine-operating-system machine))))
(define (check-literal-file-system fs)
(define remote-exp
#~(catch 'system-error
(lambda ()
(stat #$(file-system-device fs))
#t)
(lambda args
(system-error-errno args))))
(mlet %store-monad ((errno (machine-remote-eval machine remote-exp)))
(when (number? errno)
(raise (condition
(&message
(message (format #f (G_ "device '~a' not found: ~a")
(file-system-device fs)
(strerror errno)))))))
(return #t)))
(define (check-labeled-file-system fs)
(define remote-exp
(with-imported-modules '((gnu build file-systems))
#~(begin
(use-modules (gnu build file-systems))
(find-partition-by-label #$(file-system-label->string
(file-system-device fs))))))
(mlet %store-monad ((result (machine-remote-eval machine remote-exp)))
(unless result
(raise (condition
(&message
(message (format #f (G_ "no file system with label '~a'")
(file-system-label->string
(file-system-device fs))))))))
(return #t)))
(define (check-uuid-file-system fs)
(define remote-exp
(with-imported-modules (source-module-closure
'((gnu build file-systems)
(gnu system uuid)))
#~(begin
(use-modules (gnu build file-systems)
(gnu system uuid))
(define uuid
(string->uuid #$(uuid->string (file-system-device fs))))
(find-partition-by-uuid uuid))))
(mlet %store-monad ((result (machine-remote-eval machine remote-exp)))
(unless result
(raise (condition
(&message
(message (format #f (G_ "no file system with UUID '~a'")
(uuid->string (file-system-device fs))))))))
(return #t)))
(mbegin %store-monad
(mapm %store-monad check-literal-file-system
(filter (lambda (fs)
(string? (file-system-device fs)))
file-systems))
(mapm %store-monad check-labeled-file-system
(filter (lambda (fs)
(file-system-label? (file-system-device fs)))
file-systems))
(mapm %store-monad check-uuid-file-system
(filter (lambda (fs)
(uuid? (file-system-device fs)))
file-systems))))
(define (machine-check-initrd-modules machine)
"Raise a '&message' error condition if any of the modules needed by
'needed-for-boot' file systems in MACHINE are not available in the initrd."
(define file-systems
(filter file-system-needed-for-boot?
(operating-system-file-systems (machine-operating-system machine))))
(define (missing-modules fs)
(define remote-exp
(let ((device (file-system-device fs)))
(with-imported-modules (source-module-closure
'((gnu build file-systems)
(gnu build linux-modules)
(gnu system uuid)))
#~(begin
(use-modules (gnu build file-systems)
(gnu build linux-modules)
(gnu system uuid))
(define dev
#$(cond ((string? device) device)
((uuid? device) #~(find-partition-by-uuid
(string->uuid
#$(uuid->string device))))
((file-system-label? device)
#~(find-partition-by-label
(file-system-label->string #$device)))))
(missing-modules dev '#$(operating-system-initrd-modules
(machine-operating-system machine)))))))
(mlet %store-monad ((missing (machine-remote-eval machine remote-exp)))
(return (list fs missing))))
(mlet %store-monad ((device (mapm %store-monad missing-modules file-systems)))
(for-each (match-lambda
((fs missing)
(unless (null? missing)
(raise (condition
(&message
(message (format #f (G_ "~a missing modules ~{ ~a~}~%")
(file-system-device fs)
missing))))))))
device)
(return #t)))
(define (check-deployment-sanity machine)
"Raise a '&message' error condition if it is clear that deploying MACHINE's
'system' declaration would fail."
(mbegin %store-monad
(machine-check-file-system-availability machine)
(machine-check-initrd-modules machine)))
;;;
;;; System deployment.
@ -165,7 +308,8 @@ of MACHINE's system profile, ordered from most recent to oldest."
"Internal implementation of 'deploy-machine' for MACHINE instances with an
environment type of 'managed-host."
(maybe-raise-unsupported-configuration-error machine)
(mlet %store-monad ((boot-parameters (machine-boot-parameters machine)))
(mlet %store-monad ((_ (check-deployment-sanity machine))
(boot-parameters (machine-boot-parameters machine)))
(let* ((os (machine-operating-system machine))
(eval (cut machine-remote-eval machine <>))
(menu-entries (map boot-parameters->menu-entry boot-parameters))