meissa/dda-backup
7
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

change pw now works

Browse source
This commit is contained in:
Michael Jerger 2024-12-11 10:43:44 +01:00
parent e07d0021b2
commit 747755eb2c
5 changed files with 207 additions and 64 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
infrastructure/backup/image/Dockerfile
View file

@ -6,4 +6,5 @@ RUN /tmp/install.sh
ADD local/ /usr/local/lib/dda-backup
RUN init-bb.bb
ADD resources2 /tmp/
RUN install -m 0700 -o root -g root /tmp/test-me.bb /usr/local/bin/
RUN install -m 0700 -o root -g root /tmp/test.bb /usr/local/bin/
RUN test.bb

23
infrastructure/backup/image/resources2/test-me.bb → infrastructure/backup/image/resources2/test.bb
View file

@ -1,7 +1,5 @@
#!/usr/bin/env bb
(println "initialized")
(require '[babashka.tasks :as tasks]
'[dda.backup.cred-rot :as cr]
'[dda.backup.restic :as rc]
@ -14,24 +12,19 @@
:files ["test-backup"]
:restore-target-directory "test-restore"}))
(def db-config (merge restic-repo {:backup-path "db"
:pg-db "mydb"
:pg-user "user"
:pg-password "password"}))
(def cred-config (merge restic-repo {:new-password-file "new-pw-file"}))
(def cred-config (merge restic-repo
{:new-password-config {:new-password-file "new-pw"
:valid-from "2024-12-12 00:00:00"}}))
(def dry-run {:dry-run true :debug true})
(defn prepare!
[]
(spit "/tmp/file_password" "file-password")
(spit "restic-pwd" "ThePassword")
(spit "restic-pwd" "thePassword")
(spit "new-pw" "newPassword")
(tasks/shell "mkdir" "-p" "test-backup")
(spit "test-backup/file" "I was here")
(spit "new-pw-file" "newpassword")
(tasks/shell "mkdir" "-p" "test-restore")
(pg/create-pg-pass! db-config))
(tasks/shell "mkdir" "-p" "test-restore"))
(defn restic-repo-init!
[]
@ -39,6 +32,4 @@
(prepare!)
(restic-repo-init!)
(cr/list-passwords! cred-config)
(cr/maybe-add-new! cred-config)
(cr/list-passwords! cred-config)
(cr/change-password! cred-config)

72
src/dda/backup/cred_rot.clj
View file

@ -3,11 +3,13 @@
[orchestra.core :refer [defn-spec]]
[clojure.spec.alpha :as s]
[dda.backup.cred-rot.domain :as domain]
[dda.backup.infrastructure :as i]))
[dda.backup.infrastructure :as i]
[cljc.java-time.instant :as inst]
[cljc.java-time.local-date :as ld]))
(s/def ::valid-from domain/timestamp?)
(s/def ::replace-until domain/timestamp?)
(s/def ::new-password-file string?)
(s/def ::new-password-config (s/keys :req-un [::new-password-file ::valid-from]))
(s/def ::new-password-config (s/keys :req-un [::new-password-file ::replace-until]))
(s/def ::cred-rot
(s/keys :req-un []
@ -18,16 +20,60 @@
[config ::cred-rot]
(i/execute-out! (domain/list-passwords-command config) config))
(defn-spec maybe-add-new! nil?
(defn-spec change-password-step! nil?
[config ::cred-rot]
(let [{:keys [new-password-file valid-from]} (:new-password-config config)]
(when-some [new-password-config (:new-password-config config)]
(let [{:keys [new-password-file replace-until]} new-password-config
initial-passwords-list (domain/parse-response (list-passwords! config))
action (domain/set-new-password-action
(ld/now)
initial-passwords-list
config)]
(cond
(= action :wait-for-new-pwd)
(println "wait till new password is valid")
(= action :set-new-pwd)
(i/execute! (domain/add-password-command config) config)
(= action :remove-old-pwd)
(i/execute! (domain/remove-password-command
config
(:id (first initial-passwords-list))
(:id (last initial-passwords-list)))
config)
(= action :new-pwd-change-finished)
(println "pw-change sucessfull")
(= action :no-pwd-change-needed)
(println "nothing to do.")
:else
(throw (Exception. (str action)))
)
(println initial-passwords-list)
(println action)
(println (list-passwords! config))
action
)))
(defn-spec change-password! nil?
[config ::cred-rot]
(while (let [action (change-password-step! config) ]
(and (not= :no-pwd-change-needed action)
(not= :wait-for-new-pwd action)))
(println "call step")
))
(defn-spec set-new-password-old! nil?
[config ::cred-rot]
(let [{:keys [new-password-file replace-until]} (:new-password-config config)
replace-until-date (ld/parse "2024-10-19 13:16:54" domain/timestamp-formatter)]
(if (not (nil? new-password-file))
(let [parsed-passwords (domain/parse-response (list-passwords! config))]
(when (> 0 (compare
(:created (last parsed-passwords))
valid-from))
(i/execute! (domain/add-password-command config) config))))))
(defn-spec replace-old-password! nil?
[]
)
(println (str "add-new-password: relace until " replace-until))
(cond
(> 0 (compare
(:created (last parsed-passwords))
replace-until-date))
(do (println "add-new-password: set new pw")
(i/execute! (domain/add-password-command config) config))
:else (println (str "else " (inst/now)))))
(println "add-new-password: there was no new pw configured"))))

51
src/dda/backup/cred_rot/domain.clj
View file

@ -27,20 +27,32 @@
(s/def ::hostName (fn [in] (every? #(re-matches lowercase-numeric %) (str/split in #"-"))))
; "2024-10-18 13:08:16"
(def timestamp-formatter (df/of-pattern "yyyy-MM-dd HH:mm:ss"))
(defn timestamp? [in]
(defn timestamp-string? [in]
(try
(ld/parse in timestamp-formatter)
true
(catch Exception _ false)))
(def timestamp? any?)
(s/def ::created timestamp?)
(s/def ::entry (s/keys :opt-un []
:req-un [::current ::id ::userName ::hostName ::created]))
(s/def ::response (s/coll-of ::entry))
(s/def ::set-password-action #{:error-parse-password :error-undefined
:wait-for-new-pwd :set-new-pwd :remove-old-pwd
:new-pwd-change-finished :no-pwd-change-needed})
(s/def ::valid-from timestamp-string?)
(s/def ::new-password-file string?)
(s/def ::new-password-config (s/keys :req-un [::new-password-file ::valid-from]))
(s/def ::cred-rot
(s/keys :req-un []
:opt-un [::new-password-config]))
; Refer to "docs/CredentialRotation.md" for specifics
(defn-spec base-command ::cd/command
[config ::config
command ::cd/command]
@ -75,4 +87,37 @@
(defn-spec parse-response ::response
[response string?]
(sort-by :created (cc/parse-string response #(keyword %))))
(->> (cc/parse-string response true)
(map #(merge % {:created (ld/parse (:created %) timestamp-formatter)}))
(sort-by :created)
))
(defn-spec set-new-password-action ::set-password-action
[current-date timestamp?
parsed-response ::response
config ::cred-rot]
(if-let [new-password-config (:new-password-config config)]
(let [valid-from (:valid-from new-password-config)
valid-from-date (ld/parse valid-from timestamp-formatter)]
(cond
(> 1 (count parsed-response))
:error-parse-password
(> 0 (compare current-date valid-from-date))
:wait-for-new-pwd
(and (<= 0 (compare current-date valid-from-date))
(= 1 (count parsed-response))
(> 0 (compare (:created (last parsed-response)) valid-from-date)))
:set-new-pwd
(and (<= 0 (compare current-date valid-from-date))
(= 2 (count parsed-response))
(<= 0 (compare (:created (last parsed-response)) valid-from-date))
(not (:current (last parsed-response))))
:remove-old-pwd
(and (<= 0 (compare current-date valid-from-date))
(= 1 (count parsed-response))
(<= 0 (compare (:created (last parsed-response)) valid-from-date))
(:current (last parsed-response)))
:new-pwd-change-finished
:else
:error-undefined))
:no-pwd-change-needed))

122
test/dda/backup/cred_rot/domain_test.clj
View file

@ -3,37 +3,9 @@
[clojure.test :refer [deftest is]]
[clojure.spec.alpha :as s]
[clojure.spec.test.alpha :as st]
[cljc.java-time.local-date :as ld]
[dda.backup.cred-rot.domain :as cut]))
(deftest test-parse-response
(is (=
[{:current true,
:id "b67161fb",
:userName "root",
:hostName "backup-restore-65bd9b6ff5-z69sn",
:created "2024-10-18 13:16:54"}
{:current false,
:id "521e0760",
:userName "root",
:hostName "backup-restore-65bd9b6ff5-z69sn",
:created "2024-11-18 13:08:16"}]
(cut/parse-response "[
{
\"current\": false,
\"id\": \"521e0760\",
\"userName\": \"root\",
\"hostName\": \"backup-restore-65bd9b6ff5-z69sn\",
\"created\": \"2024-11-18 13:08:16\"
},
{
\"current\": true,
\"id\": \"b67161fb\",
\"userName\": \"root\",
\"hostName\": \"backup-restore-65bd9b6ff5-z69sn\",
\"created\": \"2024-10-18 13:16:54\"
}
]"))))
(deftest test-spec-id
(is (s/valid? ::cut/id "521e0760"))
(is (s/valid? ::cut/id "test"))
@ -54,9 +26,97 @@
(is (valid "backup-restore-65bd9b6ff5-z69sn"))))
(deftest test-spec-timestamp
(let [valid #(s/valid? cut/timestamp? %)]
(let [valid #(s/valid? cut/timestamp-string? %)]
(is (valid "2024-10-18 13:08:16"))
(is (valid "2032-09-01 12:56:59"))
(is (not (valid "2024-13-5 13:08:16")))
(is (not (valid "2024-6-42 13:08:16")))
(is (not (valid "test")))))
(is (not (valid "test")))))
(deftest test-parse-response
(is (=
(ld/parse "2024-10-19 13:16:54" cut/timestamp-formatter)
(:created
(first
(cut/parse-response "[
{
\"current\": false,
\"id\": \"521e0760\",
\"userName\": \"root\",
\"hostName\": \"backup-restore-65bd9b6ff5-z69sn\",
\"created\": \"2024-11-18 13:08:16\"
},
{
\"current\": true,
\"id\": \"b67161fb\",
\"userName\": \"root\",
\"hostName\": \"backup-restore-65bd9b6ff5-z69sn\",
\"created\": \"2024-10-19 13:16:54\"
}
]"))))))
(deftest test-set-new-password-action
(is (= :error-parse-password
(cut/set-new-password-action
(ld/parse "2024-10-19 13:16:54" cut/timestamp-formatter)
[]
{:new-password-config {:new-password-file "new-pw-file"
:valid-from "2024-11-29 12:00:16"}})))
(is (= :wait-for-new-pwd
(cut/set-new-password-action
(ld/parse "2024-10-19 13:16:54" cut/timestamp-formatter)
[{:current true
:id "a1"
:userName "root"
:hostName "host"
:created (ld/parse "2023-01-01 00:00:00" cut/timestamp-formatter)}]
{:new-password-config {:new-password-file "new-pw-file"
:valid-from "2024-11-29 12:00:16"}})))
(is (= :set-new-pwd
(cut/set-new-password-action
(ld/parse "2024-11-29 13:16:54" cut/timestamp-formatter)
[{:current true
:id "a1"
:userName "root"
:hostName "host"
:created (ld/parse "2023-01-01 00:00:00" cut/timestamp-formatter)}]
{:new-password-config {:new-password-file "new-pw-file"
:valid-from "2024-11-29 12:00:16"}})))
(is (= :remove-old-pwd
(cut/set-new-password-action
(ld/parse "2024-11-29 13:16:55" cut/timestamp-formatter)
[{:current true
:id "a1"
:userName "root"
:hostName "host"
:created (ld/parse "2023-01-01 00:00:00" cut/timestamp-formatter)}
{:current false
:id "a2"
:userName "root"
:hostName "host"
:created (ld/parse "2024-11-29 13:16:54" cut/timestamp-formatter)}]
{:new-password-config {:new-password-file "new-pw-file"
:valid-from "2024-11-29 12:00:16"}})))
(is (= :new-pwd-change-finished
(cut/set-new-password-action
(ld/parse "2024-11-29 13:16:55" cut/timestamp-formatter)
[{:current true
:id "a2"
:userName "root"
:hostName "host"
:created (ld/parse "2024-11-29 13:16:54" cut/timestamp-formatter)}]
{:new-password-config {:new-password-file "new-pw-file"
:valid-from "2024-11-29 12:00:16"}})))
(is (= :no-pwd-change-needed
(cut/set-new-password-action
(ld/parse "2024-11-29 13:16:55" cut/timestamp-formatter)
[{:current true
:id "a2"
:userName "root"
:hostName "host"
:created (ld/parse "2024-11-29 13:16:54" cut/timestamp-formatter)}]
{})))
)