eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add owner-rooted node management

Browse source
This commit is contained in:
Eric Wendland 2026-05-21 11:29:29 +02:00
commit b941037652
9 changed files with 1001 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

156
crates/geth-cli/src/lib.rs
View file

@ -20,7 +20,18 @@ pub struct Cli {
#[derive(Debug, Subcommand)]
pub enum Command {
Init,
Init {
#[arg(long)]
admin_key: Option<PathBuf>,
#[arg(long)]
signing_key: Option<PathBuf>,
#[arg(long, default_value = "owner")]
owner: String,
#[arg(long, default_value = "local")]
node_name: String,
#[arg(long = "capability")]
capabilities: Vec<String>,
},
Daemon {
#[command(subcommand)]
command: DaemonCommand,
@ -127,6 +138,29 @@ pub enum ServiceCommand {
pub enum NodeCommand {
Id,
Status,
List,
Rename {
node: String,
name: String,
#[arg(long)]
signing_key: Option<PathBuf>,
},
Revoke {
node: String,
#[arg(long)]
signing_key: Option<PathBuf>,
},
Grant {
node: String,
resource: String,
capability: String,
#[arg(long)]
grant_id: Option<String>,
},
RevokeGrant {
resource: String,
grant_id: String,
},
}
#[derive(Debug, Subcommand)]
@ -164,6 +198,9 @@ pub enum KeychainCommand {
signing_key: Option<PathBuf>,
},
Status,
Sync {
node: String,
},
}
#[derive(Debug, Subcommand)]
@ -616,8 +653,24 @@ pub async fn run() -> Result<()> {
let cli = Cli::parse();
let paths = GethPaths::resolve().context("resolve geth paths")?;
match cli.command {
Command::Init => {
let node = geth_node::init_node(&paths).context("initialize geth node")?;
Command::Init {
admin_key,
signing_key,
owner,
node_name,
capabilities,
} => {
let node = geth_node::init_owned_node(
&paths,
geth_node::InitOwnerOptions {
admin_key_path: admin_key,
signing_key_path: signing_key,
owner_name: owner,
node_name,
capabilities,
},
)
.context("initialize geth node")?;
println!("initialized geth home: {}", node.paths.home().display());
println!("agent: {}", node.agent_id);
println!("node: {}", node.node_id);
@ -701,6 +754,44 @@ fn request_for_command(command: Command) -> Result<ControlRequest> {
Command::Node {
command: NodeCommand::Status,
} => ControlRequest::Status,
Command::Node {
command: NodeCommand::List,
} => ControlRequest::NodeList,
Command::Node {
command:
NodeCommand::Rename {
node,
name,
signing_key,
},
} => ControlRequest::NodeRename {
node,
name,
signing_key_path: signing_key,
},
Command::Node {
command: NodeCommand::Revoke { node, signing_key },
} => ControlRequest::NodeRevoke {
node,
signing_key_path: signing_key,
},
Command::Node {
command:
NodeCommand::Grant {
node,
resource,
capability,
grant_id,
},
} => ControlRequest::NodeGrant {
node,
resource,
capability,
grant_id,
},
Command::Node {
command: NodeCommand::RevokeGrant { resource, grant_id },
} => ControlRequest::NodeRevokeGrant { resource, grant_id },
Command::Peer { command } => match command {
PeerCommand::Export { out } => ControlRequest::PeerCardExport { out },
PeerCommand::Import { path } => ControlRequest::PeerCardImport { path },
@ -735,6 +826,9 @@ fn request_for_command(command: Command) -> Result<ControlRequest> {
Command::Keychain {
command: KeychainCommand::Status,
} => ControlRequest::KeychainStatus,
Command::Keychain {
command: KeychainCommand::Sync { node },
} => ControlRequest::KeychainSync { node },
Command::Auth {
command:
AuthCommand::Explain {
@ -1163,7 +1257,7 @@ fn request_for_command(command: Command) -> Result<ControlRequest> {
},
},
},
Command::Init | Command::Daemon { .. } => bail!("command is handled directly"),
Command::Init { .. } | Command::Daemon { .. } => bail!("command is handled directly"),
})
}
@ -1576,6 +1670,23 @@ fn print_response(response: ControlResponse, json: bool) -> Result<()> {
);
}
}
ControlResponse::KeychainSynced {
peer_node_id,
peer_agent_id,
endpoint_id,
ops_imported,
signatures_imported,
invalid_ops_rejected,
note,
} => {
println!("synced keychain from: {peer_node_id}");
println!("agent: {peer_agent_id}");
println!("endpoint: {endpoint_id}");
println!("ops_imported: {ops_imported}");
println!("signatures_imported: {signatures_imported}");
println!("invalid_ops_rejected: {invalid_ops_rejected}");
println!("note: {note}");
}
ControlResponse::SecretStatus { secrets } => {
if secrets.is_empty() {
println!("no resource secrets");
@ -1689,6 +1800,43 @@ fn print_response(response: ControlResponse, json: bool) -> Result<()> {
println!("recorded auth op: {}", op.id);
println!("resource: {}", op.resource);
}
ControlResponse::NodeList { nodes, note } => {
if nodes.is_empty() {
println!("no enrolled nodes");
} else {
for node in nodes {
println!(
"{}\t{}\tdevice {}\t{} endpoints",
node.name,
node.id,
node.device,
node.endpoints.len()
);
}
}
println!("note: {note}");
}
ControlResponse::NodeKeychainUpdated {
ops,
signatures,
note,
} => {
for op in ops {
println!("recorded keychain op: {}", op.id);
}
for signature in signatures {
println!(
"signed keychain op: {} by {} ({})",
signature.op_id, signature.signer, signature.namespace
);
}
println!("note: {note}");
}
ControlResponse::NodeGrantUpdated { op, note } => {
println!("recorded auth op: {}", op.id);
println!("resource: {}", op.resource);
println!("note: {note}");
}
ControlResponse::SshCertRequested { request } => {
println!("ssh cert request: {}", request.id);
println!("status: {}", request.status);