Package: afterglow
afterglowWARNING: Project is currently unstable, API's versions and tags can change at any momentA configuration tool for ignition based systems.Ignition-based systems have a 'one-shot' system configuration, which needs to be generally available to all instances. This means that if you are deploying a service that requires configured secrets, you might be tempted to place them in the Ignition config. However, doing so would involve storing secrets in plain text (potentially uploading them to a hosting service). Not only is this insecure, but it also doesn't truly solve the problem since these secrets are likely to rotate, rendering any static values in the Ignition configuration invalid. This service is intended to allow secret provisioning after boot, similar to how you would provision other servers. This aligns with the general principles of other configuration tools such as Ansible and PuppetPrinciple of operationThis service usessshandscpto copy across configuration files and uses parent/child semantics where the parent provisions the child. A typical boot up flow may look like this:Parent (CI/Local/Instance) boots up a new vm on some host providerParent needs to know the childs public keyRequires the parent knows the IP address of the child nodeChild boots and runsafterglow child <...>providing private keyNote: In someways this is just kicking the can down the road. We still need to get the secret key onto the child node. How exactly is up to you. Two solutions seems promising:Add a volume mount to the instance through the host providerUpload a custom FCOS|Flatcar|... image with a preshared key (symmetrical/asymetrical?) used to decrypt a private key in the ignition configSome other trust mechanism through the host provider (aws secrets manager) with IAM permissions provided to the instanceParent runsafterglow parent <...>including child public key connecting to childChild initiatesscpfor each configured files.Both parent and child process return exit code0on successful provisioningChild writes lock file to--lock-pathcontaining<file tag> = <sha256sum>key value pairsNote: The intention of this is to allow use of this in a systemd unit configuration for oneshot behaviourIn the case of copy failure the child process keeps running waiting up totimeoutfor a new parent connection which succeeds.RoadmapAdd CI integration testsUsageSpecify the mode eitherparentorchildusage:afterglow[-h][parent|child]...

Copyfilesfromonemachinetoanother

positionalarguments:[parent|child]childcopyfilesontothismachineparentcopyfilesfromthismachineParent optionsusage:afterglowparent[-h]--private-keyPRIVATE_KEY--child-keyCHILD_KEY--ipIP--portPORT--filesFILES[FILES...][--timeoutTIMEOUT]options:-h,--helpshowthishelpmessageandexit--private-keyPRIVATE_KEYPathtoprivatekeyfile--child-keyCHILD_KEYPathtochildspublickey--ipIPTheipaddrestoconnectto--portPORTTheporttoconnectto--filesFILES[FILES...]Colonseperatedfile:pathmapping--timeoutTIMEOUTThetimewindowforwhichfilesareexpetedtobecopiedacrossChild optionsusage:afterglowchild[-h]--private-keyPRIVATE_KEY--portPORT--filesFILES[FILES...][--timeoutTIMEOUT]options:-h,--helpshowthishelpmessageandexit--private-keyPRIVATE_KEYPathtoprivatekeyfile--portPORTTheportonwhichtheserverwilllisten--filesFILES[FILES...]Colonseperatedfile:pathmapping--lock-pathLOCK_PATHPathtowritethelockfiletouponsuccessfullprovisioning--timeoutTIMEOUTThetimewindowforwhichfilesareexpetedtobecopiedacrossMakefileSimplify docker packagingDependenciesDocker or Podman (passUSE_PODMAN=1to use podman)The pyproject.toml file needs to have a version set correctlyTargetsbuild: Builds the Docker or Podman image using the specified Dockerfile and assigns appropriate tags based on the project's version defined inpyproject.toml.run: Runs the Docker or Podman container with the specified runtime arguments (RUN_ARGS). It also allows additional runtime arguments to be passed (DOCKER_ARGS).clean: Removes the Docker or Podman image and the running container associated with the project. It stops the running container, removes it, and deletes the image.rebuild:cleanbuildrerun:rebuildrunpush: Push image to docker hubhelp: Show help informationDevelopingTech stackpyenvpython-build-dependenciespoetrypython 3.11pyenv install 3.11Example invocationsChilddockerrun\-v~/.ssh:/root/.ssh:ro\-v`pwd`:/host\-p127.0.0.1:8022:8022\dataligand/afterglow:latestchild\--filestest_file:/host/child/files\--lock-path/host/afterglow.lock\--private-key/root/.ssh/id_ed25519\--port8022Parentdockerrun\-v~/.ssh:/root/.ssh:ro\-v`pwd`:/root/files:ro\--networkhost\dataligand/afterglow:latestparent\--filestest_file:/root/files/test_file\--private-key/root/.ssh/id_ed25519\--child-key/root/.ssh/id_ed25519.pub\--iplocalhost\--port8022