MachineState: Don't send keys within state.RESCUE.

This will store keys on the machine's disk when you try to deploy a
machine expression that has deployment.keys set, because in rescue state
we don't have /run mounted.

If you want to manually get rid of /run/keys from your disk you can
access the files that are covered by another mount using a bind mount of
the parent directory, so you can delete the keys using something like
this:

mkdir /delkeys
mount --bind / /delkeys
rm -r /delkeys/run/keys
umount /delkeys
rmdir /delkeys

But that's no longer necessary since release 14.04, because the stage 2
init script does a "rm -rf /run/keys" on bootup already.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Fix evaluation of VM tests for all backends.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
tests: Add Archive::Cpio to all the coordinators.

This is needed in order to build the initrd for the target machines and
we don't have access to external network resources within the VM test.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
tests: Disable packet filtering on all VM tests.

This is only a source for more errors, confusion, more complexity and we
really don't want to test the packet filter here, because we already
have tests in NixOS directly.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Merge pull request #208 from aszlig/fix-vm-tests

Fix VM tests.
Merge pull request #207 from aszlig/fix-rescue-sendkeys

MachineState: Don't send keys within state.RESCUE.
Use docbook xhtml output for nixops manual.
Add option --keep-physical to remove backups just from nixops state, and leave the physical copy as-is.
When using --force with 'nixops backup' do not perform status checks on existing backups.
Allow users in group "keys" to access /run/keys.

This makes it at least possible to access the keys directory if a
particular service is in the keys group, which has been introduced by
NixOS/nixpkgs@4ab5646417e3cc606281f71027c12ddced8b65b4.

However, to let specific users access a particular key, you still need
to work around it by adding an additional systemd service that sets the
right permissions. But at least with this we should have some
consistency with what is actually done in <nixpkgs>.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Turn "keys" option into an attrset of attrsets.

This now provides options for each key and also converts old style
string-only keys into the new format while emitting a warning.

At the moment only the "text" option is actually supported.

For applying the keys for string-values the permissions attribute is set
to "0600" instead of the default value "0640" in keyOptionsType in order
to correctly replicate the old behaviour even when we implement
permissions and ownership.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
MachineState: Implement permissions for keys.

This however only implements setting permissions if "storeKeysOnMachine" is
set to false right now, because if the value is set to true the keys are
symlinked from the store and we actually have to find a way to control
permisions on it, which for the store is only possible if NixOS/nix#8 is
implemented.

Also, this ensures that the key filename is properly escaped.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
nix/keys: Fix keyOptionsType submodule type.

First, forgot about specifying options.* and even if it would be there,
the option values wouldn't be merged because keyType was not properly
inheriting the merge function from keyOptionsType.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
nix/keys: Use 0600 as the default permissions.

Only using this for legacy options could introduce unexpected behaviour
when switching to the new configuration if the user just appends a .text
to its configuration values and could possibly lead to services that
refuse to work, especially when it comes to OpenSSH.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
nix/keys: Fix eval if storeKeysOnMachine is true.

This currently only fixes evaluation but actually doesn't apply the
correct permissions on the key files because they're just links to world
readable files in the Nix store.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
nix/keys: Fix description of storeKeysOnMachine.

As storeKeysOnMachine no longer is true by default (7ae4b27), we
shouldn't say so in the description. Especially because the default
value is already shown in the generated manual along with the
description.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
nix/keys: Add a warning for storeKeysOnMachine.

This warning should be annoying enough so people will eventually set it
to false in case they ever used it. Especially if we want to set key
permissions, setting this option is pointless anyway because keys in
/run/keys are just symlinks to the world-readably store paths.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
nix/keys: Correctly merge/convert deployment.keys.

So far we only used the apply function in order to convert keys as
string values into the new format. But if you have several keys defined,
mixing old and new format, the evaluation will fail because the apply
function is only evaluated once everything is merged.

So, we now use the same function we're using for apply to merge the
consecutive option values.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>