4 files changed, 32 insertions, 19 deletions

diff --git a/cokiki.hs b/cokiki.hs
index 9448aea..fc69037 100644
--- a/cokiki.hs
+++ b/cokiki.hs
@@ -78,22 +78,22 @@ whenRoot uid root cmn action
     no = hPutStrLn stderr "operation requires root."
 
 sshClient uid root cmn = whenRoot uid root cmn $ do
-    -- /etc/ssh/ssh_config    <--  'GlobalKnownHostsFile /var/cache/kiki/ssh_known_hosts'
+    -- /etc/ssh/config/ssh_config    <--  'GlobalKnownHostsFile /var/cache/kiki/ssh_known_hosts'
     sshconfig <- parseSshConfig . fromMaybe "" <$> maybeReadFile (root "/etc/ssh/ssh_config")
     let (ps,qs) = sshSplitAtDirective "GlobalKnownHostsFile" sshconfig
     sshconfig' <-
         case qs of
-            d:ds | elem "/var/cache/kiki/ssh_known_hosts" d
+            d:ds | elem "/var/cache/kiki/config/ssh_known_hosts" d
                  -> do hPutStrLn stderr "ssh-client already configured."
                        return Nothing
             d:ds -> do hPutStrLn stderr "modifying GlobalKnownHostsFile directive"
-                       let hs = " " : "/var/cache/kiki/ssh_known_hosts" : drop 1 d
+                       let hs = " " : "/var/cache/kiki/config/ssh_known_hosts" : drop 1 d
                            stmt = take 1 d ++ hs
                        return $ Just (ps ++ stmt : ds)
             []   -> do -- Unconfigured add fresh directive.
                        hPutStrLn stderr "adding GlobalKnownHostsFile directive"
                        let stmt = L8.unwords ["GlobalKnownHostsFile"
-                                             ,  "/var/cache/kiki/ssh_known_hosts"
+                                             ,  "/var/cache/kiki/config/ssh_known_hosts"
                                              ,  "/etc/ssh/ssh_known_hosts"
                                              ,  "/etc/ssh/ssh_known_hosts2"
                                              ]
@@ -101,31 +101,31 @@ sshClient uid root cmn = whenRoot uid root cmn $ do
     sshconfig' `deepseq` return () -- force lazy input
     maybe (return ()) (myWriteFile (root "/etc/ssh/ssh_config") . unparseSshConfig) sshconfig'
 
-    -- /var/cache/kiki/ssh_known_hosts        <--  contains known hosts from /root/.gnupg/...
+    -- /var/cache/kiki/config/ssh_known_hosts        <--  contains known hosts from /root/.gnupg/...
     Kiki.importAndRefresh root cmn
 
 sshServer uid root cmn = whenRoot uid root cmn $ do
     sshconfig <- parseSshConfig . fromMaybe "" <$> maybeReadFile (root "/etc/ssh/sshd_config")
     let p:gs = groupBy (\_ d -> not $ sshIsDirective "HostKey" d) $ ["#"]:sshconfig
-        got = filter (\(d:ds) -> elem "/var/cache/kiki/ssh_host_rsa_key" d) gs
+        got = filter (\(d:ds) -> elem "/var/cache/kiki/config/ssh_host_rsa_key" d) gs
     case got of
         _:_ -> do hPutStrLn stderr "ssh-server already configured."
         [] -> do let sshconfig' = drop 1 $ sshconfig ++ [stmt]
-                     stmt = ["HostKey", " ", "/var/cache/kiki/ssh_host_rsa_key"]
+                     stmt = ["HostKey", " ", "/var/cache/kiki/config/ssh_host_rsa_key"]
                  hPutStrLn stderr "adding HostKey directive"
                  myWriteFile (root "/etc/ssh/sshd_config") $ unparseSshConfig sshconfig'
-    -- /etc/ssh/sshd_config <-- 'HostKey /var/cache/kiki/ssh_host_ecdsa_key' etc.
+    -- /etc/ssh/sshd_config <-- 'HostKey /var/cache/kiki/config/ssh_host_ecdsa_key' etc.
     Kiki.importAndRefresh root cmn
 
 strongswan uid root cmn = whenRoot uid root cmn $ do
     -- Parsing as if ssh config, that's not right, but good enough for now.
     ipsecconf <- parseSshConfig . fromMaybe "" <$> maybeReadFile (root "/etc/ipsec.conf")
     let p:gs = groupBy (\_ d -> not $ sshIsDirective "include" d) $ ["#"]:ipsecconf
-        got = filter (\(d:ds) -> elem "/var/cache/kiki/ipsec.conf" d) gs
+        got = filter (\(d:ds) -> elem "/var/cache/kiki/config/ipsec.conf" d) gs
     case got of
         _:_ -> do hPutStrLn stderr "ipsec already configured."
         [] -> do let ipsecconf' = drop 1 $ ipsecconf ++ [stmt]
-                     stmt = ["include", " ", "/var/cache/kiki/ipsec.conf"]
+                     stmt = ["include", " ", "/var/cache/kiki/config/ipsec.conf"]
                  hPutStrLn stderr "adding include directive"
                  myWriteFile (root "/etc/ipsec.conf") $ unparseSshConfig ipsecconf'
     -- etc/ipsec.conf    <--  'include /var/cache/kiki/ipsec.conf'
diff --git a/kiki.cabal b/kiki.cabal
index 4f624d6..b937984 100644
--- a/kiki.cabal
+++ b/kiki.cabal
@@ -96,6 +96,7 @@ library
                      FunctorToMaybe
 
     Build-Depends:   base >=4.6.0.0,
+                     temporary,
                      asn1-encoding,
                      asn1-types,
                      binary,
diff --git a/lib/Kiki.hs b/lib/Kiki.hs
index 0e06ee2..34594cc 100644
--- a/lib/Kiki.hs
+++ b/lib/Kiki.hs
@@ -18,8 +18,10 @@ import Data.Ord
 import System.Directory
 import System.FilePath.Posix
 import System.IO
+import System.IO.Temp
 import System.Posix.User
 import System.Process
+import System.Posix.Files
 import qualified Codec.Binary.Base64 as Base64
 import qualified Data.ByteString.Lazy as L
 import qualified Data.ByteString.Lazy.Char8 as Char8
@@ -212,9 +214,19 @@ importAndRefresh root cmn = do
 refreshCache :: KeyRingRuntime -> Maybe FilePath -> IO ()
 refreshCache rt rootdir = do
 
-    let mkpath pth = fromMaybe "" rootdir ++ "/var/cache/kiki/"++pth
-
-        write' wr f bs = do
+    let getMkPathAndCommit destdir = do
+        let cachedir = takeDirectory destdir
+            unslash ('/':xs) = xs
+            unslash xs = xs
+        createDirectoryIfMissing True cachedir
+        tmpdir <- createTempDirectory cachedir "tmp.dir"
+        createSymbolicLink tmpdir (tmpdir ++ ".link")
+        let mkpath pth = tmpdir </> unslash pth
+            commit     = rename (tmpdir ++ ".link") destdir
+        return (mkpath,commit)
+    (mkpath, commit) <- getMkPathAndCommit (fromMaybe "" rootdir ++ "/var/cache/kiki/config")
+
+    let write' wr f bs = do
             createDirectoryIfMissing True $ takeDirectory f
             wr f bs
         write = write' writeFile
@@ -347,7 +359,7 @@ refreshCache rt rootdir = do
             , "  auto=route"
             , ""
             ] ++ filter (not . Char8.null) cons
-    return ()
+    commit
 
 strongswanForContact addr oname = Char8.unlines
     [ "conn " <> p oname
diff --git a/testkiki/testkiki.hs b/testkiki/testkiki.hs
index 90b6635..c8b141b 100644
--- a/testkiki/testkiki.hs
+++ b/testkiki/testkiki.hs
@@ -262,7 +262,7 @@ doTests tkConfig = hspec $ do
 
     -- **** cokiki tests *****
     describe "cokiki ssh-client" $ do
-        it "modifies system ssh configuration to respect /var/cache/kiki/ssh_known_hosts." $
+        it "modifies system ssh configuration to respect /var/cache/kiki/config/ssh_known_hosts." $
           onlyIf didInit3 $ do
             let cfg' = appendpaths tkConfig "3"
                 home = "root" -- chroot cfg' </> "root"
@@ -287,8 +287,8 @@ doTests tkConfig = hspec $ do
                             nonComment x = not ("#" `B.isPrefixOf` x)
                         lines <- filter nonComment . map dropSp . B.lines <$> B.readFile file
                         return (any (x `B.isInfixOf`) lines)            )
-                -- does it already mention /var/cache/kiki/ssh_known_hosts? expect not 
-                subStr0 <- etcFile `hasSubStr` "/var/cache/kiki/ssh_known_hosts"
+                -- does it already mention /var/cache/kiki/config/ssh_known_hosts? expect not 
+                subStr0 <- etcFile `hasSubStr` "/var/cache/kiki/config/ssh_known_hosts"
                 bReplace <- etcFile `hasUnCommentedSubStr` "GlobalKnownHostsFile"
                 (code,(outs,ers)) <- runExternal (mkCokiki cfg ["ssh-client"]) Nothing
                 -- outs <- cokiki cfg ["ssh-client"] myStdErr
@@ -298,8 +298,8 @@ doTests tkConfig = hspec $ do
                 (lost,gained) <- linesSubtractedAndAdded etcFile
                 -- did Sha1 change? expect it did
                 bChanged <- isChangedSha1 etcFile
-                -- does it mention /var/cache/kiki/ssh_known_hosts now? expect it does
-                subStr <- etcFile `hasSubStr` "/var/cache/kiki/ssh_known_hosts"
+                -- does it mention /var/cache/kiki/config/ssh_known_hosts now? expect it does
+                subStr <- etcFile `hasSubStr` "/var/cache/kiki/config/ssh_known_hosts"
                 -- new mtime
                 mtime <- getModificationTime etcFile
                 if bReplace then