working on bash script to allow remote bootstrapping of sops-nix secrets
This commit is contained in:
+4
-3
@@ -1,8 +1,9 @@
|
||||
|
||||
keys:
|
||||
- &homelab age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v
|
||||
- &laptop age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v
|
||||
- &server age1tklxmt3txjjhcsgwy8ejjj20xuq9ca9w522cvan0vwnmq0vdpezsah25pe
|
||||
creation_rules:
|
||||
- path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
|
||||
key_groups:
|
||||
- age:
|
||||
- *homelab
|
||||
- *laptop
|
||||
- *server
|
||||
|
||||
@@ -5,7 +5,7 @@ let
|
||||
<html>
|
||||
<head><title>Hello</title></head>
|
||||
<body>
|
||||
<h1>Hello from test.roypository.com 🎉</h1>
|
||||
<h1>Hello from test.roypository.com</h1>
|
||||
<p>This content is defined in configuration.nix</p>
|
||||
</body>
|
||||
</html>
|
||||
@@ -47,11 +47,14 @@ in
|
||||
};
|
||||
|
||||
environment.variables = {
|
||||
LEAKYKEY = builtins.readFile config.sops.secrets."clusterPassword".path;
|
||||
CP = config.sops.secrets."clusterPassword".path;
|
||||
CAE = config.sops.secrets."cloudflare-api-email".path;
|
||||
CAK = config.sops.secrets."cloudflare-api-key".path;
|
||||
};
|
||||
|
||||
systemd.user.services.mbsync.unitConfig.After = [ "sops-nix.service" ];
|
||||
|
||||
fileSystems."/persist".neededForBoot = true;
|
||||
|
||||
# set up DNS with nginx
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "ehci_pci" "nvme" "sr_mod" ];
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "ehci_pci" "nvme" "usbhid" "usb_storage" "sd_mod" "sr_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
Executable
+97
@@ -0,0 +1,97 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# User variables
|
||||
target_hostname=""
|
||||
target_destination=""
|
||||
target_user=${BOOTSTRAP_USER-root} # Set BOOTSTRAP_ defaults in your shell.nix
|
||||
ssh_port=${BOOTSTRAP_SSH_PORT-22}
|
||||
ssh_key=${BOOTSTRAP_SSH_KEY-}
|
||||
|
||||
# Create a temporary directory
|
||||
temp=$(mktemp -d)
|
||||
|
||||
# Function to cleanup temporary directory on exit
|
||||
cleanup() {
|
||||
rm -rf "$temp"
|
||||
}
|
||||
trap cleanup EXIT
|
||||
|
||||
function help_and_exit() {
|
||||
echo
|
||||
echo "Remotely installs NixOS on a target machine using this nix-config."
|
||||
echo
|
||||
echo "USAGE: $0 -n <target_hostname> -d <target_destination> -k <ssh_key> [OPTIONS]"
|
||||
echo
|
||||
echo "ARGS:"
|
||||
echo " -n <target_hostname> specify target_hostname of the target host to deploy the nixos config on."
|
||||
echo " -d <target_destination> specify ip or domain to the target host."
|
||||
echo " -k <ssh_key> specify the full path to the ssh_key you'll use for remote access to the"
|
||||
echo " target during install process."
|
||||
echo " Example: -k /home/${target_user}/.ssh/my_ssh_key"
|
||||
echo
|
||||
echo "OPTIONS:"
|
||||
echo " -u <target_user> specify target_user with sudo access. nix-config will be cloned to their home."
|
||||
echo " Default=root."
|
||||
echo " --port <ssh_port> specify the ssh port to use for remote access. Default=${ssh_port}."
|
||||
echo " --debug Enable debug mode."
|
||||
echo " -h | --help Print this help."
|
||||
exit 0
|
||||
}
|
||||
|
||||
# Handle command-line arguments
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
-n)
|
||||
shift
|
||||
target_hostname=$1
|
||||
;;
|
||||
-d)
|
||||
shift
|
||||
target_destination=$1
|
||||
;;
|
||||
-u)
|
||||
shift
|
||||
target_user=$1
|
||||
;;
|
||||
-k)
|
||||
shift
|
||||
ssh_key=$1
|
||||
;;
|
||||
--port)
|
||||
shift
|
||||
ssh_port=$1
|
||||
;;
|
||||
--temp-override)
|
||||
shift
|
||||
temp=$1
|
||||
;;
|
||||
--debug)
|
||||
set -x
|
||||
;;
|
||||
-h | --help) help_and_exit ;;
|
||||
*)
|
||||
red "ERROR: Invalid option detected."
|
||||
help_and_exit
|
||||
;;
|
||||
esac
|
||||
shift
|
||||
done
|
||||
|
||||
if [ -z "$target_hostname" ] || [ -z "$target_destination" ] || [ -z "$ssh_key" ]; then
|
||||
red "ERROR: -n, -d, and -k are all required"
|
||||
echo
|
||||
help_and_exit
|
||||
fi
|
||||
|
||||
# Create the directory where sshd expects to find the host keys
|
||||
install -d -m755 "$tempSSH/persist/etc/ssh"
|
||||
|
||||
# Generate private key and copy it to the temporary directory
|
||||
ssh-keygen -t ed25519 -f "$temp/$persist_dir/etc/ssh/ssh_host_ed25519_key" -C "$target_user"@"$target_hostname" -N ""
|
||||
|
||||
# Set the correct permissions so sshd will accept the key
|
||||
chmod 600 "$temp/persist/etc/ssh/ssh_host_ed25519_key"
|
||||
|
||||
# Install NixOS to the host system with our secrets
|
||||
nix run github:nix-community/nixos-anywhere --extra-experimental-features "nix-command flakes" -- --ssh-port "$ssh_port" --post-kexec-ssh-port "$ssh_port" --extra-files "$temp" --generate-hardware-config nixos-generate-config ./hardware-configuration.nix --disko-mode disko --build-on local --flake .#"$target_hostname" --target-host "$target_user"@"$target_destination"
|
||||
|
||||
@@ -8,7 +8,11 @@
|
||||
"age": [
|
||||
{
|
||||
"recipient": "age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v",
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGZUs1ajViZTM4Smg3a1BU\nU05taWxTUGRzald0cnE3MWt1VzVtMGE0cHlvCnhWbVN0cFNSZDZMcVdXUXVtZUtM\nRzhmK1QvS1R6enNKRnRUdlRLdWhQZjQKLS0tIGJRWElaTWhCbm50Wk1ZRjBUbU5R\nZU9tUjhlR0xwQlU0WnNvQ1FBZGlRQWcK/+Vj6QoktFQ78CxJ8dSQGGqE72fxagA+\n10f60BNlWjWtkIZ2CmcjsDi1zLHny10MaKj9fyRvmBta6Inzra/maA==\n-----END AGE ENCRYPTED FILE-----\n"
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJeFpEeWxyY3hVK0pOMFlV\ndXRhRzRjUUtmK2VpdjZNMDJ2NURDRFZ6WjBFClc3MXR2R3pPVERvUWV4OUpXM2hy\nVm9GTkxMSzRSZW1Lb0Fnbkx5YmFqNTAKLS0tIDBJZFgwQjNXaU5UeFUrWUlhWkRO\nK3QwdlBUSUpiVTVBTnkyM1RNMER6ekkKlzYHGPU9b3tY/37nEOiNgQpJFr5KwnU0\n13VRnL5IPlZuSSHaxDXZYjRas0lMT1LujrI0GSjqB8+Pj3m0nELFBg==\n-----END AGE ENCRYPTED FILE-----\n"
|
||||
},
|
||||
{
|
||||
"recipient": "age1tklxmt3txjjhcsgwy8ejjj20xuq9ca9w522cvan0vwnmq0vdpezsah25pe",
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFY1hRWGowRUExd2VLa2Jh\nY2ZEc053b0lGaGlhSG8zalkwdmZaV1p4NVJFCjdxWGdaVVNrakRGZS92OVdGcndI\nZjNMWG56UURwUm4xZk5Ud2ErWGVxYzQKLS0tIFBTa0szR2pvczFwdGpncXhicTBQ\ndk9nL3ROUk1ROFNRYmlDZytRbkJzSlUKI5dp4LoM/aBz2A+mHCmUy7PoHP3CXFOU\nU4ciuyCV4HFHkDB7NMOsrO3D+7U/xG3gBzglEaws/hrCW7iZNjItUw==\n-----END AGE ENCRYPTED FILE-----\n"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2025-04-17T15:26:55Z",
|
||||
|
||||
@@ -9,7 +9,11 @@
|
||||
"age": [
|
||||
{
|
||||
"recipient": "age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v",
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiSVlXekdnZW02SlpUN0Zq\nS3hzVGtGdkRQRUMrNExqVEFaQnJrVVRNOXhVClJYT2dNVTFuSE9SYnlnSEJmdkUw\nS21pYmRSaFRIVlp5clVST3VTY0YyS1kKLS0tIE9Hd09QWk0xYzBuSzBnU3gzSmFZ\nWUo3T0EyeXUzVjA2SFNFR1QzeW84OUEKObVZ9D7NZPwRXj7OA7EAJtmarT76TnSb\n/SsZ6vU3hQ9Vcn5EIZ39+MpdFluyxZkoq+0di52BHkgExrUD8VD0Lg==\n-----END AGE ENCRYPTED FILE-----\n"
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKY2N5RWIwK21GRjgzVzdQ\nR0V1T3pwTWVCR2hNKzI3UTh2N3phYWFzTGtVCmN2Vlk1eUNCNlFVWWkyNVd2cUta\nYjNPZk4vUkZhSHU1T0cxRTRXVjArelkKLS0tIC9jM2pKSzE4TDJLdGF6OUJDSHZL\nYzdOT255TVZBOE9qYVN0NjZWdFArN0EKMa0cJmuYG4Jo1YqT9J9F6dFzscev+CDA\nzh0JsUbVmlHmjGIwVvrdmj3io/U12CrifnnEYs0oRb+zYMwTvbokFQ==\n-----END AGE ENCRYPTED FILE-----\n"
|
||||
},
|
||||
{
|
||||
"recipient": "age1tklxmt3txjjhcsgwy8ejjj20xuq9ca9w522cvan0vwnmq0vdpezsah25pe",
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZcjlXYVJRNWNvTCs0ODBW\nblJGbEpjOUR2eDJDY0psbFBJMG5ZTitFRTE4CkZMS0ZhZ0Z3T2xXREZrc1VvUkhJ\nblN5SnMvWG5lVmdaMUVUWVRGTFBIKzgKLS0tIEpneFF2cytwa2FISmpScjdudTg5\nc3BvKzFpalIwQzczOUxCYXZnM0xwME0KksEAZTqf/N/FlgXwvHpzZ6U8Zhq2/Yz3\nDBv4A9SQMDhR3lVRxBP4Vw/+GbZ5ZTmGTsbSPqjvSsvT3wtde34Bkg==\n-----END AGE ENCRYPTED FILE-----\n"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2025-04-28T04:15:19Z",
|
||||
|
||||
Reference in New Issue
Block a user