working on bash script to allow remote bootstrapping of sops-nix secrets
This commit is contained in:
+4
-3
@@ -1,8 +1,9 @@
|
|||||||
|
|
||||||
keys:
|
keys:
|
||||||
- &homelab age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v
|
- &laptop age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v
|
||||||
|
- &server age1tklxmt3txjjhcsgwy8ejjj20xuq9ca9w522cvan0vwnmq0vdpezsah25pe
|
||||||
creation_rules:
|
creation_rules:
|
||||||
- path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
|
- path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
|
||||||
key_groups:
|
key_groups:
|
||||||
- age:
|
- age:
|
||||||
- *homelab
|
- *laptop
|
||||||
|
- *server
|
||||||
|
|||||||
@@ -5,7 +5,7 @@ let
|
|||||||
<html>
|
<html>
|
||||||
<head><title>Hello</title></head>
|
<head><title>Hello</title></head>
|
||||||
<body>
|
<body>
|
||||||
<h1>Hello from test.roypository.com 🎉</h1>
|
<h1>Hello from test.roypository.com</h1>
|
||||||
<p>This content is defined in configuration.nix</p>
|
<p>This content is defined in configuration.nix</p>
|
||||||
</body>
|
</body>
|
||||||
</html>
|
</html>
|
||||||
@@ -47,10 +47,13 @@ in
|
|||||||
};
|
};
|
||||||
|
|
||||||
environment.variables = {
|
environment.variables = {
|
||||||
LEAKYKEY = builtins.readFile config.sops.secrets."clusterPassword".path;
|
CP = config.sops.secrets."clusterPassword".path;
|
||||||
|
CAE = config.sops.secrets."cloudflare-api-email".path;
|
||||||
|
CAK = config.sops.secrets."cloudflare-api-key".path;
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.user.services.mbsync.unitConfig.After = [ "sops-nix.service" ];
|
systemd.user.services.mbsync.unitConfig.After = [ "sops-nix.service" ];
|
||||||
|
fileSystems."/persist".neededForBoot = true;
|
||||||
|
|
||||||
# set up DNS with nginx
|
# set up DNS with nginx
|
||||||
security.acme = {
|
security.acme = {
|
||||||
|
|||||||
@@ -8,7 +8,7 @@
|
|||||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||||
];
|
];
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "ehci_pci" "nvme" "sr_mod" ];
|
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "ehci_pci" "nvme" "usbhid" "usb_storage" "sd_mod" "sr_mod" ];
|
||||||
boot.initrd.kernelModules = [ ];
|
boot.initrd.kernelModules = [ ];
|
||||||
boot.kernelModules = [ "kvm-amd" ];
|
boot.kernelModules = [ "kvm-amd" ];
|
||||||
boot.extraModulePackages = [ ];
|
boot.extraModulePackages = [ ];
|
||||||
|
|||||||
Executable
+97
@@ -0,0 +1,97 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
# User variables
|
||||||
|
target_hostname=""
|
||||||
|
target_destination=""
|
||||||
|
target_user=${BOOTSTRAP_USER-root} # Set BOOTSTRAP_ defaults in your shell.nix
|
||||||
|
ssh_port=${BOOTSTRAP_SSH_PORT-22}
|
||||||
|
ssh_key=${BOOTSTRAP_SSH_KEY-}
|
||||||
|
|
||||||
|
# Create a temporary directory
|
||||||
|
temp=$(mktemp -d)
|
||||||
|
|
||||||
|
# Function to cleanup temporary directory on exit
|
||||||
|
cleanup() {
|
||||||
|
rm -rf "$temp"
|
||||||
|
}
|
||||||
|
trap cleanup EXIT
|
||||||
|
|
||||||
|
function help_and_exit() {
|
||||||
|
echo
|
||||||
|
echo "Remotely installs NixOS on a target machine using this nix-config."
|
||||||
|
echo
|
||||||
|
echo "USAGE: $0 -n <target_hostname> -d <target_destination> -k <ssh_key> [OPTIONS]"
|
||||||
|
echo
|
||||||
|
echo "ARGS:"
|
||||||
|
echo " -n <target_hostname> specify target_hostname of the target host to deploy the nixos config on."
|
||||||
|
echo " -d <target_destination> specify ip or domain to the target host."
|
||||||
|
echo " -k <ssh_key> specify the full path to the ssh_key you'll use for remote access to the"
|
||||||
|
echo " target during install process."
|
||||||
|
echo " Example: -k /home/${target_user}/.ssh/my_ssh_key"
|
||||||
|
echo
|
||||||
|
echo "OPTIONS:"
|
||||||
|
echo " -u <target_user> specify target_user with sudo access. nix-config will be cloned to their home."
|
||||||
|
echo " Default=root."
|
||||||
|
echo " --port <ssh_port> specify the ssh port to use for remote access. Default=${ssh_port}."
|
||||||
|
echo " --debug Enable debug mode."
|
||||||
|
echo " -h | --help Print this help."
|
||||||
|
exit 0
|
||||||
|
}
|
||||||
|
|
||||||
|
# Handle command-line arguments
|
||||||
|
while [[ $# -gt 0 ]]; do
|
||||||
|
case "$1" in
|
||||||
|
-n)
|
||||||
|
shift
|
||||||
|
target_hostname=$1
|
||||||
|
;;
|
||||||
|
-d)
|
||||||
|
shift
|
||||||
|
target_destination=$1
|
||||||
|
;;
|
||||||
|
-u)
|
||||||
|
shift
|
||||||
|
target_user=$1
|
||||||
|
;;
|
||||||
|
-k)
|
||||||
|
shift
|
||||||
|
ssh_key=$1
|
||||||
|
;;
|
||||||
|
--port)
|
||||||
|
shift
|
||||||
|
ssh_port=$1
|
||||||
|
;;
|
||||||
|
--temp-override)
|
||||||
|
shift
|
||||||
|
temp=$1
|
||||||
|
;;
|
||||||
|
--debug)
|
||||||
|
set -x
|
||||||
|
;;
|
||||||
|
-h | --help) help_and_exit ;;
|
||||||
|
*)
|
||||||
|
red "ERROR: Invalid option detected."
|
||||||
|
help_and_exit
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
shift
|
||||||
|
done
|
||||||
|
|
||||||
|
if [ -z "$target_hostname" ] || [ -z "$target_destination" ] || [ -z "$ssh_key" ]; then
|
||||||
|
red "ERROR: -n, -d, and -k are all required"
|
||||||
|
echo
|
||||||
|
help_and_exit
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Create the directory where sshd expects to find the host keys
|
||||||
|
install -d -m755 "$tempSSH/persist/etc/ssh"
|
||||||
|
|
||||||
|
# Generate private key and copy it to the temporary directory
|
||||||
|
ssh-keygen -t ed25519 -f "$temp/$persist_dir/etc/ssh/ssh_host_ed25519_key" -C "$target_user"@"$target_hostname" -N ""
|
||||||
|
|
||||||
|
# Set the correct permissions so sshd will accept the key
|
||||||
|
chmod 600 "$temp/persist/etc/ssh/ssh_host_ed25519_key"
|
||||||
|
|
||||||
|
# Install NixOS to the host system with our secrets
|
||||||
|
nix run github:nix-community/nixos-anywhere --extra-experimental-features "nix-command flakes" -- --ssh-port "$ssh_port" --post-kexec-ssh-port "$ssh_port" --extra-files "$temp" --generate-hardware-config nixos-generate-config ./hardware-configuration.nix --disko-mode disko --build-on local --flake .#"$target_hostname" --target-host "$target_user"@"$target_destination"
|
||||||
|
|
||||||
@@ -8,7 +8,11 @@
|
|||||||
"age": [
|
"age": [
|
||||||
{
|
{
|
||||||
"recipient": "age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v",
|
"recipient": "age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v",
|
||||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGZUs1ajViZTM4Smg3a1BU\nU05taWxTUGRzald0cnE3MWt1VzVtMGE0cHlvCnhWbVN0cFNSZDZMcVdXUXVtZUtM\nRzhmK1QvS1R6enNKRnRUdlRLdWhQZjQKLS0tIGJRWElaTWhCbm50Wk1ZRjBUbU5R\nZU9tUjhlR0xwQlU0WnNvQ1FBZGlRQWcK/+Vj6QoktFQ78CxJ8dSQGGqE72fxagA+\n10f60BNlWjWtkIZ2CmcjsDi1zLHny10MaKj9fyRvmBta6Inzra/maA==\n-----END AGE ENCRYPTED FILE-----\n"
|
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJeFpEeWxyY3hVK0pOMFlV\ndXRhRzRjUUtmK2VpdjZNMDJ2NURDRFZ6WjBFClc3MXR2R3pPVERvUWV4OUpXM2hy\nVm9GTkxMSzRSZW1Lb0Fnbkx5YmFqNTAKLS0tIDBJZFgwQjNXaU5UeFUrWUlhWkRO\nK3QwdlBUSUpiVTVBTnkyM1RNMER6ekkKlzYHGPU9b3tY/37nEOiNgQpJFr5KwnU0\n13VRnL5IPlZuSSHaxDXZYjRas0lMT1LujrI0GSjqB8+Pj3m0nELFBg==\n-----END AGE ENCRYPTED FILE-----\n"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"recipient": "age1tklxmt3txjjhcsgwy8ejjj20xuq9ca9w522cvan0vwnmq0vdpezsah25pe",
|
||||||
|
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFY1hRWGowRUExd2VLa2Jh\nY2ZEc053b0lGaGlhSG8zalkwdmZaV1p4NVJFCjdxWGdaVVNrakRGZS92OVdGcndI\nZjNMWG56UURwUm4xZk5Ud2ErWGVxYzQKLS0tIFBTa0szR2pvczFwdGpncXhicTBQ\ndk9nL3ROUk1ROFNRYmlDZytRbkJzSlUKI5dp4LoM/aBz2A+mHCmUy7PoHP3CXFOU\nU4ciuyCV4HFHkDB7NMOsrO3D+7U/xG3gBzglEaws/hrCW7iZNjItUw==\n-----END AGE ENCRYPTED FILE-----\n"
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"lastmodified": "2025-04-17T15:26:55Z",
|
"lastmodified": "2025-04-17T15:26:55Z",
|
||||||
|
|||||||
@@ -9,7 +9,11 @@
|
|||||||
"age": [
|
"age": [
|
||||||
{
|
{
|
||||||
"recipient": "age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v",
|
"recipient": "age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v",
|
||||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiSVlXekdnZW02SlpUN0Zq\nS3hzVGtGdkRQRUMrNExqVEFaQnJrVVRNOXhVClJYT2dNVTFuSE9SYnlnSEJmdkUw\nS21pYmRSaFRIVlp5clVST3VTY0YyS1kKLS0tIE9Hd09QWk0xYzBuSzBnU3gzSmFZ\nWUo3T0EyeXUzVjA2SFNFR1QzeW84OUEKObVZ9D7NZPwRXj7OA7EAJtmarT76TnSb\n/SsZ6vU3hQ9Vcn5EIZ39+MpdFluyxZkoq+0di52BHkgExrUD8VD0Lg==\n-----END AGE ENCRYPTED FILE-----\n"
|
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKY2N5RWIwK21GRjgzVzdQ\nR0V1T3pwTWVCR2hNKzI3UTh2N3phYWFzTGtVCmN2Vlk1eUNCNlFVWWkyNVd2cUta\nYjNPZk4vUkZhSHU1T0cxRTRXVjArelkKLS0tIC9jM2pKSzE4TDJLdGF6OUJDSHZL\nYzdOT255TVZBOE9qYVN0NjZWdFArN0EKMa0cJmuYG4Jo1YqT9J9F6dFzscev+CDA\nzh0JsUbVmlHmjGIwVvrdmj3io/U12CrifnnEYs0oRb+zYMwTvbokFQ==\n-----END AGE ENCRYPTED FILE-----\n"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"recipient": "age1tklxmt3txjjhcsgwy8ejjj20xuq9ca9w522cvan0vwnmq0vdpezsah25pe",
|
||||||
|
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZcjlXYVJRNWNvTCs0ODBW\nblJGbEpjOUR2eDJDY0psbFBJMG5ZTitFRTE4CkZMS0ZhZ0Z3T2xXREZrc1VvUkhJ\nblN5SnMvWG5lVmdaMUVUWVRGTFBIKzgKLS0tIEpneFF2cytwa2FISmpScjdudTg5\nc3BvKzFpalIwQzczOUxCYXZnM0xwME0KksEAZTqf/N/FlgXwvHpzZ6U8Zhq2/Yz3\nDBv4A9SQMDhR3lVRxBP4Vw/+GbZ5ZTmGTsbSPqjvSsvT3wtde34Bkg==\n-----END AGE ENCRYPTED FILE-----\n"
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"lastmodified": "2025-04-28T04:15:19Z",
|
"lastmodified": "2025-04-28T04:15:19Z",
|
||||||
|
|||||||
Reference in New Issue
Block a user