144 lines
4.3 KiB
Bash
Executable File
144 lines
4.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
# User variables
|
|
target_hostname=""
|
|
target_destination=""
|
|
target_user=${BOOTSTRAP_USER-root} # Set BOOTSTRAP_ defaults in your shell.nix
|
|
ssh_port=${BOOTSTRAP_SSH_PORT-22}
|
|
|
|
# ---HELPER FUNCTIONS START---
|
|
SOPS_FILE=".sops.yaml"
|
|
|
|
# Updates the .sops.yaml file with a new host age key.
|
|
function sops_update_age_key() {
|
|
keyname="$1"
|
|
key="$2"
|
|
|
|
if [[ -n $(yq ".keys.hosts[] | select(anchor == \"$keyname\")" "${SOPS_FILE}") ]]; then
|
|
echo "Updating existing ${keyname} key"
|
|
yq -i "(.keys.hosts[] | select(anchor == \"$keyname\")) = \"$key\"" "$SOPS_FILE"
|
|
else
|
|
echo "Adding new ${keyname} key"
|
|
yq -i ".keys.hosts += [\"$key\"] | .keys.hosts[-1] anchor = \"$keyname\"" "$SOPS_FILE"
|
|
fi
|
|
}
|
|
|
|
# Update key groups to have new host's sops key
|
|
function sops_add_host_to_key_groups() {
|
|
h="\"$1\"" # quoted hostname for yaml
|
|
|
|
yq -i ".creation_rules.key_groups[].age += [ $h ]" "$SOPS_FILE"
|
|
yq -i ".creation_rules.key_groups[].age[-1] alias = $h" "$SOPS_FILE"
|
|
}
|
|
|
|
# Use generated ssh key generate age key, and update sops
|
|
# args: target_key
|
|
function sops_generate_host_age_key() {
|
|
echo "Generating an age key based on the new ssh_host_ed25519_key"
|
|
|
|
# Get the SSH key
|
|
target_key="$1"
|
|
echo "$target_key"
|
|
host_age_key=$(echo "$target_key" | ssh-to-age)
|
|
|
|
if grep -qv '^age1' <<<"$host_age_key"; then
|
|
echo "The result from generated age key does not match the expected format."
|
|
echo "Result: $host_age_key"
|
|
echo "Expected format: age10000000000000000000000000000000000000000000000000000000000"
|
|
exit 1
|
|
fi
|
|
|
|
echo "Updating nix-secrets/.sops.yaml"
|
|
sops_update_age_key "$target_hostname" "$host_age_key"
|
|
sops_add_host_to_key_groups "$target_hostname"
|
|
}
|
|
|
|
# ---HELPER FUNCTIONS END---
|
|
|
|
# Create a temporary directory
|
|
temp=$(mktemp -d)
|
|
|
|
# Function to cleanup temporary directory on exit
|
|
cleanup() {
|
|
rm -rf "$temp"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
function help_and_exit() {
|
|
echo
|
|
echo "Remotely installs NixOS on a target machine using this nix-config."
|
|
echo
|
|
echo "USAGE: $0 -n <target_hostname> -d <target_destination> [OPTIONS]"
|
|
echo
|
|
echo "ARGS:"
|
|
echo " -n <target_hostname> specify target_hostname of the target host to deploy the nixos config on."
|
|
echo " -d <target_destination> specify ip or domain to the target host."
|
|
echo
|
|
echo "OPTIONS:"
|
|
echo " -u <target_user> specify target_user with sudo access. nix-config will be cloned to their home."
|
|
echo " Default=root."
|
|
echo " --port <ssh_port> specify the ssh port to use for remote access. Default=${ssh_port}."
|
|
echo " --debug Enable debug mode."
|
|
echo " -h | --help Print this help."
|
|
exit 0
|
|
}
|
|
|
|
# Handle command-line arguments
|
|
while [[ $# -gt 0 ]]; do
|
|
case "$1" in
|
|
-n)
|
|
shift
|
|
target_hostname=$1
|
|
;;
|
|
-d)
|
|
shift
|
|
target_destination=$1
|
|
;;
|
|
-u)
|
|
shift
|
|
target_user=$1
|
|
;;
|
|
--port)
|
|
shift
|
|
ssh_port=$1
|
|
;;
|
|
--debug)
|
|
set -x
|
|
;;
|
|
-h | --help) help_and_exit ;;
|
|
*)
|
|
echo "ERROR: Invalid option detected."
|
|
help_and_exit
|
|
;;
|
|
esac
|
|
shift
|
|
done
|
|
|
|
if [ -z "$target_hostname" ] || [ -z "$target_destination" ]; then
|
|
echo "ERROR: -n, -d, and -k are all required"
|
|
echo
|
|
help_and_exit
|
|
fi
|
|
|
|
# delete known hosts
|
|
sed -i "/$target_hostname/d; /$target_destination/d" ~/.ssh/known_hosts
|
|
|
|
# Create the directory where sshd expects to find the host keys
|
|
install -d -m755 "$temp/persist/etc/ssh"
|
|
|
|
# Generate private key and copy it to the temporary directory
|
|
ssh-keygen -t ed25519 -f "$temp/persist/etc/ssh/ssh_host_ed25519_key" -C "$target_user"@"$target_hostname" -N ""
|
|
|
|
# Set the correct permissions so sshd will accept the key
|
|
chmod 600 "$temp/persist/etc/ssh/ssh_host_ed25519_key"
|
|
|
|
# update sops with new host ssh key | age key
|
|
target_key=$(cut -f1- -d" " "$temp/persist/etc/ssh/ssh_host_ed25519_key.pub")
|
|
echo "$target_key"
|
|
sops_generate_host_age_key "$target_key"
|
|
|
|
# Install NixOS to the host system with our secrets
|
|
nix run github:nix-community/nixos-anywhere --extra-experimental-features "nix-command flakes" -- --ssh-port "$ssh_port" --post-kexec-ssh-port "$ssh_port" --extra-files "$temp" --generate-hardware-config nixos-generate-config ./hardware-configuration.nix --disko-mode disko --build-on local --flake .#"$target_hostname" --target-host "$target_user"@"$target_destination"
|
|
|
|
echo "Success"
|