diff options
author | Gregor Kleen <gkleen@yggdrasil.li> | 2021-06-06 21:25:39 +0200 |
---|---|---|
committer | Gregor Kleen <gkleen@yggdrasil.li> | 2021-06-06 21:25:39 +0200 |
commit | bff6acc5b58eec5265182dce7b905d5a5b98976a (patch) | |
tree | 22138607238197c3eb47793e70de6220262a7c9f /system-profiles | |
parent | a57f5e6e4b655abf21430053db013d9a646b5bf8 (diff) | |
download | nixos-bff6acc5b58eec5265182dce7b905d5a5b98976a.tar nixos-bff6acc5b58eec5265182dce7b905d5a5b98976a.tar.gz nixos-bff6acc5b58eec5265182dce7b905d5a5b98976a.tar.bz2 nixos-bff6acc5b58eec5265182dce7b905d5a5b98976a.tar.xz nixos-bff6acc5b58eec5265182dce7b905d5a5b98976a.zip |
rebuild-machines: major cleanup
Diffstat (limited to 'system-profiles')
4 files changed, 88 insertions, 40 deletions
diff --git a/system-profiles/rebuild-machines/default.nix b/system-profiles/rebuild-machines/default.nix index 53bba06b..e2a15aae 100644 --- a/system-profiles/rebuild-machines/default.nix +++ b/system-profiles/rebuild-machines/default.nix | |||
@@ -1,5 +1,21 @@ | |||
1 | { pkgs, hostName, ... }: | 1 | { config, pkgs, hostName, lib, ... }: |
2 | |||
3 | with lib; | ||
4 | |||
2 | let | 5 | let |
6 | cfg = config.system.rebuild-machine; | ||
7 | |||
8 | sshConfig = pkgs.writeText "config" '' | ||
9 | UserKnownHostsFile ${knownHostsFile} | ||
10 | |||
11 | Host ${cfg.repoHost} | ||
12 | User ${cfg.repoUser} | ||
13 | IdentityFile ${if isNull cfg.sopsConfig then cfg.repoPrivkey else config.sops.secrets."${cfg.sopsName}".path} | ||
14 | IdentitiesOnly yes | ||
15 | ''; | ||
16 | |||
17 | knownHostsFile = pkgs.writeText "known_hosts" (concatMapStringsSep "\n" (kPath: cfg.repoHost + " " + readFile kPath) (attrValues cfg.repoPubkeys)); | ||
18 | |||
3 | rebuildScript = pkgs.stdenv.mkDerivation { | 19 | rebuildScript = pkgs.stdenv.mkDerivation { |
4 | name = "rebuild-${hostName}"; | 20 | name = "rebuild-${hostName}"; |
5 | 21 | ||
@@ -9,8 +25,11 @@ let | |||
9 | 25 | ||
10 | phases = [ "buildPhase" "installPhase" ]; | 26 | phases = [ "buildPhase" "installPhase" ]; |
11 | 27 | ||
12 | inherit (pkgs) zsh; | 28 | inherit (pkgs) zsh coreutils openssh; |
13 | inherit hostName; | 29 | inherit (cfg) flake scriptName; |
30 | nixosRebuild = config.system.build.nixos-rebuild; | ||
31 | inherit (config.security) wrapperDir; | ||
32 | inherit sshConfig; | ||
14 | 33 | ||
15 | buildPhase = '' | 34 | buildPhase = '' |
16 | substituteAll $src rebuild-machine.zsh | 35 | substituteAll $src rebuild-machine.zsh |
@@ -18,49 +37,75 @@ let | |||
18 | 37 | ||
19 | installPhase = '' | 38 | installPhase = '' |
20 | mkdir -p $out/bin | 39 | mkdir -p $out/bin |
21 | install -m 0755 rebuild-machine.zsh $out/bin/rebuild-${hostName} | 40 | install -m 0755 rebuild-machine.zsh $out/bin/${cfg.scriptName} |
22 | ''; | 41 | ''; |
23 | }; | 42 | }; |
24 | in { | 43 | in { |
25 | home-manager.users."root" = { | 44 | options = { |
26 | programs.ssh = { | 45 | system.rebuild-machine = { |
27 | enable = true; | 46 | scriptName = mkOption { |
28 | matchBlocks = { | 47 | type = types.str; |
29 | "machines" = { | 48 | default = "rebuild-${hostName}"; |
30 | hostname = "git.yggdrasil.li"; | 49 | description = '' |
31 | user = "gitolite"; | 50 | Name of the script wrapping <literal>nixos-rebuild</literal> |
32 | identityFile = "/root/.ssh/machines"; | 51 | ''; |
33 | }; | 52 | }; |
53 | |||
54 | flake = mkOption { | ||
55 | type = types.nullOr types.str; | ||
56 | default = "git+ssh://${cfg.repoHost}/nixos?ref=flakes#${hostName}"; | ||
57 | description = '' | ||
58 | The Flake URI of the NixOS configuration to build. | ||
59 | ''; | ||
34 | }; | 60 | }; |
35 | }; | ||
36 | }; | ||
37 | 61 | ||
38 | sops.secrets = { | 62 | repoHost = mkOption { |
39 | rebuild-machines = { | 63 | type = types.str; |
40 | path = "/root/.ssh/machines"; | 64 | default = "git.yggdrasil.li"; |
41 | sopsFile = ./ssh + "/${hostName}/private"; | 65 | }; |
42 | format = "binary"; | 66 | |
43 | }; | 67 | repoUser = mkOption { |
44 | }; | 68 | type = types.str; |
69 | default = "gitolite"; | ||
70 | }; | ||
45 | 71 | ||
46 | system.activationScripts.rebuild-machines-publickey = '' | 72 | repoPubkeys = mkOption { |
47 | install -m 0644 ${./ssh + "/${hostName}/public"} /root/.ssh/machines.pub | 73 | type = types.attrsOf types.path; |
48 | ''; | 74 | default = genAttrs ["rsa" "ed25519"] (kType: ./ssh-pub + "/${cfg.repoHost}-${kType}.pub"); |
75 | }; | ||
49 | 76 | ||
50 | environment.systemPackages = [ rebuildScript ]; | 77 | repoPrivkey = mkOption { |
78 | type = types.path; | ||
79 | default = ./ssh + "/${hostName}/private"; | ||
80 | }; | ||
51 | 81 | ||
52 | services.openssh.knownHosts = { | 82 | sopsName = mkOption { |
53 | rsa = { | 83 | type = types.nullOr types.str; |
54 | hostNames = [ "git.yggdrasil.li" ]; | 84 | default = "rebuild-machines"; |
55 | publicKey = '' | 85 | }; |
56 | ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDNr7oFNneR3sVuAhdbnU83PuG6gTU6rDmiz+qykkRUr5Qdtm0NIr9lI7nhoO/MaALWmkMXsBGjvJ2UxvY959g0wQRHJZnuJDwOMo3YJjfuDGMTtp8ikzd646uMHQB+y/xb4dou6f0INr94eRsZcji7AQgZQnyWVV3DZuSADBfNK0Tx6sT6IdbJXaCwYoexnfSfzDdu3i5zMuReF4zdkFUEfAdcbOM8Cr0Abnn4+iLVrof/QaOEuZDC+Pf5QUhkAArETdavSCUIbV6+1md0jz/T8yalgrTCsYOoEUbSPwM/8vmiYDWSo/tvAf3KnVIPjjK2UFz7Qu0HyK0y1dBEXoYLGZ1ep4x67aE4zy7GlR2GZdAYilHknugZB+/kvYGDEixHFfcUh/uvF5PY8sm63C6HUBT1s/aQHXGHgE4uUru6YvbU3UW3fRdslABY/atZ9gc3MuKu9Zk27b1SYfAAoK1R8rKsOKWqUWvvMVCfKBNKqqb7+30q75iGeneB8Tb1C9lToyDG2Yl5p+Gpfnj8YmaU/xFm0HFEC42crRbaQyz01LmupHWf8VwH/O2LsjztAF9b4Oe2q/NwqQAF+h5hIm2tfM2fzxHGCmw1sFYf6dEdkyV5pge/IJrnuQn27iO06tRC6tvrt/ocbpwEEOk/3WWpAWW4oT8L5ceh7iAXrCRWpw== | 86 | |
57 | ''; | 87 | sopsConfig = mkOption { |
88 | type = types.nullOr types.attrs; | ||
89 | default = { | ||
90 | format = "binary"; | ||
91 | }; | ||
92 | }; | ||
58 | }; | 93 | }; |
59 | ed25519 = { | 94 | }; |
60 | hostNames = [ "git.yggdrasil.li" ]; | 95 | |
61 | publicKey = '' | 96 | config = { |
62 | ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDeBBux2bIXnS/RUv+Y/NCpzI/SCW0KOJSzf48KDiEZD | 97 | assertions = [ |
63 | ''; | 98 | { assertion = isNull cfg.sopsConfig || (!(isNull cfg.sopsName)); |
99 | message = "If option sopsConfig is not null option sopsName may not be null"; | ||
100 | } | ||
101 | ]; | ||
102 | |||
103 | sops.secrets = lib.mkIf (!(isNull cfg.sopsConfig)) { | ||
104 | "${cfg.sopsName}" = { | ||
105 | sopsFile = cfg.repoPrivkey; | ||
106 | } // cfg.sopsConfig; | ||
64 | }; | 107 | }; |
108 | |||
109 | environment.systemPackages = [ rebuildScript ]; | ||
65 | }; | 110 | }; |
66 | } | 111 | } |
diff --git a/system-profiles/rebuild-machines/rebuild-machine.zsh b/system-profiles/rebuild-machines/rebuild-machine.zsh index 59df8999..e9e1655f 100644 --- a/system-profiles/rebuild-machines/rebuild-machine.zsh +++ b/system-profiles/rebuild-machines/rebuild-machine.zsh | |||
@@ -1,7 +1,8 @@ | |||
1 | #!@zsh@/bin/zsh -e | 1 | #!@zsh@/bin/zsh -e |
2 | 2 | ||
3 | if [[ $(whoami) != "root" ]]; then | 3 | if [[ $(@coreutils@/bin/whoami) != "root" ]]; then |
4 | exec sudo -H -- $0 $@ | 4 | exec @wrapperDir@/sudo -H -- @out@/bin/@scriptName@ $@ |
5 | fi | 5 | fi |
6 | 6 | ||
7 | exec -- nixos-rebuild --refresh --flake 'git+ssh://machines/nixos?ref=flakes#@hostName@' ${@:-switch} | 7 | export NIX_SSHOPTS="-F @sshConfig@" GIT_SSH_COMMAND="@openssh@/bin/ssh -F @sshConfig@" |
8 | exec -- @nixosRebuild@/bin/nixos-rebuild --refresh --flake '@flake@' ${@:-switch} | ||
diff --git a/system-profiles/rebuild-machines/ssh-pub/git.yggdrasil.li-ed25519.pub b/system-profiles/rebuild-machines/ssh-pub/git.yggdrasil.li-ed25519.pub new file mode 100644 index 00000000..aaf4b012 --- /dev/null +++ b/system-profiles/rebuild-machines/ssh-pub/git.yggdrasil.li-ed25519.pub | |||
@@ -0,0 +1 @@ | |||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDeBBux2bIXnS/RUv+Y/NCpzI/SCW0KOJSzf48KDiEZD | |||
diff --git a/system-profiles/rebuild-machines/ssh-pub/git.yggdrasil.li-rsa.pub b/system-profiles/rebuild-machines/ssh-pub/git.yggdrasil.li-rsa.pub new file mode 100644 index 00000000..7748d3a1 --- /dev/null +++ b/system-profiles/rebuild-machines/ssh-pub/git.yggdrasil.li-rsa.pub | |||
@@ -0,0 +1 @@ | |||
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDNr7oFNneR3sVuAhdbnU83PuG6gTU6rDmiz+qykkRUr5Qdtm0NIr9lI7nhoO/MaALWmkMXsBGjvJ2UxvY959g0wQRHJZnuJDwOMo3YJjfuDGMTtp8ikzd646uMHQB+y/xb4dou6f0INr94eRsZcji7AQgZQnyWVV3DZuSADBfNK0Tx6sT6IdbJXaCwYoexnfSfzDdu3i5zMuReF4zdkFUEfAdcbOM8Cr0Abnn4+iLVrof/QaOEuZDC+Pf5QUhkAArETdavSCUIbV6+1md0jz/T8yalgrTCsYOoEUbSPwM/8vmiYDWSo/tvAf3KnVIPjjK2UFz7Qu0HyK0y1dBEXoYLGZ1ep4x67aE4zy7GlR2GZdAYilHknugZB+/kvYGDEixHFfcUh/uvF5PY8sm63C6HUBT1s/aQHXGHgE4uUru6YvbU3UW3fRdslABY/atZ9gc3MuKu9Zk27b1SYfAAoK1R8rKsOKWqUWvvMVCfKBNKqqb7+30q75iGeneB8Tb1C9lToyDG2Yl5p+Gpfnj8YmaU/xFm0HFEC42crRbaQyz01LmupHWf8VwH/O2LsjztAF9b4Oe2q/NwqQAF+h5hIm2tfM2fzxHGCmw1sFYf6dEdkyV5pge/IJrnuQn27iO06tRC6tvrt/ocbpwEEOk/3WWpAWW4oT8L5ceh7iAXrCRWpw== | |||