8 files changed, 177 insertions, 0 deletions

diff --git a/system-profiles/rebuild-machines/default.nix b/system-profiles/rebuild-machines/default.nix
new file mode 100644
index 00000000..e2a15aae
--- /dev/null
+++ b/system-profiles/rebuild-machines/default.nix
@@ -0,0 +1,111 @@
+{ config, pkgs, hostName, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.system.rebuild-machine;
+
+  sshConfig = pkgs.writeText "config" ''
+    UserKnownHostsFile ${knownHostsFile}
+
+    Host ${cfg.repoHost}
+      User ${cfg.repoUser}
+      IdentityFile ${if isNull cfg.sopsConfig then cfg.repoPrivkey else config.sops.secrets."${cfg.sopsName}".path}
+      IdentitiesOnly yes
+  '';
+
+  knownHostsFile = pkgs.writeText "known_hosts" (concatMapStringsSep "\n" (kPath: cfg.repoHost + " " + readFile kPath) (attrValues cfg.repoPubkeys));
+  
+  rebuildScript = pkgs.stdenv.mkDerivation {
+    name = "rebuild-${hostName}";
+
+    src = ./rebuild-machine.zsh;
+
+    buildInputs = with pkgs; [ makeWrapper ];
+
+    phases = [ "buildPhase" "installPhase" ];
+
+    inherit (pkgs) zsh coreutils openssh;
+    inherit (cfg) flake scriptName;
+    nixosRebuild = config.system.build.nixos-rebuild;
+    inherit (config.security) wrapperDir;
+    inherit sshConfig;
+
+    buildPhase = ''
+      substituteAll $src rebuild-machine.zsh
+    '';
+
+    installPhase = ''
+      mkdir -p $out/bin
+      install -m 0755 rebuild-machine.zsh $out/bin/${cfg.scriptName}
+    '';
+  };
+in {
+  options = {
+    system.rebuild-machine = {
+      scriptName = mkOption {
+        type = types.str;
+        default = "rebuild-${hostName}";
+        description = ''
+          Name of the script wrapping <literal>nixos-rebuild</literal>
+        '';
+      };
+      
+      flake = mkOption {
+        type = types.nullOr types.str;
+        default = "git+ssh://${cfg.repoHost}/nixos?ref=flakes#${hostName}";
+        description = ''
+          The Flake URI of the NixOS configuration to build.
+        '';
+      };
+
+      repoHost = mkOption {
+        type = types.str;
+        default = "git.yggdrasil.li";
+      };
+      
+      repoUser = mkOption {
+        type = types.str;
+        default = "gitolite";
+      };
+
+      repoPubkeys = mkOption {
+        type = types.attrsOf types.path;
+        default = genAttrs ["rsa" "ed25519"] (kType: ./ssh-pub + "/${cfg.repoHost}-${kType}.pub");
+      };
+
+      repoPrivkey = mkOption {
+        type = types.path;
+        default = ./ssh + "/${hostName}/private";
+      };
+
+      sopsName = mkOption {
+        type = types.nullOr types.str;
+        default = "rebuild-machines";
+      };
+
+      sopsConfig = mkOption {
+        type = types.nullOr types.attrs;
+        default = {
+          format = "binary";
+        };
+      };
+    };
+  };
+  
+  config = {
+    assertions = [
+      { assertion = isNull cfg.sopsConfig || (!(isNull cfg.sopsName));
+        message = "If option sopsConfig is not null option sopsName may not be null";
+      }
+    ];
+    
+    sops.secrets = lib.mkIf (!(isNull cfg.sopsConfig)) {
+      "${cfg.sopsName}" = {
+        sopsFile = cfg.repoPrivkey;
+      } // cfg.sopsConfig;
+    };
+
+    environment.systemPackages = [ rebuildScript ];
+  };
+}
diff --git a/system-profiles/rebuild-machines/rebuild-machine.zsh b/system-profiles/rebuild-machines/rebuild-machine.zsh
new file mode 100644
index 00000000..6420a417
--- /dev/null
+++ b/system-profiles/rebuild-machines/rebuild-machine.zsh
@@ -0,0 +1,10 @@
+#!@zsh@/bin/zsh -e
+
+if [[ $(@coreutils@/bin/whoami) != "root" ]]; then
+    exec @wrapperDir@/sudo -H -- @out@/bin/@scriptName@ $@
+fi
+
+export NIX_SSHOPTS="-F @sshConfig@"
+export GIT_SSH_COMMAND="@openssh@/bin/ssh -F @sshConfig@"
+export GIT_CONFIG_COUNT=0 GIT_CONFIG_KEY_0="init.defaultBranch" GIT_CONFIG_VALUE_0=main
+exec -- @nixosRebuild@/bin/nixos-rebuild --refresh --flake '@flake@' ${@:-switch}
diff --git a/system-profiles/rebuild-machines/ssh-pub/git.yggdrasil.li-ed25519.pub b/system-profiles/rebuild-machines/ssh-pub/git.yggdrasil.li-ed25519.pub
new file mode 100644
index 00000000..aaf4b012
--- /dev/null
+++ b/system-profiles/rebuild-machines/ssh-pub/git.yggdrasil.li-ed25519.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDeBBux2bIXnS/RUv+Y/NCpzI/SCW0KOJSzf48KDiEZD
diff --git a/system-profiles/rebuild-machines/ssh-pub/git.yggdrasil.li-rsa.pub b/system-profiles/rebuild-machines/ssh-pub/git.yggdrasil.li-rsa.pub
new file mode 100644
index 00000000..7748d3a1
--- /dev/null
+++ b/system-profiles/rebuild-machines/ssh-pub/git.yggdrasil.li-rsa.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDNr7oFNneR3sVuAhdbnU83PuG6gTU6rDmiz+qykkRUr5Qdtm0NIr9lI7nhoO/MaALWmkMXsBGjvJ2UxvY959g0wQRHJZnuJDwOMo3YJjfuDGMTtp8ikzd646uMHQB+y/xb4dou6f0INr94eRsZcji7AQgZQnyWVV3DZuSADBfNK0Tx6sT6IdbJXaCwYoexnfSfzDdu3i5zMuReF4zdkFUEfAdcbOM8Cr0Abnn4+iLVrof/QaOEuZDC+Pf5QUhkAArETdavSCUIbV6+1md0jz/T8yalgrTCsYOoEUbSPwM/8vmiYDWSo/tvAf3KnVIPjjK2UFz7Qu0HyK0y1dBEXoYLGZ1ep4x67aE4zy7GlR2GZdAYilHknugZB+/kvYGDEixHFfcUh/uvF5PY8sm63C6HUBT1s/aQHXGHgE4uUru6YvbU3UW3fRdslABY/atZ9gc3MuKu9Zk27b1SYfAAoK1R8rKsOKWqUWvvMVCfKBNKqqb7+30q75iGeneB8Tb1C9lToyDG2Yl5p+Gpfnj8YmaU/xFm0HFEC42crRbaQyz01LmupHWf8VwH/O2LsjztAF9b4Oe2q/NwqQAF+h5hIm2tfM2fzxHGCmw1sFYf6dEdkyV5pge/IJrnuQn27iO06tRC6tvrt/ocbpwEEOk/3WWpAWW4oT8L5ceh7iAXrCRWpw==
diff --git a/system-profiles/rebuild-machines/ssh/sif/private b/system-profiles/rebuild-machines/ssh/sif/private
new file mode 100644
index 00000000..ffac520a
--- /dev/null
+++ b/system-profiles/rebuild-machines/ssh/sif/private
@@ -0,0 +1,26 @@
+{
+        "data": "ENC[AES256_GCM,data:8AhUuD0/SiwXAv3nD+nzJPUtf67O9/wcyY1Iu/RCMzqKOs6iRTLlcvxyOtirUUtKRc7QECpX/TQ/K6PFo/0FKrNWn/aVCb0TnZFucL5UXsjO6TDnLWV7x+Huvcgj3RmEi4l24S/NBDuo7RtBBDByfaegavBRkx9NuFiYD16YVrQgvqL8owzXBTSmwfnlTNmRv2tsZzEbaaxRzgRf8USbks7bHWeEMOJ1Lx7svPm5GgARm+6N+wwXmsyDCXiRCOu54bHftUPh0lOKLw6Nggnn8vDgv1OJLemwtrMr7vZ0wZ8NWwYDfHr0FyYI/0isCpDXzFvtFd8XsXCOQxD29QM1C1CdSbavnBcc4UMoKoJzBeBHFlqqMSLrHDmFSKet+rr8nTu2ZKEyHq0C8T/h4sBXdrOF2G7GGEdohL/9sy9yrNgvvYRBv/85uieV3qr8OQ8dhmR4Cj1DucLROslLW9/QOp12Z8wcDRbA185Vh2SnYEF+K+EPYlEV3SBLLl3GxOT2cjUHefBEl727lgNdh2gYxIpMTYxTMum7cosv,iv:y97GnUb2wyIHP3Nj+/VkHbC3nwegrKnAipp33tjFLE4=,tag:u01az3q8edvpQ52k9SQL1w==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": null,
+                "lastmodified": "2021-06-06T15:05:54Z",
+                "mac": "ENC[AES256_GCM,data:Cf8WbqV4bqkg+W84hRSjMsrqzV7QZqAJeU/DrlN94NRaLDbayXK/kbxz9gMWY6Eyv3D70ulc75EBojZF1SXfk/WpDHpVJ4DEizb28oIfE4x88MmQ7ZJuskqXQaFa4MohJVQ/7ukr9bTjNMm7RFtq+yNKkIy6mj2YBk6BYsPgwic=,iv:kq+FpwQEWJo18QEEqG1uZ3uJ1MpklqN7Oaj0fPw8/0k=,tag:FYHLHjzeD+28KHD7x5JwGA==,type:str]",
+                "pgp": [
+                        {
+                                "created_at": "2021-06-06T15:05:54Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAO0QzeTgAkvdr+w43Yk9a0X1AmwQd1b1CFPNbINQbvSww\noa85a30JfMy9r2LRfTd9S8sd7rAfOaRCaPrJVWHQBXd0s36Ux8gSktcAM+PzYBCE\n0l4BkVI6bLaO756h5ru+gANRuqMRKgpV8PB3PMmIlhinUAZFsmNJb1T1O13JkMsM\nMuygJ8cg8LukjEeXM7jnWO52cX1NcoquhJK7f0eVvFMNW3Iexf9pI0XC0iSYW69B\n=lQQZ\n-----END PGP MESSAGE-----\n",
+                                "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51"
+                        },
+                        {
+                                "created_at": "2021-06-06T15:05:54Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4Dgwm4NZSaLAcSAQdANW63iv/Mn2irKYdSZxX7iwIPyDGmGDUDUnbWEgel/jcw\nLILXuiWOkgfG2G4tvqdM4AHkYoKEA1mAfH9ybFJMhiS12WI60or6Z8e0cd23mteo\n0l4BU7FiVt9p8/96qJlVuGUS3GRlhnczFN9GIBaj9BkzuifFbC+S4iphvO6u59m1\nGodFjFZ5ayfvgSRLb93DN7cGUfhcZ80oQHSiuJxFC7I0xnTcg/LKxYvX49yHE6/I\n=63VB\n-----END PGP MESSAGE-----\n",
+                                "fp": "F1AF20B9511B63F681A14E8D51AEFBCD1DEF68F8"
+                        }
+                ],
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.7.1"
+        }
+}
\ No newline at end of file
diff --git a/system-profiles/rebuild-machines/ssh/sif/public b/system-profiles/rebuild-machines/ssh/sif/public
new file mode 100644
index 00000000..fa3eeefb
--- /dev/null
+++ b/system-profiles/rebuild-machines/ssh/sif/public
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINj5I8YSEwS+44YDksxm5JgrmOvz+Jhzj2tWFUWT9z+M rebuild-machines@sif
diff --git a/system-profiles/rebuild-machines/ssh/surtr/private b/system-profiles/rebuild-machines/ssh/surtr/private
new file mode 100644
index 00000000..40651674
--- /dev/null
+++ b/system-profiles/rebuild-machines/ssh/surtr/private
@@ -0,0 +1,26 @@
+{
+        "data": "ENC[AES256_GCM,data:6iBi0nQMKJccWxpWkJcWIdpQ4qitMgewFs0LAUU7PFH268hoCkmiWgfq+ZJ1E4hfgAMqTmiS+FJUnYyAGaHHghPCMjHLaNaoS25GjQM3S0pUFd56zGipP0xkii4HaiEGEpcxmXuGHnfrJgJZIHSsl8KRaLRJUKmIl7uorN0nGo6A2R+DKljExXRpH/ZSZj5dCoTu8tVCwnKxgDh9rDhEKCYIl1XnTKV8U8KeT9M7KJt6VWA5mmYhziv0No2U8g22T1ZQP+ATIqGXzbDUDEjY+kg7q6Om0ZsWBL2mJ7U88V/BBMymeYrJiawxrjXzG1VtsnMC7pn8F5BgHCz8x3lUIi2/wlWdqKEUp+TuKEMeuGLdaAifdeFKG/qnFBtNQLxcScvilXAH4w2L+yjCnJbdKoGk1GdJl1U/a2lEXmzbwSQ7Gxlq2rSDpTRW91Gr6I/JXJS6vpq8XRv1faHDGGW+AuNArP9P85/d/S7Fv/UeRQ7vNi30ePG6LjTN+0ajhqwv2YEocArFj+1I8vY3RSQ0PVj27Cwcc582BBmhRZNccgI7AL8=,iv:IwcMztAFDpOE23dYEzjJiv6qhk9E0/Qb/xgwbtt9xt0=,tag:qYMBaoUtkUDR1taehr7Y/g==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": null,
+                "lastmodified": "2021-05-15T17:58:53Z",
+                "mac": "ENC[AES256_GCM,data:N/CM/+4b02tRBFqFioX/FRPPj4bG3QGltIg7KZk7BYrl+5rJ/6QKL1g+CqsLTteRAbHiluBNFMT/dUBSmiQ+So95sUTc+rICRNKmxCX5GFxw3Kr5/y4r9W/sw/NOSXQD4+dctkhKmzg9NFR+T4pLM8W4KErtV384Wy3ccAW/g8g=,iv:Rr4rDloQRRsLTErUNbB1OIKbi5qyh2gU1y55sU7ecTY=,tag:sYHPOKcAWNfjz26X+w4r3g==,type:str]",
+                "pgp": [
+                        {
+                                "created_at": "2021-05-15T17:58:52Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAJOYE8FC5GREn7xoQfuSMvow0GwajGfi4bw+FEydrDhAw\n+F8ryseAyQPgVouzlO2aItBy20dYYNs6zkcfnuZemDdBSpQQmahtXBs5Dt3wGhvg\n0l4BPJeJ3cpuLDQMFnNfTOLJRdoR0kvxVHJBBYJ+Jn4ArPrpiMReJvyLl7i83wDb\nsb+WCcu83IFLM/oInb22cto3shATTLgr30hq65+RwAXlGBNmoAT0HH9MDsgq+VQw\n=nsV9\n-----END PGP MESSAGE-----\n",
+                                "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51"
+                        },
+                        {
+                                "created_at": "2021-05-15T17:58:52Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdA12ftTan1dZSX50t5H1/LdTse+nhePZS6RxqV7WcRi04w\nyiqJt+C6AFBZl4esCqHQjpPnmkb5pvI2/P9e8bvK8uszIF35KC+r55LAaB2RXkr2\n0l4BX0fPwE6XNtiBn2hQo7KYnci6s25itij+uppRyu6Cnc3Hi4Emro4MFBBJlot8\no773ulk8jmOeR2k9fLDSMQ0EO+3zZbm7zz/fK46SyFzBIAPvCx0fEpXi0ZdLES2k\n=rULf\n-----END PGP MESSAGE-----\n",
+                                "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8"
+                        }
+                ],
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.7.1"
+        }
+}
\ No newline at end of file
diff --git a/system-profiles/rebuild-machines/ssh/surtr/public b/system-profiles/rebuild-machines/ssh/surtr/public
new file mode 100644
index 00000000..323e8398
--- /dev/null
+++ b/system-profiles/rebuild-machines/ssh/surtr/public
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM5HJRwdwtmIqx8HRK0AKIq+vSCHvGv98rOmraSGwnTL rebuild-machines@surtr