summaryrefslogtreecommitdiff
path: root/system-profiles
diff options
context:
space:
mode:
Diffstat (limited to 'system-profiles')
-rw-r--r--system-profiles/rebuild-machines/default.nix119
-rw-r--r--system-profiles/rebuild-machines/rebuild-machine.zsh7
-rw-r--r--system-profiles/rebuild-machines/ssh-pub/git.yggdrasil.li-ed25519.pub1
-rw-r--r--system-profiles/rebuild-machines/ssh-pub/git.yggdrasil.li-rsa.pub1
4 files changed, 88 insertions, 40 deletions
diff --git a/system-profiles/rebuild-machines/default.nix b/system-profiles/rebuild-machines/default.nix
index 53bba06b..e2a15aae 100644
--- a/system-profiles/rebuild-machines/default.nix
+++ b/system-profiles/rebuild-machines/default.nix
@@ -1,5 +1,21 @@
1{ pkgs, hostName, ... }: 1{ config, pkgs, hostName, lib, ... }:
2
3with lib;
4
2let 5let
6 cfg = config.system.rebuild-machine;
7
8 sshConfig = pkgs.writeText "config" ''
9 UserKnownHostsFile ${knownHostsFile}
10
11 Host ${cfg.repoHost}
12 User ${cfg.repoUser}
13 IdentityFile ${if isNull cfg.sopsConfig then cfg.repoPrivkey else config.sops.secrets."${cfg.sopsName}".path}
14 IdentitiesOnly yes
15 '';
16
17 knownHostsFile = pkgs.writeText "known_hosts" (concatMapStringsSep "\n" (kPath: cfg.repoHost + " " + readFile kPath) (attrValues cfg.repoPubkeys));
18
3 rebuildScript = pkgs.stdenv.mkDerivation { 19 rebuildScript = pkgs.stdenv.mkDerivation {
4 name = "rebuild-${hostName}"; 20 name = "rebuild-${hostName}";
5 21
@@ -9,8 +25,11 @@ let
9 25
10 phases = [ "buildPhase" "installPhase" ]; 26 phases = [ "buildPhase" "installPhase" ];
11 27
12 inherit (pkgs) zsh; 28 inherit (pkgs) zsh coreutils openssh;
13 inherit hostName; 29 inherit (cfg) flake scriptName;
30 nixosRebuild = config.system.build.nixos-rebuild;
31 inherit (config.security) wrapperDir;
32 inherit sshConfig;
14 33
15 buildPhase = '' 34 buildPhase = ''
16 substituteAll $src rebuild-machine.zsh 35 substituteAll $src rebuild-machine.zsh
@@ -18,49 +37,75 @@ let
18 37
19 installPhase = '' 38 installPhase = ''
20 mkdir -p $out/bin 39 mkdir -p $out/bin
21 install -m 0755 rebuild-machine.zsh $out/bin/rebuild-${hostName} 40 install -m 0755 rebuild-machine.zsh $out/bin/${cfg.scriptName}
22 ''; 41 '';
23 }; 42 };
24in { 43in {
25 home-manager.users."root" = { 44 options = {
26 programs.ssh = { 45 system.rebuild-machine = {
27 enable = true; 46 scriptName = mkOption {
28 matchBlocks = { 47 type = types.str;
29 "machines" = { 48 default = "rebuild-${hostName}";
30 hostname = "git.yggdrasil.li"; 49 description = ''
31 user = "gitolite"; 50 Name of the script wrapping <literal>nixos-rebuild</literal>
32 identityFile = "/root/.ssh/machines"; 51 '';
33 }; 52 };
53
54 flake = mkOption {
55 type = types.nullOr types.str;
56 default = "git+ssh://${cfg.repoHost}/nixos?ref=flakes#${hostName}";
57 description = ''
58 The Flake URI of the NixOS configuration to build.
59 '';
34 }; 60 };
35 };
36 };
37 61
38 sops.secrets = { 62 repoHost = mkOption {
39 rebuild-machines = { 63 type = types.str;
40 path = "/root/.ssh/machines"; 64 default = "git.yggdrasil.li";
41 sopsFile = ./ssh + "/${hostName}/private"; 65 };
42 format = "binary"; 66
43 }; 67 repoUser = mkOption {
44 }; 68 type = types.str;
69 default = "gitolite";
70 };
45 71
46 system.activationScripts.rebuild-machines-publickey = '' 72 repoPubkeys = mkOption {
47 install -m 0644 ${./ssh + "/${hostName}/public"} /root/.ssh/machines.pub 73 type = types.attrsOf types.path;
48 ''; 74 default = genAttrs ["rsa" "ed25519"] (kType: ./ssh-pub + "/${cfg.repoHost}-${kType}.pub");
75 };
49 76
50 environment.systemPackages = [ rebuildScript ]; 77 repoPrivkey = mkOption {
78 type = types.path;
79 default = ./ssh + "/${hostName}/private";
80 };
51 81
52 services.openssh.knownHosts = { 82 sopsName = mkOption {
53 rsa = { 83 type = types.nullOr types.str;
54 hostNames = [ "git.yggdrasil.li" ]; 84 default = "rebuild-machines";
55 publicKey = '' 85 };
56 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDNr7oFNneR3sVuAhdbnU83PuG6gTU6rDmiz+qykkRUr5Qdtm0NIr9lI7nhoO/MaALWmkMXsBGjvJ2UxvY959g0wQRHJZnuJDwOMo3YJjfuDGMTtp8ikzd646uMHQB+y/xb4dou6f0INr94eRsZcji7AQgZQnyWVV3DZuSADBfNK0Tx6sT6IdbJXaCwYoexnfSfzDdu3i5zMuReF4zdkFUEfAdcbOM8Cr0Abnn4+iLVrof/QaOEuZDC+Pf5QUhkAArETdavSCUIbV6+1md0jz/T8yalgrTCsYOoEUbSPwM/8vmiYDWSo/tvAf3KnVIPjjK2UFz7Qu0HyK0y1dBEXoYLGZ1ep4x67aE4zy7GlR2GZdAYilHknugZB+/kvYGDEixHFfcUh/uvF5PY8sm63C6HUBT1s/aQHXGHgE4uUru6YvbU3UW3fRdslABY/atZ9gc3MuKu9Zk27b1SYfAAoK1R8rKsOKWqUWvvMVCfKBNKqqb7+30q75iGeneB8Tb1C9lToyDG2Yl5p+Gpfnj8YmaU/xFm0HFEC42crRbaQyz01LmupHWf8VwH/O2LsjztAF9b4Oe2q/NwqQAF+h5hIm2tfM2fzxHGCmw1sFYf6dEdkyV5pge/IJrnuQn27iO06tRC6tvrt/ocbpwEEOk/3WWpAWW4oT8L5ceh7iAXrCRWpw== 86
57 ''; 87 sopsConfig = mkOption {
88 type = types.nullOr types.attrs;
89 default = {
90 format = "binary";
91 };
92 };
58 }; 93 };
59 ed25519 = { 94 };
60 hostNames = [ "git.yggdrasil.li" ]; 95
61 publicKey = '' 96 config = {
62 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDeBBux2bIXnS/RUv+Y/NCpzI/SCW0KOJSzf48KDiEZD 97 assertions = [
63 ''; 98 { assertion = isNull cfg.sopsConfig || (!(isNull cfg.sopsName));
99 message = "If option sopsConfig is not null option sopsName may not be null";
100 }
101 ];
102
103 sops.secrets = lib.mkIf (!(isNull cfg.sopsConfig)) {
104 "${cfg.sopsName}" = {
105 sopsFile = cfg.repoPrivkey;
106 } // cfg.sopsConfig;
64 }; 107 };
108
109 environment.systemPackages = [ rebuildScript ];
65 }; 110 };
66} 111}
diff --git a/system-profiles/rebuild-machines/rebuild-machine.zsh b/system-profiles/rebuild-machines/rebuild-machine.zsh
index 59df8999..e9e1655f 100644
--- a/system-profiles/rebuild-machines/rebuild-machine.zsh
+++ b/system-profiles/rebuild-machines/rebuild-machine.zsh
@@ -1,7 +1,8 @@
1#!@zsh@/bin/zsh -e 1#!@zsh@/bin/zsh -e
2 2
3if [[ $(whoami) != "root" ]]; then 3if [[ $(@coreutils@/bin/whoami) != "root" ]]; then
4 exec sudo -H -- $0 $@ 4 exec @wrapperDir@/sudo -H -- @out@/bin/@scriptName@ $@
5fi 5fi
6 6
7exec -- nixos-rebuild --refresh --flake 'git+ssh://machines/nixos?ref=flakes#@hostName@' ${@:-switch} 7export NIX_SSHOPTS="-F @sshConfig@" GIT_SSH_COMMAND="@openssh@/bin/ssh -F @sshConfig@"
8exec -- @nixosRebuild@/bin/nixos-rebuild --refresh --flake '@flake@' ${@:-switch}
diff --git a/system-profiles/rebuild-machines/ssh-pub/git.yggdrasil.li-ed25519.pub b/system-profiles/rebuild-machines/ssh-pub/git.yggdrasil.li-ed25519.pub
new file mode 100644
index 00000000..aaf4b012
--- /dev/null
+++ b/system-profiles/rebuild-machines/ssh-pub/git.yggdrasil.li-ed25519.pub
@@ -0,0 +1 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDeBBux2bIXnS/RUv+Y/NCpzI/SCW0KOJSzf48KDiEZD
diff --git a/system-profiles/rebuild-machines/ssh-pub/git.yggdrasil.li-rsa.pub b/system-profiles/rebuild-machines/ssh-pub/git.yggdrasil.li-rsa.pub
new file mode 100644
index 00000000..7748d3a1
--- /dev/null
+++ b/system-profiles/rebuild-machines/ssh-pub/git.yggdrasil.li-rsa.pub
@@ -0,0 +1 @@
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDNr7oFNneR3sVuAhdbnU83PuG6gTU6rDmiz+qykkRUr5Qdtm0NIr9lI7nhoO/MaALWmkMXsBGjvJ2UxvY959g0wQRHJZnuJDwOMo3YJjfuDGMTtp8ikzd646uMHQB+y/xb4dou6f0INr94eRsZcji7AQgZQnyWVV3DZuSADBfNK0Tx6sT6IdbJXaCwYoexnfSfzDdu3i5zMuReF4zdkFUEfAdcbOM8Cr0Abnn4+iLVrof/QaOEuZDC+Pf5QUhkAArETdavSCUIbV6+1md0jz/T8yalgrTCsYOoEUbSPwM/8vmiYDWSo/tvAf3KnVIPjjK2UFz7Qu0HyK0y1dBEXoYLGZ1ep4x67aE4zy7GlR2GZdAYilHknugZB+/kvYGDEixHFfcUh/uvF5PY8sm63C6HUBT1s/aQHXGHgE4uUru6YvbU3UW3fRdslABY/atZ9gc3MuKu9Zk27b1SYfAAoK1R8rKsOKWqUWvvMVCfKBNKqqb7+30q75iGeneB8Tb1C9lToyDG2Yl5p+Gpfnj8YmaU/xFm0HFEC42crRbaQyz01LmupHWf8VwH/O2LsjztAF9b4Oe2q/NwqQAF+h5hIm2tfM2fzxHGCmw1sFYf6dEdkyV5pge/IJrnuQn27iO06tRC6tvrt/ocbpwEEOk/3WWpAWW4oT8L5ceh7iAXrCRWpw==