From 76daf3ac0aa3399d7fcfbadc35c14ed2d0bbe952 Mon Sep 17 00:00:00 2001 From: Gregor Kleen Date: Sat, 15 May 2021 20:00:21 +0200 Subject: rebuild-machines --- system-profiles/rebuild-machines/default.nix | 66 ++++++++++++++++++++++ .../rebuild-machines/rebuild-machine.zsh | 9 +++ system-profiles/rebuild-machines/ssh/surtr/private | 26 +++++++++ system-profiles/rebuild-machines/ssh/surtr/public | 1 + 4 files changed, 102 insertions(+) create mode 100644 system-profiles/rebuild-machines/default.nix create mode 100644 system-profiles/rebuild-machines/rebuild-machine.zsh create mode 100644 system-profiles/rebuild-machines/ssh/surtr/private create mode 100644 system-profiles/rebuild-machines/ssh/surtr/public (limited to 'system-profiles') diff --git a/system-profiles/rebuild-machines/default.nix b/system-profiles/rebuild-machines/default.nix new file mode 100644 index 00000000..53bba06b --- /dev/null +++ b/system-profiles/rebuild-machines/default.nix @@ -0,0 +1,66 @@ +{ pkgs, hostName, ... }: +let + rebuildScript = pkgs.stdenv.mkDerivation { + name = "rebuild-${hostName}"; + + src = ./rebuild-machine.zsh; + + buildInputs = with pkgs; [ makeWrapper ]; + + phases = [ "buildPhase" "installPhase" ]; + + inherit (pkgs) zsh; + inherit hostName; + + buildPhase = '' + substituteAll $src rebuild-machine.zsh + ''; + + installPhase = '' + mkdir -p $out/bin + install -m 0755 rebuild-machine.zsh $out/bin/rebuild-${hostName} + ''; + }; +in { + home-manager.users."root" = { + programs.ssh = { + enable = true; + matchBlocks = { + "machines" = { + hostname = "git.yggdrasil.li"; + user = "gitolite"; + identityFile = "/root/.ssh/machines"; + }; + }; + }; + }; + + sops.secrets = { + rebuild-machines = { + path = "/root/.ssh/machines"; + sopsFile = ./ssh + "/${hostName}/private"; + format = "binary"; + }; + }; + + system.activationScripts.rebuild-machines-publickey = '' + install -m 0644 ${./ssh + "/${hostName}/public"} /root/.ssh/machines.pub + ''; + + environment.systemPackages = [ rebuildScript ]; + + services.openssh.knownHosts = { + rsa = { + hostNames = [ "git.yggdrasil.li" ]; + publicKey = '' + ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDNr7oFNneR3sVuAhdbnU83PuG6gTU6rDmiz+qykkRUr5Qdtm0NIr9lI7nhoO/MaALWmkMXsBGjvJ2UxvY959g0wQRHJZnuJDwOMo3YJjfuDGMTtp8ikzd646uMHQB+y/xb4dou6f0INr94eRsZcji7AQgZQnyWVV3DZuSADBfNK0Tx6sT6IdbJXaCwYoexnfSfzDdu3i5zMuReF4zdkFUEfAdcbOM8Cr0Abnn4+iLVrof/QaOEuZDC+Pf5QUhkAArETdavSCUIbV6+1md0jz/T8yalgrTCsYOoEUbSPwM/8vmiYDWSo/tvAf3KnVIPjjK2UFz7Qu0HyK0y1dBEXoYLGZ1ep4x67aE4zy7GlR2GZdAYilHknugZB+/kvYGDEixHFfcUh/uvF5PY8sm63C6HUBT1s/aQHXGHgE4uUru6YvbU3UW3fRdslABY/atZ9gc3MuKu9Zk27b1SYfAAoK1R8rKsOKWqUWvvMVCfKBNKqqb7+30q75iGeneB8Tb1C9lToyDG2Yl5p+Gpfnj8YmaU/xFm0HFEC42crRbaQyz01LmupHWf8VwH/O2LsjztAF9b4Oe2q/NwqQAF+h5hIm2tfM2fzxHGCmw1sFYf6dEdkyV5pge/IJrnuQn27iO06tRC6tvrt/ocbpwEEOk/3WWpAWW4oT8L5ceh7iAXrCRWpw== + ''; + }; + ed25519 = { + hostNames = [ "git.yggdrasil.li" ]; + publicKey = '' + ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDeBBux2bIXnS/RUv+Y/NCpzI/SCW0KOJSzf48KDiEZD + ''; + }; + }; +} diff --git a/system-profiles/rebuild-machines/rebuild-machine.zsh b/system-profiles/rebuild-machines/rebuild-machine.zsh new file mode 100644 index 00000000..80cc7a2f --- /dev/null +++ b/system-profiles/rebuild-machines/rebuild-machine.zsh @@ -0,0 +1,9 @@ +#!@zsh@/bin/zsh + +set -o errexit + +if [[ $(whoami) != "root" ]]; then + exec sudo -H -- $0 $@ +fi + +exec nixos-rebuild --refresh --flake 'git+ssh://machines/nixos?ref=flakes#@hostName@' ${@:-switch} diff --git a/system-profiles/rebuild-machines/ssh/surtr/private b/system-profiles/rebuild-machines/ssh/surtr/private new file mode 100644 index 00000000..40651674 --- /dev/null +++ b/system-profiles/rebuild-machines/ssh/surtr/private @@ -0,0 +1,26 @@ +{ + "data": "ENC[AES256_GCM,data:6iBi0nQMKJccWxpWkJcWIdpQ4qitMgewFs0LAUU7PFH268hoCkmiWgfq+ZJ1E4hfgAMqTmiS+FJUnYyAGaHHghPCMjHLaNaoS25GjQM3S0pUFd56zGipP0xkii4HaiEGEpcxmXuGHnfrJgJZIHSsl8KRaLRJUKmIl7uorN0nGo6A2R+DKljExXRpH/ZSZj5dCoTu8tVCwnKxgDh9rDhEKCYIl1XnTKV8U8KeT9M7KJt6VWA5mmYhziv0No2U8g22T1ZQP+ATIqGXzbDUDEjY+kg7q6Om0ZsWBL2mJ7U88V/BBMymeYrJiawxrjXzG1VtsnMC7pn8F5BgHCz8x3lUIi2/wlWdqKEUp+TuKEMeuGLdaAifdeFKG/qnFBtNQLxcScvilXAH4w2L+yjCnJbdKoGk1GdJl1U/a2lEXmzbwSQ7Gxlq2rSDpTRW91Gr6I/JXJS6vpq8XRv1faHDGGW+AuNArP9P85/d/S7Fv/UeRQ7vNi30ePG6LjTN+0ajhqwv2YEocArFj+1I8vY3RSQ0PVj27Cwcc582BBmhRZNccgI7AL8=,iv:IwcMztAFDpOE23dYEzjJiv6qhk9E0/Qb/xgwbtt9xt0=,tag:qYMBaoUtkUDR1taehr7Y/g==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": null, + "lastmodified": "2021-05-15T17:58:53Z", + "mac": "ENC[AES256_GCM,data:N/CM/+4b02tRBFqFioX/FRPPj4bG3QGltIg7KZk7BYrl+5rJ/6QKL1g+CqsLTteRAbHiluBNFMT/dUBSmiQ+So95sUTc+rICRNKmxCX5GFxw3Kr5/y4r9W/sw/NOSXQD4+dctkhKmzg9NFR+T4pLM8W4KErtV384Wy3ccAW/g8g=,iv:Rr4rDloQRRsLTErUNbB1OIKbi5qyh2gU1y55sU7ecTY=,tag:sYHPOKcAWNfjz26X+w4r3g==,type:str]", + "pgp": [ + { + "created_at": "2021-05-15T17:58:52Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAJOYE8FC5GREn7xoQfuSMvow0GwajGfi4bw+FEydrDhAw\n+F8ryseAyQPgVouzlO2aItBy20dYYNs6zkcfnuZemDdBSpQQmahtXBs5Dt3wGhvg\n0l4BPJeJ3cpuLDQMFnNfTOLJRdoR0kvxVHJBBYJ+Jn4ArPrpiMReJvyLl7i83wDb\nsb+WCcu83IFLM/oInb22cto3shATTLgr30hq65+RwAXlGBNmoAT0HH9MDsgq+VQw\n=nsV9\n-----END PGP MESSAGE-----\n", + "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51" + }, + { + "created_at": "2021-05-15T17:58:52Z", + "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdA12ftTan1dZSX50t5H1/LdTse+nhePZS6RxqV7WcRi04w\nyiqJt+C6AFBZl4esCqHQjpPnmkb5pvI2/P9e8bvK8uszIF35KC+r55LAaB2RXkr2\n0l4BX0fPwE6XNtiBn2hQo7KYnci6s25itij+uppRyu6Cnc3Hi4Emro4MFBBJlot8\no773ulk8jmOeR2k9fLDSMQ0EO+3zZbm7zz/fK46SyFzBIAPvCx0fEpXi0ZdLES2k\n=rULf\n-----END PGP MESSAGE-----\n", + "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8" + } + ], + "unencrypted_suffix": "_unencrypted", + "version": "3.7.1" + } +} \ No newline at end of file diff --git a/system-profiles/rebuild-machines/ssh/surtr/public b/system-profiles/rebuild-machines/ssh/surtr/public new file mode 100644 index 00000000..323e8398 --- /dev/null +++ b/system-profiles/rebuild-machines/ssh/surtr/public @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM5HJRwdwtmIqx8HRK0AKIq+vSCHvGv98rOmraSGwnTL rebuild-machines@surtr -- cgit v1.2.3