nixops/scripts/setup

   1 #!/bin/bash
   2
   3 set -euo pipefail
   4
   5 RemoteRepo="gitolite@git.immae.eu:perso/Immae/Prive/Password_store/Sites"
   6 DeploymentUuid="cef694f3-081d-11e9-b31f-0242ec186adf"
   7
   8 if ! which nix 2>/dev/null >/dev/null; then
   9   cat <<-EOF
  10         nix is needed, please install it:
  11         > curl https://nixos.org/nix/install | sh
  12         (or any other way handled by your distribution)
  13         EOF
  14   exit 1
  15 fi
  16
  17 if [ "${NIX_STORE:-/nix/store}" != "/nix/store" ]; then
  18   cat <<-EOF
  19         Nix store outside of /nix/store is not supported
  20         EOF
  21   exit 1
  22 fi
  23
  24 if [ -z "$NIXOPS_CONFIG_PASS_SUBTREE_REMOTE" \
  25     -o -z "$NIXOPS_CONFIG_PASS_SUBTREE_PATH" ]; then
  26   cat <<-EOF
  27         Two environment variables are needed to setup the password store:
  28         NIXOPS_CONFIG_PASS_SUBTREE_PATH : path where the subtree will be imported
  29         NIXOPS_CONFIG_PASS_SUBTREE_REMOTE : remote name to give to the repository
  30         EOF
  31   exit 1
  32 fi
  33
  34 if ! pass $NIXOPS_CONFIG_PASS_SUBTREE_PATH > /dev/null 2>/dev/null; then
  35   cat <<-EOF
  36         /!\ This will modify your password store to add and import a subtree
  37         with the specific passwords files. Choose a path that doesn’t exist
  38         yet in your password store.
  39         > pass git remote add $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE $RemoteRepo
  40         > pass git subtree add --prefix=$NIXOPS_CONFIG_PASS_SUBTREE_PATH $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE master
  41         Later, you can use pull_environment and push_environment scripts to
  42         update the passwords when needed
  43         Continue? [y/N]
  44         EOF
  45   read y
  46   if [ "$y" = "y" -o "$y" = "Y" ]; then
  47     pass git remote add $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE $RemoteRepo
  48     pass git subtree add --prefix=$NIXOPS_CONFIG_PASS_SUBTREE_PATH $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE master
  49   else
  50     echo "Aborting"
  51     exit 1
  52   fi
  53 fi
  54
  55 # Repull it before using it, just in case
  56 pass git subtree pull --prefix=$NIXOPS_CONFIG_PASS_SUBTREE_PATH $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE master
  57
  58 gpg_keys=$(pass ls $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/GPGKeys | sed -e "1d" | cut -d" " -f2)
  59 for key in $gpg_keys; do
  60   content=$(pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/GPGKeys/$key)
  61   fpr=$(echo "$content" | gpg --import-options show-only --import --with-colons | grep -e "^pub" | cut -d':' -f5)
  62   gpg --list-key "$fpr" >/dev/null 2>/dev/null && imported=yes || imported=no
  63   # /usr/share/doc/gnupg/DETAILS field 2
  64   (echo "$content" | gpg --import-options show-only --import --with-colons |
  65       grep -E '^pub:' |
  66       cut -d':' -f2 |
  67       grep -q '[fu]') && signed=yes || signed=no
  68   if [ "$signed" = no -o "$imported" = no ] ; then
  69     echo "The key for $key needs to be imported and signed (a local signature is enough)"
  70     echo "$content" | gpg --import-options show-only --import
  71     echo "Continue? [y/N]"
  72     read y
  73     if [ "$y" = "y" -o "$y" = "Y" ]; then
  74       echo "$content" | gpg --import
  75       gpg --expert --edit-key "$fpr" lsign quit
  76     else
  77       echo "Aborting"
  78       exit 1
  79     fi
  80   fi
  81 done
  82
  83 nix_group=$(stat -c %G /nix/store)
  84 if [ "$nix_group" = "nixbld" ]; then
  85   nix_user="nixbld1"
  86 else
  87   nix_user="$(stat -c %U /nix/store)"
  88 fi
  89
  90 if [ ! -f /etc/ssh/ssh_rsa_key_nixops ]; then
  91   cat <<-EOF
  92         The key to access private git repositories (websites hosted by the
  93         server) needs to be accessible to nix builders. It will be put in
  94         /etc/ssh/ssh_rsa_key_nixops (sudo right is needed for that)
  95         > pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/SshKey | sudo tee /etc/ssh/ssh_rsa_key_nixops > /dev/null
  96         > pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/SshKey.pub | sudo tee /etc/ssh/ssh_rsa_key_nixops.pub > /dev/null
  97         > sudo chmod u=r,go-rwx /etc/ssh/ssh_rsa_key_nixops
  98         > sudo chown $nix_user:$nix_group /etc/ssh/ssh_rsa_key_nixops /etc/ssh/ssh_rsa_key_nixops.pub
  99         Continue? [y/N]
 100         EOF
 101   read y
 102   if [ "$y" = "y" -o "$y" = "Y" ]; then
 103     if ! id -u $nix_user 2>/dev/null >/dev/null; then
 104       echo "User $nix_user seems inexistant, did you install nix?"
 105       exit 1
 106     fi
 107     mask=$(umask)
 108     umask 0777
 109     # Don’t forward it directly to tee, it would break ncurse pinentry
 110     key=$(pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/SshKey)
 111     echo "$key" | sudo tee /etc/ssh/ssh_rsa_key_nixops > /dev/null
 112     sudo chmod u=r,go=- /etc/ssh/ssh_rsa_key_nixops
 113     pubkey=$(pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/SshKey.pub)
 114     echo "$pubkey" | sudo tee /etc/ssh/ssh_rsa_key_nixops.pub > /dev/null
 115     sudo chmod a=r /etc/ssh/ssh_rsa_key_nixops.pub
 116     sudo chown $nix_user:$nix_group /etc/ssh/ssh_rsa_key_nixops /etc/ssh/ssh_rsa_key_nixops.pub
 117     umask $mask
 118   else
 119     echo "Aborting"
 120     exit 1
 121   fi
 122 fi
 123
 124 if nix show-config --json | jq -e '.sandbox.value == "true"' >/dev/null; then
 125   cat <<-EOF
 126         There are some impure derivations in the repo currently (grep __noChroot), please put
 127           sandbox = "relaxed"
 128         in /etc/nix/nix.conf
 129         you may also want to add
 130           keep-outputs = true
 131           keep-derivations = true
 132         to prevent garbage collector from deleting build dependencies (they take a lot of time to build)
 133         EOF
 134   exit 1
 135 fi
 136
 137 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 138 source $(dirname $(dirname $DIR))/nix_path_env
 139 nixops="$(nix-build --no-out-link "$(dirname $DIR)/custom_nixops.nix")/bin/nixops"
 140 export NIXOPS_STATE="$(dirname $DIR)/state/eldiron.nixops"
 141 export NIXOPS_DEPLOYMENT="$DeploymentUuid"
 142
 143 if ! $nixops info 2>/dev/null >/dev/null; then
 144   cat <<-EOF
 145         Importing deployment file into nixops:
 146         Continue? [y/N]
 147         EOF
 148   read y
 149   if [ "$y" = "y" -o "$y" = "Y" ]; then
 150     deployment=$(pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/Deployment)
 151     echo "$deployment" | $nixops import
 152
 153     $nixops modify "$(dirname $DIR)/eldiron.nix"
 154   else
 155     echo "Aborting"
 156     exit 1
 157   fi
 158 fi
 159
 160 cat <<-EOF
 161         All set up.
 162         Please make sure you’re using scripts/nixops_wrap when deploying
 163         EOF