nixops/scripts/setup

   1 #!/bin/bash
   2
   3 set -euo pipefail
   4
   5 RemoteRepo="gitolite@git.immae.eu:perso/Immae/Prive/Password_store/Sites"
   6 DeploymentUuid="cef694f3-081d-11e9-b31f-0242ec186adf"
   7
   8 if ! which nix 2>/dev/null >/dev/null; then
   9   cat <<-EOF
  10         nix is needed, please install it:
  11         > curl https://nixos.org/nix/install | sh
  12         (or any other way handled by your distribution)
  13         EOF
  14   exit 1
  15 fi
  16
  17 if [ "${NIX_STORE:-/nix/store}" != "/nix/store" ]; then
  18   cat <<-EOF
  19         Nix store outside of /nix/store is not supported
  20         EOF
  21   exit 1
  22 fi
  23
  24 if [ -z "$NIXOPS_CONFIG_PASS_SUBTREE_REMOTE" \
  25     -o -z "$NIXOPS_CONFIG_PASS_SUBTREE_PATH" ]; then
  26   cat <<-EOF
  27         Two environment variables are needed to setup the password store:
  28         NIXOPS_CONFIG_PASS_SUBTREE_PATH : path where the subtree will be imported
  29         NIXOPS_CONFIG_PASS_SUBTREE_REMOTE : remote name to give to the repository
  30         EOF
  31   exit 1
  32 fi
  33
  34 if ! pass $NIXOPS_CONFIG_PASS_SUBTREE_PATH > /dev/null 2>/dev/null; then
  35   cat <<-EOF
  36         /!\ This will modify your password store to add and import a subtree
  37         with the specific passwords files. Choose a path that doesn’t exist
  38         yet in your password store.
  39         > pass git remote add $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE $RemoteRepo
  40         > pass git subtree add --prefix=$NIXOPS_CONFIG_PASS_SUBTREE_PATH $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE master
  41         Later, you can use pull_environment and push_environment scripts to
  42         update the passwords when needed
  43         Continue? [y/N]
  44         EOF
  45   read y
  46   if [ "$y" = "y" -o "$y" = "Y" ]; then
  47     pass git remote add $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE $RemoteRepo
  48     pass git subtree add --prefix=$NIXOPS_CONFIG_PASS_SUBTREE_PATH $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE master
  49   else
  50     echo "Aborting"
  51     exit 1
  52   fi
  53 fi
  54
  55 # Repull it before using it, just in case
  56 pass git subtree pull --prefix=$NIXOPS_CONFIG_PASS_SUBTREE_PATH $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE master
  57
  58 gpg_keys=$(pass ls $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/GPGKeys | sed -e "1d" | cut -d" " -f2)
  59 for key in $gpg_keys; do
  60   content=$(pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/GPGKeys/$key)
  61   fpr=$(echo "$content" | gpg --import-options show-only --import --with-colons | grep -e "^pub" | cut -d':' -f5)
  62   gpg --list-key "$fpr" >/dev/null 2>/dev/null && imported=yes || imported=no
  63   # /usr/share/doc/gnupg/DETAILS field 2
  64   (echo "$content" | gpg --import-options show-only --import --with-colons |
  65       grep -E '^pub:' |
  66       cut -d':' -f2 |
  67       grep -q '[fu]') && signed=yes || signed=no
  68   if [ "$signed" = no -o "$imported" = no ] ; then
  69     echo "The key for $key needs to be imported and signed (a local signature is enough)"
  70     echo "$content" | gpg --import-options show-only --import
  71     echo "Continue? [y/N]"
  72     read y
  73     if [ "$y" = "y" -o "$y" = "Y" ]; then
  74       echo "$content" | gpg --import
  75       gpg --expert --edit-key "$fpr" lsign quit
  76     else
  77       echo "Aborting"
  78       exit 1
  79     fi
  80   fi
  81 done
  82
  83 if nix show-config --json | jq -e '.sandbox.value == "true"' >/dev/null; then
  84   cat <<-EOF
  85         There are some impure derivations in the repo currently (grep __noChroot), please put
  86           sandbox = "relaxed"
  87         in /etc/nix/nix.conf
  88         you may also want to add
  89           keep-outputs = true
  90           keep-derivations = true
  91         to prevent garbage collector from deleting build dependencies (they take a lot of time to build)
  92         EOF
  93   exit 1
  94 fi
  95
  96 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
  97 source $(dirname $(dirname $DIR))/scripts/nix_env
  98 export NIXOPS_STATE="$(dirname $DIR)/state/eldiron.nixops"
  99 export NIXOPS_DEPLOYMENT="$DeploymentUuid"
 100
 101 if ! nixops_custom info 2>/dev/null >/dev/null; then
 102   cat <<-EOF
 103         Importing deployment file into nixops:
 104         Continue? [y/N]
 105         EOF
 106   read y
 107   if [ "$y" = "y" -o "$y" = "Y" ]; then
 108     deployment=$(pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/Deployment)
 109     echo "$deployment" | nixops_custom import
 110   else
 111     echo "Aborting"
 112     exit 1
 113   fi
 114 fi
 115
 116 nixops_custom modify "$(dirname $DIR)/default.nix"
 117
 118 cat <<-EOF
 119         All set up.
 120         Please make sure you’re using scripts/nixops_wrap when deploying
 121         EOF