nixops/scripts/setup

   1 #!/bin/bash
   2
   3 set -euo pipefail
   4
   5 if ! which nix 2>/dev/null >/dev/null; then
   6   cat <<-EOF
   7         nix is needed, please install it:
   8         > curl https://nixos.org/nix/install | sh
   9         (or any other way handled by your distribution)
  10         EOF
  11   exit 1
  12 fi
  13
  14 if [ "${NIX_STORE:-/nix/store}" != "/nix/store" ]; then
  15   cat <<-EOF
  16         Nix store outside of /nix/store is not supported
  17         EOF
  18   exit 1
  19 fi
  20
  21 gpg_keys=$(pass ls Nixops/GPGKeys | sed -e "1d" | cut -d" " -f2)
  22 for key in $gpg_keys; do
  23   content=$(pass show Nixops/GPGKeys/$key)
  24   fpr=$(echo "$content" | gpg --import-options show-only --import --with-colons | grep -e "^pub" | cut -d':' -f5)
  25   gpg --list-key "$fpr" >/dev/null 2>/dev/null && imported=yes || imported=no
  26   # /usr/share/doc/gnupg/DETAILS field 2
  27   (echo "$content" | gpg --import-options show-only --import --with-colons |
  28       grep -E '^pub:' |
  29       cut -d':' -f2 |
  30       grep -q '[fu]') && signed=yes || signed=no
  31   if [ "$signed" = no -o "$imported" = no ] ; then
  32     echo "The key for $key needs to be imported and signed (a local signature is enough)"
  33     echo "$content" | gpg --import-options show-only --import
  34     echo "Continue? [y/N]"
  35     read y
  36     if [ "$y" = "y" -o "$y" = "Y" ]; then
  37       echo "$content" | gpg --import
  38       gpg --expert --edit-key "$fpr" lsign quit
  39     else
  40       echo "Aborting"
  41       exit 1
  42     fi
  43   fi
  44 done
  45
  46 if nix show-config --json | jq -e '.sandbox.value == "true"' >/dev/null; then
  47   cat <<-EOF
  48         There used to be some impure derivations (grep __noChroot), you may need
  49           sandbox = "relaxed"
  50         in /etc/nix/nix.conf
  51         you may also want to add
  52           keep-outputs = true
  53           keep-derivations = true
  54         to prevent garbage collector from deleting build dependencies (they take a lot of time to build)
  55         and
  56           allow-import-from-derivation = false
  57         as an attempt to avoid having build-time derivations (doesn’t work for all packages)
  58         press key to continue
  59         EOF
  60   read y
  61 fi
  62
  63 cat <<-EOF
  64         All set up.
  65         Please make sure you’re using make commands when deploying
  66         EOF