nixops/scripts/setup

   1 #!/bin/bash
   2
   3 set -euxo pipefail
   4
   5 RemoteRepo="gitolite@git.immae.eu:perso/Immae/Prive/Password_store/Sites"
   6 DeploymentUuid="cef694f3-081d-11e9-b31f-0242ec186adf"
   7
   8 if ! which nix 2>/dev/null >/dev/null; then
   9   cat <<-EOF
  10         nix is needed, please install it:
  11         > curl https://nixos.org/nix/install | sh
  12         (or any other way handled by your distribution)
  13         EOF
  14   exit 1
  15 fi
  16
  17 if [ -z "$NIXOPS_CONFIG_PASS_SUBTREE_REMOTE" \
  18     -o -z "$NIXOPS_CONFIG_PASS_SUBTREE_PATH" ]; then
  19   cat <<-EOF
  20         Two environment variables are needed to setup the password store:
  21         NIXOPS_CONFIG_PASS_SUBTREE_PATH : path where the subtree will be imported
  22         NIXOPS_CONFIG_PASS_SUBTREE_REMOTE : remote name to give to the repository
  23         EOF
  24   exit 1
  25 fi
  26
  27 if ! pass $NIXOPS_CONFIG_PASS_SUBTREE_PATH > /dev/null 2>/dev/null; then
  28   cat <<-EOF
  29         /!\ This will modify your password store to add and import a subtree
  30         with the specific passwords files. Choose a path that doesn’t exist
  31         yet in your password store.
  32         > pass git remote add $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE $RemoteRepo
  33         > pass git subtree add --prefix=$NIXOPS_CONFIG_PASS_SUBTREE_PATH $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE master
  34         Later, you can use pull_environment and push_environment scripts to
  35         update the passwords when needed
  36         Continue? [y/N]
  37         EOF
  38   read y
  39   if [ "$y" = "y" -o "$y" = "Y" ]; then
  40     pass git remote add $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE $RemoteRepo
  41     pass git subtree add --prefix=$NIXOPS_CONFIG_PASS_SUBTREE_PATH $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE master
  42   else
  43     echo "Aborting"
  44     exit 1
  45   fi
  46 fi
  47
  48 if [ ! -f /etc/ssh/ssh_rsa_key_nixops ]; then
  49   cat <<-EOF
  50         The key to access private git repositories (websites hosted by the
  51         server) needs to be accessible to nix builders. It will be put in
  52         /etc/ssh/ssh_rsa_key_nixops (sudo right is needed for that)
  53         > pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/SshKey | sudo tee /etc/ssh/ssh_rsa_key_nixops > /dev/null
  54         > pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/SshKey.pub | sudo tee /etc/ssh/ssh_rsa_key_nixops.pub > /dev/null
  55         > sudo chmod u=r,go-rwx /etc/ssh/ssh_rsa_key_nixops
  56         > sudo chown nixbld1:nixbld /etc/ssh/ssh_rsa_key_nixops /etc/ssh/ssh_rsa_key_nixops.pub
  57         Continue? [y/N]
  58         EOF
  59   read y
  60   if [ "$y" = "y" -o "$y" = "Y" ]; then
  61     if ! id -u nixbld1 2>/dev/null >/dev/null; then
  62       echo "User nixbld1 seems inexistant, did you install nix?"
  63       exit 1
  64     fi
  65     mask=$(umask)
  66     umask 0777
  67     # Don’t forward it directly to tee, it would break ncurse pinentry
  68     key=$(pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/SshKey)
  69     echo "$key" | sudo tee /etc/ssh/ssh_rsa_key_nixops > /dev/null
  70     sudo chmod u=r,go=- /etc/ssh/ssh_rsa_key_nixops
  71     pubkey=$(pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/SshKey.pub)
  72     echo "$pubkey" | sudo tee /etc/ssh/ssh_rsa_key_nixops.pub > /dev/null
  73     sudo chmod a=r /etc/ssh/ssh_rsa_key_nixops.pub
  74     sudo chown nixbld1:nixbld /etc/ssh/ssh_rsa_key_nixops /etc/ssh/ssh_rsa_key_nixops.pub
  75     umask $mask
  76   else
  77     echo "Aborting"
  78     exit 1
  79   fi
  80 fi
  81
  82 if ! which nixops 2>/dev/null >/dev/null; then
  83   cat <<-EOF
  84         nixops is needed:
  85         > nix-env -i nixops
  86         If it fails, please check that $HOME/.nix-profile/bin is in your PATH.
  87         Continue? [y/N]
  88         EOF
  89   read y
  90   if [ "$y" = "y" -o "$y" = "Y" ]; then
  91     nix-env -i nixops
  92     if ! which nixops 2>/dev/null >/dev/null; then
  93       echo "Installation failed, please check that $HOME/.nix-profile/bin is in your path."
  94       exit 1
  95     fi
  96   else
  97     echo "Aborting"
  98     exit 1
  99   fi
 100 fi
 101
 102 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 103 export NIXOPS_STATE="$(dirname $DIR)/state/eldiron.nixops"
 104 export NIXOPS_DEPLOYMENT="$DeploymentUuid"
 105
 106 if ! nixops info 2>/dev/null >/dev/null; then
 107   cat <<-EOF
 108         Importing deployment file into nixops:
 109         Continue? [y/N]
 110         EOF
 111   read y
 112   if [ "$y" = "y" -o "$y" = "Y" ]; then
 113     deployment=$(pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/Deployment)
 114     echo "$deployment" | nixops import
 115
 116     nixops modify "$(dirname $DIR)/eldiron.nix"
 117   else
 118     echo "Aborting"
 119     exit 1
 120   fi
 121 fi
 122
 123 cat <<-EOF
 124         All set up.
 125         Please make sure you’re using scripts/nixops_wrap when deploying
 126         EOF