Complete setup script to import deployment file

diff --git a/nixops/.gitignore b/nixops/.gitignore
new file mode 100644 (file)
index 0000000..2ea467b
--- /dev/null
+++ b/nixops/.gitignore
@@ -0,0 +1 @@
+/state

diff --git a/nixops/scripts/nixops_wrap b/nixops/scripts/nixops_wrap
index 1de38f5a8879fd64573d127568cfea50a51f95e9..24b838181e22f1c2d5e27d81fad7f02508f61e63 100755 (executable)
--- a/nixops/scripts/nixops_wrap
+++ b/nixops/scripts/nixops_wrap
@@ -1,5 +1,6 @@
 #!/bin/bash
 
+DeploymentUuid="cef694f3-081d-11e9-b31f-0242ec186adf"
 if [ -z "$NIXOPS_CONFIG_PASS_SUBTREE_PATH" ]; then
   echo "Please set NIXOPS_CONFIG_PASS_SUBTREE_PATH to the password-store subtree path"
   exit 1;
@@ -15,9 +16,12 @@ finish() {
 
 trap finish EXIT
 
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+export NIXOPS_STATE="$(dirname $DIR)/state/eldiron.nixops"
+export NIXOPS_DEPLOYMENT="$DeploymentUuid"
+
 pass show "$NIXOPS_CONFIG_PASS_SUBTREE_PATH/NixConfig" >> $TEMP
 nixops set-args --argstr environment "$TEMP"
 
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 export NIX_PATH="ssh-config-file=$(dirname $DIR)/ssh/config:nixpkgs=$HOME/.nix-defexpr/channels/immaeNixpkgs"
 nixops "$@"

diff --git a/nixops/scripts/pull_deployment b/nixops/scripts/pull_deployment
new file mode 100755 (executable)
index 0000000..796ff9b
--- /dev/null
+++ b/nixops/scripts/pull_deployment
@@ -0,0 +1,31 @@
+#!/bin/bash
+
+DeploymentUuid="cef694f3-081d-11e9-b31f-0242ec186adf"
+
+if [ -z "$NIXOPS_CONFIG_PASS_SUBTREE_PATH" ]; then
+  echo "Please set NIXOPS_CONFIG_PASS_SUBTREE_PATH to the password-store subtree path"
+  exit 1;
+fi
+
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+export NIXOPS_STATE="$(dirname $DIR)/state/eldiron.nixops"
+
+if nixops info -d $DeploymentUuid 2>/dev/null >/dev/null; then
+  cat <<EOF
+This will remove your current deployment file and recreate it!
+Continue? [y/N]
+EOF
+  read y
+  if [ "$y" = "y" -o "$y" = "Y" ]; then
+    nixops delete --force -d $DeploymentUuid
+  else
+    echo "Aborting"
+    exit 1
+  fi
+fi
+
+deployment=$(pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/NixDeployment)
+
+echo "$deployment" | nixops import
+
+nixops modify -d "$DeploymentUuid" "$(dirname $DIR)/eldiron.nix"

diff --git a/nixops/scripts/push_deployment b/nixops/scripts/push_deployment
new file mode 100755 (executable)
index 0000000..07a804e
--- /dev/null
+++ b/nixops/scripts/push_deployment
@@ -0,0 +1,14 @@
+#!/bin/bash
+
+DeploymentUuid="cef694f3-081d-11e9-b31f-0242ec186adf"
+
+if [ -z "$NIXOPS_CONFIG_PASS_SUBTREE_PATH" ]; then
+  echo "Please set NIXOPS_CONFIG_PASS_SUBTREE_PATH to the password-store subtree path"
+  exit 1;
+fi
+
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+export NIXOPS_STATE="$(dirname $DIR)/state/eldiron.nixops"
+export NIXOPS_DEPLOYMENT="$DeploymentUuid"
+
+nixops export | pass insert -m $NIXOPS_CONFIG_PASS_SUBTREE_PATH/NixDeployment

diff --git a/nixops/scripts/setup b/nixops/scripts/setup
index d9d42585a9dd58244419d4b57bf4283a5c14ed4b..bb433babbdf13fafc6dfb5a15d5a93a9b9494667 100755 (executable)
--- a/nixops/scripts/setup
+++ b/nixops/scripts/setup
@@ -3,28 +3,38 @@
 RemoteRepo="gitolite@git.immae.eu:perso/Immae/Prive/Password_store/Mes_Sites/Paul"
 NixChannelUrl='https://releases.nixos.org/nixos/18.09/nixos-18.09.1834.9d608a6f592'
 NixChannelName='immaeNixpkgs'
+DeploymentUuid="cef694f3-081d-11e9-b31f-0242ec186adf"
+
+if ! which nix 2>/dev/null >/dev/null; then
+  cat <<-EOF
+       nix is needed, please install it:
+       > curl https://nixos.org/nix/install | sh
+       (or any other way handled by your distribution)
+       EOF
+  exit 1
+fi
 
 if [ -z "$NIXOPS_CONFIG_PASS_SUBTREE_REMOTE" \
     -o -z "$NIXOPS_CONFIG_PASS_SUBTREE_PATH" ]; then
   cat <<-EOF
-Two environment variables are needed to setup the password store:
-NIXOPS_CONFIG_PASS_SUBTREE_PATH : path where the subtree will be imported
-NIXOPS_CONFIG_PASS_SUBTREE_REMOTE : remote name to give to the repository
-EOF
+       Two environment variables are needed to setup the password store:
+       NIXOPS_CONFIG_PASS_SUBTREE_PATH : path where the subtree will be imported
+       NIXOPS_CONFIG_PASS_SUBTREE_REMOTE : remote name to give to the repository
+       EOF
   exit 1
 fi
 
 if ! pass $NIXOPS_CONFIG_PASS_SUBTREE_PATH > /dev/null 2>/dev/null; then
   cat <<-EOF
-/!\ This will modify your password store to add and import a subtree
-with the specific passwords files. Choose a path that doesn’t exist
-yet in your password store.
-> pass git remote add $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE $RemoteRepo
-> pass git subtree add --prefix=$NIXOPS_CONFIG_PASS_SUBTREE_PATH $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE master
-Later, you can use pull_environment and push_environment scripts to
-update the passwords when needed
-Continue? [y/N]
-EOF
+       /!\ This will modify your password store to add and import a subtree
+       with the specific passwords files. Choose a path that doesn’t exist
+       yet in your password store.
+       > pass git remote add $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE $RemoteRepo
+       > pass git subtree add --prefix=$NIXOPS_CONFIG_PASS_SUBTREE_PATH $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE master
+       Later, you can use pull_environment and push_environment scripts to
+       update the passwords when needed
+       Continue? [y/N]
+       EOF
   read y
   if [ "$y" = "y" -o "$y" = "Y" ]; then
     pass git remote add $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE $RemoteRepo
@@ -36,16 +46,16 @@ EOF
 fi
 
 if [ ! -f /etc/ssh/ssh_rsa_key_nixops ]; then
-  cat <<EOF
-The key to access private git repositories (websites hosted by the
-server) needs to be accessible to nix builders. It will be put in
-/etc/ssh/ssh_rsa_key_nixops (sudo right is needed for that)
-> pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/NixSshKey | sudo tee /etc/ssh/ssh_rsa_key_nixops > /dev/null
-> pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/NixSshKey.pub | sudo tee /etc/ssh/ssh_rsa_key_nixops.pub > /dev/null
-> sudo chmod u=r,go-rwx /etc/ssh/ssh_rsa_key_nixops
-> sudo chown nixbld1:nixbld /etc/ssh/ssh_rsa_key_nixops /etc/ssh/ssh_rsa_key_nixops.pub
-Continue? [y/N]
-EOF
+  cat <<-EOF
+       The key to access private git repositories (websites hosted by the
+       server) needs to be accessible to nix builders. It will be put in
+       /etc/ssh/ssh_rsa_key_nixops (sudo right is needed for that)
+       > pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/NixSshKey | sudo tee /etc/ssh/ssh_rsa_key_nixops > /dev/null
+       > pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/NixSshKey.pub | sudo tee /etc/ssh/ssh_rsa_key_nixops.pub > /dev/null
+       > sudo chmod u=r,go-rwx /etc/ssh/ssh_rsa_key_nixops
+       > sudo chown nixbld1:nixbld /etc/ssh/ssh_rsa_key_nixops /etc/ssh/ssh_rsa_key_nixops.pub
+       Continue? [y/N]
+       EOF
   read y
   if [ "$y" = "y" -o "$y" = "Y" ]; then
     if ! id -u nixbld1 2>/dev/null >/dev/null; then
@@ -70,26 +80,70 @@ EOF
 fi
 
 if ! nix-channel --list | grep -q "$NixChannelName $NixChannelUrl"; then
-cat <<EOF
-A new nix channel will be installed (or upgraded) to freeze the packages
-version:
-$NixChannelName $NixChannelUrl
-> nix-channel --add $NixChannelUrl $NixChannelName
-> nix-channel --update
-If this step fail, you may have to disable sandboxing in
-/etc/nix/nix.conf and rerun
-> nix-channel --update
-manually.
-Continue? [y/N]
-EOF
+  cat <<-EOF
+       A new nix channel will be installed (or upgraded) to freeze the packages
+       version:
+       $NixChannelName $NixChannelUrl
+       > nix-channel --add $NixChannelUrl $NixChannelName
+       > nix-channel --update
+       If this step fail, you may have to disable sandboxing in
+       /etc/nix/nix.conf and rerun
+       > nix-channel --update
+       manually.
+       Continue? [y/N]
+       EOF
   read y
   if [ "$y" = "y" -o "$y" = "Y" ]; then
     nix-channel --add $NixChannelUrl $NixChannelName
     nix-channel --update
+  else
+    echo "Aborting"
+    exit 1
+  fi
+fi
+
+if ! which nixops 2>/dev/null >/dev/null; then
+  cat <<-EOF
+       nixops is needed:
+       > nix-env -i nixops
+       If it fails, please check that $HOME/.nix-profile/bin is in your PATH.
+       Continue? [y/N]
+       EOF
+  read y
+  if [ "$y" = "y" -o "$y" = "Y" ]; then
+    nix-env -i nixops
+    if ! which nixops 2>/dev/null >/dev/null; then
+      echo "Installation failed, please check that $HOME/.nix-profile/bin is in your path."
+      exit 1
+    fi
+  else
+    echo "Aborting"
+    exit 1
+  fi
+fi
+
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+export NIXOPS_STATE="$(dirname $DIR)/state/eldiron.nixops"
+export NIXOPS_DEPLOYMENT="$DeploymentUuid"
+
+if ! nixops info 2>/dev/null >/dev/null; then
+  cat <<-EOF
+       Importing deployment file into nixops:
+       Continue? [y/N]
+       EOF
+  read y
+  if [ "$y" = "y" -o "$y" = "Y" ]; then
+    deployment=$(pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/NixDeployment)
+    echo "$deployment" | nixops import
+
+    nixops modify "$(dirname $DIR)/eldiron.nix"
+  else
+    echo "Aborting"
+    exit 1
   fi
 fi
 
-cat <<EOF
-All set up.
-Please make sure you’re using scripts/nixops_wrap when deploying
-EOF
+cat <<-EOF
+       All set up.
+       Please make sure you’re using scripts/nixops_wrap when deploying
+       EOF

diff --git a/nixops/state/.gitkeep b/nixops/state/.gitkeep
new file mode 100644 (file)
index 0000000..e69de29