From: Ismaël Bouya Date: Fri, 1 Feb 2019 13:39:59 +0000 (+0100) Subject: Complete setup script to import deployment file X-Git-Tag: nur_publish~263 X-Git-Url: https://git.immae.eu/?p=perso%2FImmae%2FConfig%2FNix.git;a=commitdiff_plain;h=568d4240fa2d4b1f29cc1dd6d943a2da941ef46e Complete setup script to import deployment file --- diff --git a/nixops/.gitignore b/nixops/.gitignore new file mode 100644 index 0000000..2ea467b --- /dev/null +++ b/nixops/.gitignore @@ -0,0 +1 @@ +/state diff --git a/nixops/scripts/nixops_wrap b/nixops/scripts/nixops_wrap index 1de38f5..24b8381 100755 --- a/nixops/scripts/nixops_wrap +++ b/nixops/scripts/nixops_wrap @@ -1,5 +1,6 @@ #!/bin/bash +DeploymentUuid="cef694f3-081d-11e9-b31f-0242ec186adf" if [ -z "$NIXOPS_CONFIG_PASS_SUBTREE_PATH" ]; then echo "Please set NIXOPS_CONFIG_PASS_SUBTREE_PATH to the password-store subtree path" exit 1; @@ -15,9 +16,12 @@ finish() { trap finish EXIT +DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" +export NIXOPS_STATE="$(dirname $DIR)/state/eldiron.nixops" +export NIXOPS_DEPLOYMENT="$DeploymentUuid" + pass show "$NIXOPS_CONFIG_PASS_SUBTREE_PATH/NixConfig" >> $TEMP nixops set-args --argstr environment "$TEMP" -DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" export NIX_PATH="ssh-config-file=$(dirname $DIR)/ssh/config:nixpkgs=$HOME/.nix-defexpr/channels/immaeNixpkgs" nixops "$@" diff --git a/nixops/scripts/pull_deployment b/nixops/scripts/pull_deployment new file mode 100755 index 0000000..796ff9b --- /dev/null +++ b/nixops/scripts/pull_deployment @@ -0,0 +1,31 @@ +#!/bin/bash + +DeploymentUuid="cef694f3-081d-11e9-b31f-0242ec186adf" + +if [ -z "$NIXOPS_CONFIG_PASS_SUBTREE_PATH" ]; then + echo "Please set NIXOPS_CONFIG_PASS_SUBTREE_PATH to the password-store subtree path" + exit 1; +fi + +DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" +export NIXOPS_STATE="$(dirname $DIR)/state/eldiron.nixops" + +if nixops info -d $DeploymentUuid 2>/dev/null >/dev/null; then + cat </dev/null 2>&1 && pwd )" +export NIXOPS_STATE="$(dirname $DIR)/state/eldiron.nixops" +export NIXOPS_DEPLOYMENT="$DeploymentUuid" + +nixops export | pass insert -m $NIXOPS_CONFIG_PASS_SUBTREE_PATH/NixDeployment diff --git a/nixops/scripts/setup b/nixops/scripts/setup index d9d4258..bb433ba 100755 --- a/nixops/scripts/setup +++ b/nixops/scripts/setup @@ -3,28 +3,38 @@ RemoteRepo="gitolite@git.immae.eu:perso/Immae/Prive/Password_store/Mes_Sites/Paul" NixChannelUrl='https://releases.nixos.org/nixos/18.09/nixos-18.09.1834.9d608a6f592' NixChannelName='immaeNixpkgs' +DeploymentUuid="cef694f3-081d-11e9-b31f-0242ec186adf" + +if ! which nix 2>/dev/null >/dev/null; then + cat <<-EOF + nix is needed, please install it: + > curl https://nixos.org/nix/install | sh + (or any other way handled by your distribution) + EOF + exit 1 +fi if [ -z "$NIXOPS_CONFIG_PASS_SUBTREE_REMOTE" \ -o -z "$NIXOPS_CONFIG_PASS_SUBTREE_PATH" ]; then cat <<-EOF -Two environment variables are needed to setup the password store: -NIXOPS_CONFIG_PASS_SUBTREE_PATH : path where the subtree will be imported -NIXOPS_CONFIG_PASS_SUBTREE_REMOTE : remote name to give to the repository -EOF + Two environment variables are needed to setup the password store: + NIXOPS_CONFIG_PASS_SUBTREE_PATH : path where the subtree will be imported + NIXOPS_CONFIG_PASS_SUBTREE_REMOTE : remote name to give to the repository + EOF exit 1 fi if ! pass $NIXOPS_CONFIG_PASS_SUBTREE_PATH > /dev/null 2>/dev/null; then cat <<-EOF -/!\ This will modify your password store to add and import a subtree -with the specific passwords files. Choose a path that doesn’t exist -yet in your password store. -> pass git remote add $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE $RemoteRepo -> pass git subtree add --prefix=$NIXOPS_CONFIG_PASS_SUBTREE_PATH $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE master -Later, you can use pull_environment and push_environment scripts to -update the passwords when needed -Continue? [y/N] -EOF + /!\ This will modify your password store to add and import a subtree + with the specific passwords files. Choose a path that doesn’t exist + yet in your password store. + > pass git remote add $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE $RemoteRepo + > pass git subtree add --prefix=$NIXOPS_CONFIG_PASS_SUBTREE_PATH $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE master + Later, you can use pull_environment and push_environment scripts to + update the passwords when needed + Continue? [y/N] + EOF read y if [ "$y" = "y" -o "$y" = "Y" ]; then pass git remote add $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE $RemoteRepo @@ -36,16 +46,16 @@ EOF fi if [ ! -f /etc/ssh/ssh_rsa_key_nixops ]; then - cat < pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/NixSshKey | sudo tee /etc/ssh/ssh_rsa_key_nixops > /dev/null -> pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/NixSshKey.pub | sudo tee /etc/ssh/ssh_rsa_key_nixops.pub > /dev/null -> sudo chmod u=r,go-rwx /etc/ssh/ssh_rsa_key_nixops -> sudo chown nixbld1:nixbld /etc/ssh/ssh_rsa_key_nixops /etc/ssh/ssh_rsa_key_nixops.pub -Continue? [y/N] -EOF + cat <<-EOF + The key to access private git repositories (websites hosted by the + server) needs to be accessible to nix builders. It will be put in + /etc/ssh/ssh_rsa_key_nixops (sudo right is needed for that) + > pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/NixSshKey | sudo tee /etc/ssh/ssh_rsa_key_nixops > /dev/null + > pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/NixSshKey.pub | sudo tee /etc/ssh/ssh_rsa_key_nixops.pub > /dev/null + > sudo chmod u=r,go-rwx /etc/ssh/ssh_rsa_key_nixops + > sudo chown nixbld1:nixbld /etc/ssh/ssh_rsa_key_nixops /etc/ssh/ssh_rsa_key_nixops.pub + Continue? [y/N] + EOF read y if [ "$y" = "y" -o "$y" = "Y" ]; then if ! id -u nixbld1 2>/dev/null >/dev/null; then @@ -70,26 +80,70 @@ EOF fi if ! nix-channel --list | grep -q "$NixChannelName $NixChannelUrl"; then -cat < nix-channel --add $NixChannelUrl $NixChannelName -> nix-channel --update -If this step fail, you may have to disable sandboxing in -/etc/nix/nix.conf and rerun -> nix-channel --update -manually. -Continue? [y/N] -EOF + cat <<-EOF + A new nix channel will be installed (or upgraded) to freeze the packages + version: + $NixChannelName $NixChannelUrl + > nix-channel --add $NixChannelUrl $NixChannelName + > nix-channel --update + If this step fail, you may have to disable sandboxing in + /etc/nix/nix.conf and rerun + > nix-channel --update + manually. + Continue? [y/N] + EOF read y if [ "$y" = "y" -o "$y" = "Y" ]; then nix-channel --add $NixChannelUrl $NixChannelName nix-channel --update + else + echo "Aborting" + exit 1 + fi +fi + +if ! which nixops 2>/dev/null >/dev/null; then + cat <<-EOF + nixops is needed: + > nix-env -i nixops + If it fails, please check that $HOME/.nix-profile/bin is in your PATH. + Continue? [y/N] + EOF + read y + if [ "$y" = "y" -o "$y" = "Y" ]; then + nix-env -i nixops + if ! which nixops 2>/dev/null >/dev/null; then + echo "Installation failed, please check that $HOME/.nix-profile/bin is in your path." + exit 1 + fi + else + echo "Aborting" + exit 1 + fi +fi + +DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" +export NIXOPS_STATE="$(dirname $DIR)/state/eldiron.nixops" +export NIXOPS_DEPLOYMENT="$DeploymentUuid" + +if ! nixops info 2>/dev/null >/dev/null; then + cat <<-EOF + Importing deployment file into nixops: + Continue? [y/N] + EOF + read y + if [ "$y" = "y" -o "$y" = "Y" ]; then + deployment=$(pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/NixDeployment) + echo "$deployment" | nixops import + + nixops modify "$(dirname $DIR)/eldiron.nix" + else + echo "Aborting" + exit 1 fi fi -cat <