diff options
author | Ismaël Bouya <ismael.bouya@normalesup.org> | 2019-05-24 13:27:22 +0200 |
---|---|---|
committer | Ismaël Bouya <ismael.bouya@normalesup.org> | 2019-05-24 13:27:22 +0200 |
commit | d823e010d653a6bf33ff232da5f90103be7515b8 (patch) | |
tree | 67091385504e4374f5bdb9a4e4e345b23db11c3c /nixops/scripts | |
parent | 90bfb9a814f26c154e34334f74a3582ba462b2e8 (diff) | |
download | Nix-d823e010d653a6bf33ff232da5f90103be7515b8.tar.gz Nix-d823e010d653a6bf33ff232da5f90103be7515b8.tar.zst Nix-d823e010d653a6bf33ff232da5f90103be7515b8.zip |
Replace fetchgitPrivate by its builtins counterpart
Diffstat (limited to 'nixops/scripts')
-rwxr-xr-x | nixops/scripts/nixops_wrap | 4 | ||||
-rwxr-xr-x | nixops/scripts/setup | 41 |
2 files changed, 0 insertions, 45 deletions
diff --git a/nixops/scripts/nixops_wrap b/nixops/scripts/nixops_wrap index d03784e..9cf3388 100755 --- a/nixops/scripts/nixops_wrap +++ b/nixops/scripts/nixops_wrap | |||
@@ -14,10 +14,6 @@ nixops="$(nix-build --no-out-link "$(dirname $DIR)/custom_nixops.nix")/bin/nixop | |||
14 | TEMP=$(mktemp -d /tmp/XXXXXX-nixops-files) | 14 | TEMP=$(mktemp -d /tmp/XXXXXX-nixops-files) |
15 | chmod go-rwx $TEMP | 15 | chmod go-rwx $TEMP |
16 | 16 | ||
17 | # __noChroot: ssh-config-file requires relaxed | ||
18 | export NIX_PATH="ssh-config-file=$(dirname $DIR)/ssh/config:$NIX_PATH" | ||
19 | |||
20 | |||
21 | finish() { | 17 | finish() { |
22 | rm -rf "$TEMP" | 18 | rm -rf "$TEMP" |
23 | $nixops set-args --unset privateFiles | 19 | $nixops set-args --unset privateFiles |
diff --git a/nixops/scripts/setup b/nixops/scripts/setup index 1586265..58dbf55 100755 --- a/nixops/scripts/setup +++ b/nixops/scripts/setup | |||
@@ -80,47 +80,6 @@ for key in $gpg_keys; do | |||
80 | fi | 80 | fi |
81 | done | 81 | done |
82 | 82 | ||
83 | nix_group=$(stat -c %G /nix/store) | ||
84 | if [ "$nix_group" = "nixbld" ]; then | ||
85 | nix_user="nixbld1" | ||
86 | else | ||
87 | nix_user="$(stat -c %U /nix/store)" | ||
88 | fi | ||
89 | |||
90 | if [ ! -f /etc/ssh/ssh_rsa_key_nixops ]; then | ||
91 | cat <<-EOF | ||
92 | The key to access private git repositories (websites hosted by the | ||
93 | server) needs to be accessible to nix builders. It will be put in | ||
94 | /etc/ssh/ssh_rsa_key_nixops (sudo right is needed for that) | ||
95 | > pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/SshKey | sudo tee /etc/ssh/ssh_rsa_key_nixops > /dev/null | ||
96 | > pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/SshKey.pub | sudo tee /etc/ssh/ssh_rsa_key_nixops.pub > /dev/null | ||
97 | > sudo chmod u=r,go-rwx /etc/ssh/ssh_rsa_key_nixops | ||
98 | > sudo chown $nix_user:$nix_group /etc/ssh/ssh_rsa_key_nixops /etc/ssh/ssh_rsa_key_nixops.pub | ||
99 | Continue? [y/N] | ||
100 | EOF | ||
101 | read y | ||
102 | if [ "$y" = "y" -o "$y" = "Y" ]; then | ||
103 | if ! id -u $nix_user 2>/dev/null >/dev/null; then | ||
104 | echo "User $nix_user seems inexistant, did you install nix?" | ||
105 | exit 1 | ||
106 | fi | ||
107 | mask=$(umask) | ||
108 | umask 0777 | ||
109 | # Don’t forward it directly to tee, it would break ncurse pinentry | ||
110 | key=$(pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/SshKey) | ||
111 | echo "$key" | sudo tee /etc/ssh/ssh_rsa_key_nixops > /dev/null | ||
112 | sudo chmod u=r,go=- /etc/ssh/ssh_rsa_key_nixops | ||
113 | pubkey=$(pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/SshKey.pub) | ||
114 | echo "$pubkey" | sudo tee /etc/ssh/ssh_rsa_key_nixops.pub > /dev/null | ||
115 | sudo chmod a=r /etc/ssh/ssh_rsa_key_nixops.pub | ||
116 | sudo chown $nix_user:$nix_group /etc/ssh/ssh_rsa_key_nixops /etc/ssh/ssh_rsa_key_nixops.pub | ||
117 | umask $mask | ||
118 | else | ||
119 | echo "Aborting" | ||
120 | exit 1 | ||
121 | fi | ||
122 | fi | ||
123 | |||
124 | if nix show-config --json | jq -e '.sandbox.value == "true"' >/dev/null; then | 83 | if nix show-config --json | jq -e '.sandbox.value == "true"' >/dev/null; then |
125 | cat <<-EOF | 84 | cat <<-EOF |
126 | There are some impure derivations in the repo currently (grep __noChroot), please put | 85 | There are some impure derivations in the repo currently (grep __noChroot), please put |