diff options
-rw-r--r-- | libs.nix | 6 | ||||
-rwxr-xr-x | nixops/scripts/nixops_wrap | 4 | ||||
-rwxr-xr-x | nixops/scripts/setup | 41 | ||||
-rw-r--r-- | nixops/ssh/config | 5 | ||||
-rw-r--r-- | pkgs/private/webapps/aten/aten.json | 4 | ||||
-rw-r--r-- | pkgs/private/webapps/chloe/chloe.json | 4 | ||||
-rw-r--r-- | pkgs/private/webapps/connexionswing/connexionswing.json | 4 | ||||
-rw-r--r-- | pkgs/private/webapps/ludivinecassal/ludivinecassal.json | 4 | ||||
-rw-r--r-- | pkgs/private/webapps/piedsjaloux/piedsjaloux.json | 4 | ||||
-rw-r--r-- | pkgs/private/webapps/tellesflorian/tellesflorian.json | 4 |
10 files changed, 17 insertions, 63 deletions
@@ -36,7 +36,11 @@ rec { | |||
36 | in rec { | 36 | in rec { |
37 | version = json.tag; | 37 | version = json.tag; |
38 | name = "${json.meta.name}-${version}"; | 38 | name = "${json.meta.name}-${version}"; |
39 | src = fetchgitPrivate json.git; | 39 | src = builtins.fetchGit { |
40 | url = json.git.url; | ||
41 | ref = "master"; | ||
42 | rev = json.git.rev; | ||
43 | }; | ||
40 | }; | 44 | }; |
41 | 45 | ||
42 | wrap = { paths ? [], vars ? {}, file ? null, script ? null, name ? "wrap" }: | 46 | wrap = { paths ? [], vars ? {}, file ? null, script ? null, name ? "wrap" }: |
diff --git a/nixops/scripts/nixops_wrap b/nixops/scripts/nixops_wrap index d03784e..9cf3388 100755 --- a/nixops/scripts/nixops_wrap +++ b/nixops/scripts/nixops_wrap | |||
@@ -14,10 +14,6 @@ nixops="$(nix-build --no-out-link "$(dirname $DIR)/custom_nixops.nix")/bin/nixop | |||
14 | TEMP=$(mktemp -d /tmp/XXXXXX-nixops-files) | 14 | TEMP=$(mktemp -d /tmp/XXXXXX-nixops-files) |
15 | chmod go-rwx $TEMP | 15 | chmod go-rwx $TEMP |
16 | 16 | ||
17 | # __noChroot: ssh-config-file requires relaxed | ||
18 | export NIX_PATH="ssh-config-file=$(dirname $DIR)/ssh/config:$NIX_PATH" | ||
19 | |||
20 | |||
21 | finish() { | 17 | finish() { |
22 | rm -rf "$TEMP" | 18 | rm -rf "$TEMP" |
23 | $nixops set-args --unset privateFiles | 19 | $nixops set-args --unset privateFiles |
diff --git a/nixops/scripts/setup b/nixops/scripts/setup index 1586265..58dbf55 100755 --- a/nixops/scripts/setup +++ b/nixops/scripts/setup | |||
@@ -80,47 +80,6 @@ for key in $gpg_keys; do | |||
80 | fi | 80 | fi |
81 | done | 81 | done |
82 | 82 | ||
83 | nix_group=$(stat -c %G /nix/store) | ||
84 | if [ "$nix_group" = "nixbld" ]; then | ||
85 | nix_user="nixbld1" | ||
86 | else | ||
87 | nix_user="$(stat -c %U /nix/store)" | ||
88 | fi | ||
89 | |||
90 | if [ ! -f /etc/ssh/ssh_rsa_key_nixops ]; then | ||
91 | cat <<-EOF | ||
92 | The key to access private git repositories (websites hosted by the | ||
93 | server) needs to be accessible to nix builders. It will be put in | ||
94 | /etc/ssh/ssh_rsa_key_nixops (sudo right is needed for that) | ||
95 | > pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/SshKey | sudo tee /etc/ssh/ssh_rsa_key_nixops > /dev/null | ||
96 | > pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/SshKey.pub | sudo tee /etc/ssh/ssh_rsa_key_nixops.pub > /dev/null | ||
97 | > sudo chmod u=r,go-rwx /etc/ssh/ssh_rsa_key_nixops | ||
98 | > sudo chown $nix_user:$nix_group /etc/ssh/ssh_rsa_key_nixops /etc/ssh/ssh_rsa_key_nixops.pub | ||
99 | Continue? [y/N] | ||
100 | EOF | ||
101 | read y | ||
102 | if [ "$y" = "y" -o "$y" = "Y" ]; then | ||
103 | if ! id -u $nix_user 2>/dev/null >/dev/null; then | ||
104 | echo "User $nix_user seems inexistant, did you install nix?" | ||
105 | exit 1 | ||
106 | fi | ||
107 | mask=$(umask) | ||
108 | umask 0777 | ||
109 | # Don’t forward it directly to tee, it would break ncurse pinentry | ||
110 | key=$(pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/SshKey) | ||
111 | echo "$key" | sudo tee /etc/ssh/ssh_rsa_key_nixops > /dev/null | ||
112 | sudo chmod u=r,go=- /etc/ssh/ssh_rsa_key_nixops | ||
113 | pubkey=$(pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/SshKey.pub) | ||
114 | echo "$pubkey" | sudo tee /etc/ssh/ssh_rsa_key_nixops.pub > /dev/null | ||
115 | sudo chmod a=r /etc/ssh/ssh_rsa_key_nixops.pub | ||
116 | sudo chown $nix_user:$nix_group /etc/ssh/ssh_rsa_key_nixops /etc/ssh/ssh_rsa_key_nixops.pub | ||
117 | umask $mask | ||
118 | else | ||
119 | echo "Aborting" | ||
120 | exit 1 | ||
121 | fi | ||
122 | fi | ||
123 | |||
124 | if nix show-config --json | jq -e '.sandbox.value == "true"' >/dev/null; then | 83 | if nix show-config --json | jq -e '.sandbox.value == "true"' >/dev/null; then |
125 | cat <<-EOF | 84 | cat <<-EOF |
126 | There are some impure derivations in the repo currently (grep __noChroot), please put | 85 | There are some impure derivations in the repo currently (grep __noChroot), please put |
diff --git a/nixops/ssh/config b/nixops/ssh/config deleted file mode 100644 index 3d4dc3e..0000000 --- a/nixops/ssh/config +++ /dev/null | |||
@@ -1,5 +0,0 @@ | |||
1 | Host git.immae.eu | ||
2 | IdentityFile /etc/ssh/ssh_rsa_key_nixops | ||
3 | StrictHostKeyChecking no | ||
4 | UserKnownHostsFile /dev/null | ||
5 | CheckHostIP no | ||
diff --git a/pkgs/private/webapps/aten/aten.json b/pkgs/private/webapps/aten/aten.json index 53569b6..10a315a 100644 --- a/pkgs/private/webapps/aten/aten.json +++ b/pkgs/private/webapps/aten/aten.json | |||
@@ -2,11 +2,11 @@ | |||
2 | "tag": "b99537f-master", | 2 | "tag": "b99537f-master", |
3 | "meta": { | 3 | "meta": { |
4 | "name": "aten", | 4 | "name": "aten", |
5 | "url": "gitolite@git.immae.eu:perso/Immae/Sites/Aten", | 5 | "url": "ssh://gitolite@git.immae.eu/perso/Immae/Sites/Aten", |
6 | "branch": "master" | 6 | "branch": "master" |
7 | }, | 7 | }, |
8 | "git": { | 8 | "git": { |
9 | "url": "gitolite@git.immae.eu:perso/Immae/Sites/Aten", | 9 | "url": "ssh://gitolite@git.immae.eu/perso/Immae/Sites/Aten", |
10 | "rev": "b99537fdad41291afb4f1bb8b2e2aa4081c71fae", | 10 | "rev": "b99537fdad41291afb4f1bb8b2e2aa4081c71fae", |
11 | "sha256": "15mlyik6zivxwry6zc906bqnivxhby27yr8kj4lg5n68pvb877dn", | 11 | "sha256": "15mlyik6zivxwry6zc906bqnivxhby27yr8kj4lg5n68pvb877dn", |
12 | "fetchSubmodules": true | 12 | "fetchSubmodules": true |
diff --git a/pkgs/private/webapps/chloe/chloe.json b/pkgs/private/webapps/chloe/chloe.json index 686d751..6d58e8c 100644 --- a/pkgs/private/webapps/chloe/chloe.json +++ b/pkgs/private/webapps/chloe/chloe.json | |||
@@ -2,11 +2,11 @@ | |||
2 | "tag": "96fc4eb-master", | 2 | "tag": "96fc4eb-master", |
3 | "meta": { | 3 | "meta": { |
4 | "name": "chloe", | 4 | "name": "chloe", |
5 | "url": "gitolite@git.immae.eu:perso/Immae/Sites/Chloe", | 5 | "url": "ssh://gitolite@git.immae.eu/perso/Immae/Sites/Chloe", |
6 | "branch": "master" | 6 | "branch": "master" |
7 | }, | 7 | }, |
8 | "git": { | 8 | "git": { |
9 | "url": "gitolite@git.immae.eu:perso/Immae/Sites/Chloe", | 9 | "url": "ssh://gitolite@git.immae.eu/perso/Immae/Sites/Chloe", |
10 | "rev": "96fc4eb0099a29b0f9a58fb4eaec4bf14ac65f0a", | 10 | "rev": "96fc4eb0099a29b0f9a58fb4eaec4bf14ac65f0a", |
11 | "sha256": "0mf15j6z86j2smm2k360cmm5djhcjbs9949pznwi57kw97vkm1s3", | 11 | "sha256": "0mf15j6z86j2smm2k360cmm5djhcjbs9949pznwi57kw97vkm1s3", |
12 | "fetchSubmodules": true | 12 | "fetchSubmodules": true |
diff --git a/pkgs/private/webapps/connexionswing/connexionswing.json b/pkgs/private/webapps/connexionswing/connexionswing.json index 44d9f0e..3b50916 100644 --- a/pkgs/private/webapps/connexionswing/connexionswing.json +++ b/pkgs/private/webapps/connexionswing/connexionswing.json | |||
@@ -2,11 +2,11 @@ | |||
2 | "tag": "dfcdce0-master", | 2 | "tag": "dfcdce0-master", |
3 | "meta": { | 3 | "meta": { |
4 | "name": "connexionswing", | 4 | "name": "connexionswing", |
5 | "url": "gitolite@git.immae.eu:perso/Immae/Projets/Connexionswing", | 5 | "url": "ssh://gitolite@git.immae.eu/perso/Immae/Projets/Connexionswing", |
6 | "branch": "master" | 6 | "branch": "master" |
7 | }, | 7 | }, |
8 | "git": { | 8 | "git": { |
9 | "url": "gitolite@git.immae.eu:perso/Immae/Projets/Connexionswing", | 9 | "url": "ssh://gitolite@git.immae.eu/perso/Immae/Projets/Connexionswing", |
10 | "rev": "dfcdce04d11a75f5e850e6dc3a049de4517fc107", | 10 | "rev": "dfcdce04d11a75f5e850e6dc3a049de4517fc107", |
11 | "sha256": "0ddirwxs2ify3bni6nv787nb31ckyn2hsrcq8g01b5cfv5havkwq", | 11 | "sha256": "0ddirwxs2ify3bni6nv787nb31ckyn2hsrcq8g01b5cfv5havkwq", |
12 | "fetchSubmodules": true | 12 | "fetchSubmodules": true |
diff --git a/pkgs/private/webapps/ludivinecassal/ludivinecassal.json b/pkgs/private/webapps/ludivinecassal/ludivinecassal.json index f39b143..f0d23c3 100644 --- a/pkgs/private/webapps/ludivinecassal/ludivinecassal.json +++ b/pkgs/private/webapps/ludivinecassal/ludivinecassal.json | |||
@@ -2,11 +2,11 @@ | |||
2 | "tag": "0dacc32-master", | 2 | "tag": "0dacc32-master", |
3 | "meta": { | 3 | "meta": { |
4 | "name": "ludivinecassal", | 4 | "name": "ludivinecassal", |
5 | "url": "gitolite@git.immae.eu:perso/Immae/Sites/Ludivine", | 5 | "url": "ssh://gitolite@git.immae.eu/perso/Immae/Sites/Ludivine", |
6 | "branch": "master" | 6 | "branch": "master" |
7 | }, | 7 | }, |
8 | "git": { | 8 | "git": { |
9 | "url": "gitolite@git.immae.eu:perso/Immae/Sites/Ludivine", | 9 | "url": "ssh://gitolite@git.immae.eu/perso/Immae/Sites/Ludivine", |
10 | "rev": "0dacc320ea052b69f79861c84bceaa89be53de60", | 10 | "rev": "0dacc320ea052b69f79861c84bceaa89be53de60", |
11 | "sha256": "10khg1fq9ixly3xak591n3v0rv3f2hn91rd46d75yv3wjxaj1c2d", | 11 | "sha256": "10khg1fq9ixly3xak591n3v0rv3f2hn91rd46d75yv3wjxaj1c2d", |
12 | "fetchSubmodules": true | 12 | "fetchSubmodules": true |
diff --git a/pkgs/private/webapps/piedsjaloux/piedsjaloux.json b/pkgs/private/webapps/piedsjaloux/piedsjaloux.json index a34c7e8..dc2c083 100644 --- a/pkgs/private/webapps/piedsjaloux/piedsjaloux.json +++ b/pkgs/private/webapps/piedsjaloux/piedsjaloux.json | |||
@@ -2,11 +2,11 @@ | |||
2 | "tag": "4ee4538-master", | 2 | "tag": "4ee4538-master", |
3 | "meta": { | 3 | "meta": { |
4 | "name": "piedsjaloux", | 4 | "name": "piedsjaloux", |
5 | "url": "gitolite@git.immae.eu:Pieds_jaloux/NewSite", | 5 | "url": "ssh://gitolite@git.immae.eu/Pieds_jaloux/NewSite", |
6 | "branch": "master" | 6 | "branch": "master" |
7 | }, | 7 | }, |
8 | "git": { | 8 | "git": { |
9 | "url": "gitolite@git.immae.eu:Pieds_jaloux/NewSite", | 9 | "url": "ssh://gitolite@git.immae.eu/Pieds_jaloux/NewSite", |
10 | "rev": "4ee45386ad9ec9c081234a2fbde66e5b0c3294be", | 10 | "rev": "4ee45386ad9ec9c081234a2fbde66e5b0c3294be", |
11 | "sha256": "10a41chh4crn95z6lk6nhkx27089djkngypa9m76bg7ph508mvnq", | 11 | "sha256": "10a41chh4crn95z6lk6nhkx27089djkngypa9m76bg7ph508mvnq", |
12 | "fetchSubmodules": true | 12 | "fetchSubmodules": true |
diff --git a/pkgs/private/webapps/tellesflorian/tellesflorian.json b/pkgs/private/webapps/tellesflorian/tellesflorian.json index 81b42af..693336d 100644 --- a/pkgs/private/webapps/tellesflorian/tellesflorian.json +++ b/pkgs/private/webapps/tellesflorian/tellesflorian.json | |||
@@ -2,11 +2,11 @@ | |||
2 | "tag": "1793d5c-master", | 2 | "tag": "1793d5c-master", |
3 | "meta": { | 3 | "meta": { |
4 | "name": "tellesflorian", | 4 | "name": "tellesflorian", |
5 | "url": "gitolite@git.immae.eu:perso/florian_telles/stabilo", | 5 | "url": "ssh://gitolite@git.immae.eu/perso/florian_telles/stabilo", |
6 | "branch": "master" | 6 | "branch": "master" |
7 | }, | 7 | }, |
8 | "git": { | 8 | "git": { |
9 | "url": "gitolite@git.immae.eu:perso/florian_telles/stabilo", | 9 | "url": "ssh://gitolite@git.immae.eu/perso/florian_telles/stabilo", |
10 | "rev": "1793d5c7912d1b20ad1df1ac59be9d7f1220e919", | 10 | "rev": "1793d5c7912d1b20ad1df1ac59be9d7f1220e919", |
11 | "sha256": "1zhxcrbglbjb6xfr8sfm4m2miabbkkb0a7543va3b5akrn6yk0cb", | 11 | "sha256": "1zhxcrbglbjb6xfr8sfm4m2miabbkkb0a7543va3b5akrn6yk0cb", |
12 | "fetchSubmodules": true | 12 | "fetchSubmodules": true |