From 568d4240fa2d4b1f29cc1dd6d943a2da941ef46e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= Date: Fri, 1 Feb 2019 14:39:59 +0100 Subject: Complete setup script to import deployment file --- nixops/scripts/setup | 132 ++++++++++++++++++++++++++++++++++++--------------- 1 file changed, 93 insertions(+), 39 deletions(-) (limited to 'nixops/scripts/setup') diff --git a/nixops/scripts/setup b/nixops/scripts/setup index d9d4258..bb433ba 100755 --- a/nixops/scripts/setup +++ b/nixops/scripts/setup @@ -3,28 +3,38 @@ RemoteRepo="gitolite@git.immae.eu:perso/Immae/Prive/Password_store/Mes_Sites/Paul" NixChannelUrl='https://releases.nixos.org/nixos/18.09/nixos-18.09.1834.9d608a6f592' NixChannelName='immaeNixpkgs' +DeploymentUuid="cef694f3-081d-11e9-b31f-0242ec186adf" + +if ! which nix 2>/dev/null >/dev/null; then + cat <<-EOF + nix is needed, please install it: + > curl https://nixos.org/nix/install | sh + (or any other way handled by your distribution) + EOF + exit 1 +fi if [ -z "$NIXOPS_CONFIG_PASS_SUBTREE_REMOTE" \ -o -z "$NIXOPS_CONFIG_PASS_SUBTREE_PATH" ]; then cat <<-EOF -Two environment variables are needed to setup the password store: -NIXOPS_CONFIG_PASS_SUBTREE_PATH : path where the subtree will be imported -NIXOPS_CONFIG_PASS_SUBTREE_REMOTE : remote name to give to the repository -EOF + Two environment variables are needed to setup the password store: + NIXOPS_CONFIG_PASS_SUBTREE_PATH : path where the subtree will be imported + NIXOPS_CONFIG_PASS_SUBTREE_REMOTE : remote name to give to the repository + EOF exit 1 fi if ! pass $NIXOPS_CONFIG_PASS_SUBTREE_PATH > /dev/null 2>/dev/null; then cat <<-EOF -/!\ This will modify your password store to add and import a subtree -with the specific passwords files. Choose a path that doesn’t exist -yet in your password store. -> pass git remote add $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE $RemoteRepo -> pass git subtree add --prefix=$NIXOPS_CONFIG_PASS_SUBTREE_PATH $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE master -Later, you can use pull_environment and push_environment scripts to -update the passwords when needed -Continue? [y/N] -EOF + /!\ This will modify your password store to add and import a subtree + with the specific passwords files. Choose a path that doesn’t exist + yet in your password store. + > pass git remote add $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE $RemoteRepo + > pass git subtree add --prefix=$NIXOPS_CONFIG_PASS_SUBTREE_PATH $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE master + Later, you can use pull_environment and push_environment scripts to + update the passwords when needed + Continue? [y/N] + EOF read y if [ "$y" = "y" -o "$y" = "Y" ]; then pass git remote add $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE $RemoteRepo @@ -36,16 +46,16 @@ EOF fi if [ ! -f /etc/ssh/ssh_rsa_key_nixops ]; then - cat < pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/NixSshKey | sudo tee /etc/ssh/ssh_rsa_key_nixops > /dev/null -> pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/NixSshKey.pub | sudo tee /etc/ssh/ssh_rsa_key_nixops.pub > /dev/null -> sudo chmod u=r,go-rwx /etc/ssh/ssh_rsa_key_nixops -> sudo chown nixbld1:nixbld /etc/ssh/ssh_rsa_key_nixops /etc/ssh/ssh_rsa_key_nixops.pub -Continue? [y/N] -EOF + cat <<-EOF + The key to access private git repositories (websites hosted by the + server) needs to be accessible to nix builders. It will be put in + /etc/ssh/ssh_rsa_key_nixops (sudo right is needed for that) + > pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/NixSshKey | sudo tee /etc/ssh/ssh_rsa_key_nixops > /dev/null + > pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/NixSshKey.pub | sudo tee /etc/ssh/ssh_rsa_key_nixops.pub > /dev/null + > sudo chmod u=r,go-rwx /etc/ssh/ssh_rsa_key_nixops + > sudo chown nixbld1:nixbld /etc/ssh/ssh_rsa_key_nixops /etc/ssh/ssh_rsa_key_nixops.pub + Continue? [y/N] + EOF read y if [ "$y" = "y" -o "$y" = "Y" ]; then if ! id -u nixbld1 2>/dev/null >/dev/null; then @@ -70,26 +80,70 @@ EOF fi if ! nix-channel --list | grep -q "$NixChannelName $NixChannelUrl"; then -cat < nix-channel --add $NixChannelUrl $NixChannelName -> nix-channel --update -If this step fail, you may have to disable sandboxing in -/etc/nix/nix.conf and rerun -> nix-channel --update -manually. -Continue? [y/N] -EOF + cat <<-EOF + A new nix channel will be installed (or upgraded) to freeze the packages + version: + $NixChannelName $NixChannelUrl + > nix-channel --add $NixChannelUrl $NixChannelName + > nix-channel --update + If this step fail, you may have to disable sandboxing in + /etc/nix/nix.conf and rerun + > nix-channel --update + manually. + Continue? [y/N] + EOF read y if [ "$y" = "y" -o "$y" = "Y" ]; then nix-channel --add $NixChannelUrl $NixChannelName nix-channel --update + else + echo "Aborting" + exit 1 + fi +fi + +if ! which nixops 2>/dev/null >/dev/null; then + cat <<-EOF + nixops is needed: + > nix-env -i nixops + If it fails, please check that $HOME/.nix-profile/bin is in your PATH. + Continue? [y/N] + EOF + read y + if [ "$y" = "y" -o "$y" = "Y" ]; then + nix-env -i nixops + if ! which nixops 2>/dev/null >/dev/null; then + echo "Installation failed, please check that $HOME/.nix-profile/bin is in your path." + exit 1 + fi + else + echo "Aborting" + exit 1 + fi +fi + +DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" +export NIXOPS_STATE="$(dirname $DIR)/state/eldiron.nixops" +export NIXOPS_DEPLOYMENT="$DeploymentUuid" + +if ! nixops info 2>/dev/null >/dev/null; then + cat <<-EOF + Importing deployment file into nixops: + Continue? [y/N] + EOF + read y + if [ "$y" = "y" -o "$y" = "Y" ]; then + deployment=$(pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/NixDeployment) + echo "$deployment" | nixops import + + nixops modify "$(dirname $DIR)/eldiron.nix" + else + echo "Aborting" + exit 1 fi fi -cat <