Initial commit published for NURnur_root

13 files changed, 364 insertions, 0 deletions

diff --git a/nixops/.gitignore b/nixops/.gitignore
new file mode 100644
index 00000000..2ea467b8
--- /dev/null
+++ b/nixops/.gitignore
@@ -0,0 +1 @@
+/state
diff --git a/nixops/Makefile b/nixops/Makefile
new file mode 100644
index 00000000..cce57ff4
--- /dev/null
+++ b/nixops/Makefile
@@ -0,0 +1,54 @@
+setup:
+        ./scripts/setup
+
+ssh-eldiron:
+        ./scripts/nixops_wrap ssh eldiron
+
+info:
+        ./scripts/nixops_wrap list
+        ./scripts/nixops_wrap info
+
+debug:
+        ./scripts/nixops_wrap deploy --build-only --show-trace
+
+dry-run:
+        ./scripts/nixops_wrap deploy --dry-run
+
+build:
+        ./scripts/nixops_wrap deploy --build-only
+
+upload:
+        ./scripts/nixops_wrap deploy --copy-only
+
+deploy:
+        ./scripts/nixops_wrap deploy
+
+reboot:
+        ./scripts/nixops_wrap reboot --include=eldiron
+
+push:
+        ./scripts/push_deployment
+        ./scripts/push_environment
+
+pull:
+        ./scripts/pull_environment
+
+pull-deployment:
+        ./scripts/pull_deployment
+
+profile = $(shell ./scripts/nixops_wrap info | grep "^Nix profile: " | sed -e "s/^Nix profile: //")
+GEN ?= "+3"
+
+list-generations:
+        nix-env -p $(profile) --list-generations
+        ./scripts/nixops_wrap ssh eldiron -- nix-env -p /nix/var/nix/profiles/system --list-generations
+
+delete-generations:
+        nix-env -p $(profile) --delete-generations $(GEN)
+        ./scripts/nixops_wrap ssh eldiron -- nix-env -p /nix/var/nix/profiles/system --delete-generations $(GEN)
+
+cleanup: delete-generations
+        nix-store --gc
+        ./scripts/nixops_wrap ssh eldiron -- nix-store --gc
+
+.PHONY: setup ssh-eldiron info debug dry-run build upload deploy push pull pull-deployment list-generations delete-generations cleanup
diff --git a/nixops/custom_nixops.nix b/nixops/custom_nixops.nix
new file mode 100644
index 00000000..f024a4d8
--- /dev/null
+++ b/nixops/custom_nixops.nix
@@ -0,0 +1,2 @@
+with import <nixpkgs> { overlays = builtins.attrValues (import ../overlays); };
+nixops
diff --git a/nixops/eldiron.nix b/nixops/eldiron.nix
new file mode 100644
index 00000000..649e431a
--- /dev/null
+++ b/nixops/eldiron.nix
@@ -0,0 +1,9 @@
+{ privateFiles ? ./. }:
+{
+  network = {
+    description = "Immae's network";
+    enableRollback = true;
+  };
+
+  eldiron = import ../modules/private/system/eldiron.nix { inherit privateFiles; };
+}
diff --git a/nixops/migrate_hetzner.md b/nixops/migrate_hetzner.md
new file mode 100644
index 00000000..c7fbe207
--- /dev/null
+++ b/nixops/migrate_hetzner.md
@@ -0,0 +1,20 @@
+nixops show a deprecation message at each deployment because hetzner
+info is outdated. To fix it:
+
+    cp -a ~/.nixops ~/.nixops.bak
+
+    nixops export --all > all.json
+
+    network=$(cat all.json| jq -r '."cef694f3-081d-11e9-b31f-0242ec186adf".resources.eldiron."hetzner.networkInfo"' | jq -r -c '.networking.interfaces.eth0 = { "ipv4": { "addresses": [ { "address": .networking.interfaces.eth0.ipAddress, "prefixLength": .networking.interfaces.eth0.prefixLength } ] } }')
+
+    cat all.json | jq --arg network "$network" '."cef694f3-081d-11e9-b31f-0242ec186adf".resources.eldiron."hetzner.networkInfo" = $network' > all_new.json
+
+    nixops delete --force -d eldiron
+
+    nixops import < all_new.json
+
+    rm all.json all_new.json
+
+*check that everything works*, then:
+
+    rm -rf ~/.nixops.bak
diff --git a/nixops/scripts/nixops_wrap b/nixops/scripts/nixops_wrap
new file mode 100755
index 00000000..d03784e7
--- /dev/null
+++ b/nixops/scripts/nixops_wrap
@@ -0,0 +1,36 @@
+#!/bin/bash
+
+DeploymentUuid="cef694f3-081d-11e9-b31f-0242ec186adf"
+if [ -z "$NIXOPS_CONFIG_PASS_SUBTREE_PATH" ]; then
+  echo "Please set NIXOPS_CONFIG_PASS_SUBTREE_PATH to the password-store subtree path"
+  exit 1;
+fi
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+export NIXOPS_STATE="$(dirname $DIR)/state/eldiron.nixops"
+export NIXOPS_DEPLOYMENT="$DeploymentUuid"
+source $(dirname $(dirname $DIR))/nix_path_env
+nixops="$(nix-build --no-out-link "$(dirname $DIR)/custom_nixops.nix")/bin/nixops"
+
+TEMP=$(mktemp -d /tmp/XXXXXX-nixops-files)
+chmod go-rwx $TEMP
+
+# __noChroot: ssh-config-file requires relaxed
+export NIX_PATH="ssh-config-file=$(dirname $DIR)/ssh/config:$NIX_PATH"
+
+
+finish() {
+  rm -rf "$TEMP"
+  $nixops set-args --unset privateFiles
+}
+
+trap finish EXIT
+
+# pass cannot "just" list files in a directory without showing a tree :(
+files=$(pass ls $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/files | sed -e '1d' -e 's/^.* //')
+
+for file in $files; do
+  pass show "$NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/files/$file" > $TEMP/$file
+done
+$nixops set-args --argstr privateFiles "$TEMP"
+
+$nixops "$@"
diff --git a/nixops/scripts/pull_deployment b/nixops/scripts/pull_deployment
new file mode 100755
index 00000000..10f71fec
--- /dev/null
+++ b/nixops/scripts/pull_deployment
@@ -0,0 +1,34 @@
+#!/bin/bash
+
+DeploymentUuid="cef694f3-081d-11e9-b31f-0242ec186adf"
+if [ -z "$NIXOPS_CONFIG_PASS_SUBTREE_PATH" ]; then
+  echo "Please set NIXOPS_CONFIG_PASS_SUBTREE_PATH to the password-store subtree path"
+  exit 1;
+fi
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+export NIXOPS_STATE="$(dirname $DIR)/state/eldiron.nixops"
+export NIXOPS_DEPLOYMENT="$DeploymentUuid"
+source $(dirname $(dirname $DIR))/nix_path_env
+nixops="$(nix-build --no-out-link "$(dirname $DIR)/custom_nixops.nix")/bin/nixops"
+
+export NIXOPS_STATE="$(dirname $DIR)/state/eldiron.nixops"
+
+if $nixops info -d $DeploymentUuid 2>/dev/null >/dev/null; then
+  cat <<EOF
+This will remove your current deployment file and recreate it!
+Continue? [y/N]
+EOF
+  read y
+  if [ "$y" = "y" -o "$y" = "Y" ]; then
+    $nixops delete --force -d $DeploymentUuid
+  else
+    echo "Aborting"
+    exit 1
+  fi
+fi
+
+deployment=$(pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/Deployment)
+
+echo "$deployment" | $nixops import
+
+$nixops modify -d "$DeploymentUuid" "$(dirname $DIR)/eldiron.nix"
diff --git a/nixops/scripts/pull_environment b/nixops/scripts/pull_environment
new file mode 100755
index 00000000..e508a2e8
--- /dev/null
+++ b/nixops/scripts/pull_environment
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+if [ -z "$NIXOPS_CONFIG_PASS_SUBTREE_PATH" ]; then
+  echo "Please set NIXOPS_CONFIG_PASS_SUBTREE_PATH to the password-store subtree path"
+  exit 1;
+fi
+
+if [ -z "$NIXOPS_CONFIG_PASS_SUBTREE_REMOTE" ]; then
+  echo "Please set NIXOPS_CONFIG_PASS_SUBTREE_REMOTE to the password-store subtree remote name"
+  exit 1;
+fi
+
+pass git subtree pull --prefix=$NIXOPS_CONFIG_PASS_SUBTREE_PATH $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE master
diff --git a/nixops/scripts/push_deployment b/nixops/scripts/push_deployment
new file mode 100755
index 00000000..6c67fab8
--- /dev/null
+++ b/nixops/scripts/push_deployment
@@ -0,0 +1,14 @@
+#!/bin/bash
+
+DeploymentUuid="cef694f3-081d-11e9-b31f-0242ec186adf"
+if [ -z "$NIXOPS_CONFIG_PASS_SUBTREE_PATH" ]; then
+  echo "Please set NIXOPS_CONFIG_PASS_SUBTREE_PATH to the password-store subtree path"
+  exit 1;
+fi
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+export NIXOPS_STATE="$(dirname $DIR)/state/eldiron.nixops"
+export NIXOPS_DEPLOYMENT="$DeploymentUuid"
+source $(dirname $(dirname $DIR))/nix_path_env
+nixops="$(nix-build --no-out-link "$(dirname $DIR)/custom_nixops.nix")/bin/nixops"
+
+$nixops export | pass insert -m $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/Deployment
diff --git a/nixops/scripts/push_environment b/nixops/scripts/push_environment
new file mode 100755
index 00000000..8b59240e
--- /dev/null
+++ b/nixops/scripts/push_environment
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+if [ -z "$NIXOPS_CONFIG_PASS_SUBTREE_PATH" ]; then
+  echo "Please set NIXOPS_CONFIG_PASS_SUBTREE_PATH to the password-store subtree path"
+  exit 1;
+fi
+
+if [ -z "$NIXOPS_CONFIG_PASS_SUBTREE_REMOTE" ]; then
+  echo "Please set NIXOPS_CONFIG_PASS_SUBTREE_REMOTE to the password-store subtree remote name"
+  exit 1;
+fi
+
+pass git subtree push --prefix=$NIXOPS_CONFIG_PASS_SUBTREE_PATH $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE master
diff --git a/nixops/scripts/setup b/nixops/scripts/setup
new file mode 100755
index 00000000..1586265d
--- /dev/null
+++ b/nixops/scripts/setup
@@ -0,0 +1,163 @@
+#!/bin/bash
+
+set -euo pipefail
+
+RemoteRepo="gitolite@git.immae.eu:perso/Immae/Prive/Password_store/Sites"
+DeploymentUuid="cef694f3-081d-11e9-b31f-0242ec186adf"
+
+if ! which nix 2>/dev/null >/dev/null; then
+  cat <<-EOF
+        nix is needed, please install it:
+        > curl https://nixos.org/nix/install | sh
+        (or any other way handled by your distribution)
+        EOF
+  exit 1
+fi
+
+if [ "${NIX_STORE:-/nix/store}" != "/nix/store" ]; then
+  cat <<-EOF
+        Nix store outside of /nix/store is not supported
+        EOF
+  exit 1
+fi
+
+if [ -z "$NIXOPS_CONFIG_PASS_SUBTREE_REMOTE" \
+    -o -z "$NIXOPS_CONFIG_PASS_SUBTREE_PATH" ]; then
+  cat <<-EOF
+        Two environment variables are needed to setup the password store:
+        NIXOPS_CONFIG_PASS_SUBTREE_PATH : path where the subtree will be imported
+        NIXOPS_CONFIG_PASS_SUBTREE_REMOTE : remote name to give to the repository
+        EOF
+  exit 1
+fi
+
+if ! pass $NIXOPS_CONFIG_PASS_SUBTREE_PATH > /dev/null 2>/dev/null; then
+  cat <<-EOF
+        /!\ This will modify your password store to add and import a subtree
+        with the specific passwords files. Choose a path that doesn’t exist
+        yet in your password store.
+        > pass git remote add $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE $RemoteRepo
+        > pass git subtree add --prefix=$NIXOPS_CONFIG_PASS_SUBTREE_PATH $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE master
+        Later, you can use pull_environment and push_environment scripts to
+        update the passwords when needed
+        Continue? [y/N]
+        EOF
+  read y
+  if [ "$y" = "y" -o "$y" = "Y" ]; then
+    pass git remote add $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE $RemoteRepo
+    pass git subtree add --prefix=$NIXOPS_CONFIG_PASS_SUBTREE_PATH $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE master
+  else
+    echo "Aborting"
+    exit 1
+  fi
+fi
+
+# Repull it before using it, just in case
+pass git subtree pull --prefix=$NIXOPS_CONFIG_PASS_SUBTREE_PATH $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE master
+
+gpg_keys=$(pass ls $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/GPGKeys | sed -e "1d" | cut -d" " -f2)
+for key in $gpg_keys; do
+  content=$(pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/GPGKeys/$key)
+  fpr=$(echo "$content" | gpg --import-options show-only --import --with-colons | grep -e "^pub" | cut -d':' -f5)
+  gpg --list-key "$fpr" >/dev/null 2>/dev/null && imported=yes || imported=no
+  # /usr/share/doc/gnupg/DETAILS field 2
+  (echo "$content" | gpg --import-options show-only --import --with-colons |
+      grep -E '^pub:' |
+      cut -d':' -f2 |
+      grep -q '[fu]') && signed=yes || signed=no
+  if [ "$signed" = no -o "$imported" = no ] ; then
+    echo "The key for $key needs to be imported and signed (a local signature is enough)"
+    echo "$content" | gpg --import-options show-only --import
+    echo "Continue? [y/N]"
+    read y
+    if [ "$y" = "y" -o "$y" = "Y" ]; then
+      echo "$content" | gpg --import
+      gpg --expert --edit-key "$fpr" lsign quit
+    else
+      echo "Aborting"
+      exit 1
+    fi
+  fi
+done
+
+nix_group=$(stat -c %G /nix/store)
+if [ "$nix_group" = "nixbld" ]; then
+  nix_user="nixbld1"
+else
+  nix_user="$(stat -c %U /nix/store)"
+fi
+
+if [ ! -f /etc/ssh/ssh_rsa_key_nixops ]; then
+  cat <<-EOF
+        The key to access private git repositories (websites hosted by the
+        server) needs to be accessible to nix builders. It will be put in
+        /etc/ssh/ssh_rsa_key_nixops (sudo right is needed for that)
+        > pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/SshKey | sudo tee /etc/ssh/ssh_rsa_key_nixops > /dev/null
+        > pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/SshKey.pub | sudo tee /etc/ssh/ssh_rsa_key_nixops.pub > /dev/null
+        > sudo chmod u=r,go-rwx /etc/ssh/ssh_rsa_key_nixops
+        > sudo chown $nix_user:$nix_group /etc/ssh/ssh_rsa_key_nixops /etc/ssh/ssh_rsa_key_nixops.pub
+        Continue? [y/N]
+        EOF
+  read y
+  if [ "$y" = "y" -o "$y" = "Y" ]; then
+    if ! id -u $nix_user 2>/dev/null >/dev/null; then
+      echo "User $nix_user seems inexistant, did you install nix?"
+      exit 1
+    fi
+    mask=$(umask)
+    umask 0777
+    # Don’t forward it directly to tee, it would break ncurse pinentry
+    key=$(pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/SshKey)
+    echo "$key" | sudo tee /etc/ssh/ssh_rsa_key_nixops > /dev/null
+    sudo chmod u=r,go=- /etc/ssh/ssh_rsa_key_nixops
+    pubkey=$(pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/SshKey.pub)
+    echo "$pubkey" | sudo tee /etc/ssh/ssh_rsa_key_nixops.pub > /dev/null
+    sudo chmod a=r /etc/ssh/ssh_rsa_key_nixops.pub
+    sudo chown $nix_user:$nix_group /etc/ssh/ssh_rsa_key_nixops /etc/ssh/ssh_rsa_key_nixops.pub
+    umask $mask
+  else
+    echo "Aborting"
+    exit 1
+  fi
+fi
+
+if nix show-config --json | jq -e '.sandbox.value == "true"' >/dev/null; then
+  cat <<-EOF
+        There are some impure derivations in the repo currently (grep __noChroot), please put
+          sandbox = "relaxed"
+        in /etc/nix/nix.conf
+        you may also want to add
+          keep-outputs = true
+          keep-derivations = true
+        to prevent garbage collector from deleting build dependencies (they take a lot of time to build)
+        EOF
+  exit 1
+fi
+
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+source $(dirname $(dirname $DIR))/nix_path_env
+nixops="$(nix-build --no-out-link "$(dirname $DIR)/custom_nixops.nix")/bin/nixops"
+export NIXOPS_STATE="$(dirname $DIR)/state/eldiron.nixops"
+export NIXOPS_DEPLOYMENT="$DeploymentUuid"
+
+if ! $nixops info 2>/dev/null >/dev/null; then
+  cat <<-EOF
+        Importing deployment file into nixops:
+        Continue? [y/N]
+        EOF
+  read y
+  if [ "$y" = "y" -o "$y" = "Y" ]; then
+    deployment=$(pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/Deployment)
+    echo "$deployment" | $nixops import
+
+    $nixops modify "$(dirname $DIR)/eldiron.nix"
+  else
+    echo "Aborting"
+    exit 1
+  fi
+fi
+
+cat <<-EOF
+        All set up.
+        Please make sure you’re using scripts/nixops_wrap when deploying
+        EOF
diff --git a/nixops/ssh/config b/nixops/ssh/config
new file mode 100644
index 00000000..3d4dc3e4
--- /dev/null
+++ b/nixops/ssh/config
@@ -0,0 +1,5 @@
+Host git.immae.eu
+IdentityFile /etc/ssh/ssh_rsa_key_nixops
+StrictHostKeyChecking no
+UserKnownHostsFile /dev/null
+CheckHostIP no
diff --git a/nixops/state/.gitkeep b/nixops/state/.gitkeep
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/nixops/state/.gitkeep