From 252dd7d899b7a0deea1537cc5d2d48b825afffb0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= Date: Thu, 13 Dec 2018 21:25:24 +0100 Subject: Initial commit published for NUR --- nixops/.gitignore | 1 + nixops/Makefile | 54 +++++++++++++ nixops/custom_nixops.nix | 2 + nixops/eldiron.nix | 9 +++ nixops/migrate_hetzner.md | 20 +++++ nixops/scripts/nixops_wrap | 36 +++++++++ nixops/scripts/pull_deployment | 34 +++++++++ nixops/scripts/pull_environment | 13 ++++ nixops/scripts/push_deployment | 14 ++++ nixops/scripts/push_environment | 13 ++++ nixops/scripts/setup | 163 ++++++++++++++++++++++++++++++++++++++++ nixops/ssh/config | 5 ++ nixops/state/.gitkeep | 0 13 files changed, 364 insertions(+) create mode 100644 nixops/.gitignore create mode 100644 nixops/Makefile create mode 100644 nixops/custom_nixops.nix create mode 100644 nixops/eldiron.nix create mode 100644 nixops/migrate_hetzner.md create mode 100755 nixops/scripts/nixops_wrap create mode 100755 nixops/scripts/pull_deployment create mode 100755 nixops/scripts/pull_environment create mode 100755 nixops/scripts/push_deployment create mode 100755 nixops/scripts/push_environment create mode 100755 nixops/scripts/setup create mode 100644 nixops/ssh/config create mode 100644 nixops/state/.gitkeep (limited to 'nixops') diff --git a/nixops/.gitignore b/nixops/.gitignore new file mode 100644 index 00000000..2ea467b8 --- /dev/null +++ b/nixops/.gitignore @@ -0,0 +1 @@ +/state diff --git a/nixops/Makefile b/nixops/Makefile new file mode 100644 index 00000000..cce57ff4 --- /dev/null +++ b/nixops/Makefile @@ -0,0 +1,54 @@ +setup: + ./scripts/setup + +ssh-eldiron: + ./scripts/nixops_wrap ssh eldiron + +info: + ./scripts/nixops_wrap list + ./scripts/nixops_wrap info + +debug: + ./scripts/nixops_wrap deploy --build-only --show-trace + +dry-run: + ./scripts/nixops_wrap deploy --dry-run + +build: + ./scripts/nixops_wrap deploy --build-only + +upload: + ./scripts/nixops_wrap deploy --copy-only + +deploy: + ./scripts/nixops_wrap deploy + +reboot: + ./scripts/nixops_wrap reboot --include=eldiron + +push: + ./scripts/push_deployment + ./scripts/push_environment + +pull: + ./scripts/pull_environment + +pull-deployment: + ./scripts/pull_deployment + +profile = $(shell ./scripts/nixops_wrap info | grep "^Nix profile: " | sed -e "s/^Nix profile: //") +GEN ?= "+3" + +list-generations: + nix-env -p $(profile) --list-generations + ./scripts/nixops_wrap ssh eldiron -- nix-env -p /nix/var/nix/profiles/system --list-generations + +delete-generations: + nix-env -p $(profile) --delete-generations $(GEN) + ./scripts/nixops_wrap ssh eldiron -- nix-env -p /nix/var/nix/profiles/system --delete-generations $(GEN) + +cleanup: delete-generations + nix-store --gc + ./scripts/nixops_wrap ssh eldiron -- nix-store --gc + +.PHONY: setup ssh-eldiron info debug dry-run build upload deploy push pull pull-deployment list-generations delete-generations cleanup diff --git a/nixops/custom_nixops.nix b/nixops/custom_nixops.nix new file mode 100644 index 00000000..f024a4d8 --- /dev/null +++ b/nixops/custom_nixops.nix @@ -0,0 +1,2 @@ +with import { overlays = builtins.attrValues (import ../overlays); }; +nixops diff --git a/nixops/eldiron.nix b/nixops/eldiron.nix new file mode 100644 index 00000000..649e431a --- /dev/null +++ b/nixops/eldiron.nix @@ -0,0 +1,9 @@ +{ privateFiles ? ./. }: +{ + network = { + description = "Immae's network"; + enableRollback = true; + }; + + eldiron = import ../modules/private/system/eldiron.nix { inherit privateFiles; }; +} diff --git a/nixops/migrate_hetzner.md b/nixops/migrate_hetzner.md new file mode 100644 index 00000000..c7fbe207 --- /dev/null +++ b/nixops/migrate_hetzner.md @@ -0,0 +1,20 @@ +nixops show a deprecation message at each deployment because hetzner +info is outdated. To fix it: + + cp -a ~/.nixops ~/.nixops.bak + + nixops export --all > all.json + + network=$(cat all.json| jq -r '."cef694f3-081d-11e9-b31f-0242ec186adf".resources.eldiron."hetzner.networkInfo"' | jq -r -c '.networking.interfaces.eth0 = { "ipv4": { "addresses": [ { "address": .networking.interfaces.eth0.ipAddress, "prefixLength": .networking.interfaces.eth0.prefixLength } ] } }') + + cat all.json | jq --arg network "$network" '."cef694f3-081d-11e9-b31f-0242ec186adf".resources.eldiron."hetzner.networkInfo" = $network' > all_new.json + + nixops delete --force -d eldiron + + nixops import < all_new.json + + rm all.json all_new.json + +*check that everything works*, then: + + rm -rf ~/.nixops.bak diff --git a/nixops/scripts/nixops_wrap b/nixops/scripts/nixops_wrap new file mode 100755 index 00000000..d03784e7 --- /dev/null +++ b/nixops/scripts/nixops_wrap @@ -0,0 +1,36 @@ +#!/bin/bash + +DeploymentUuid="cef694f3-081d-11e9-b31f-0242ec186adf" +if [ -z "$NIXOPS_CONFIG_PASS_SUBTREE_PATH" ]; then + echo "Please set NIXOPS_CONFIG_PASS_SUBTREE_PATH to the password-store subtree path" + exit 1; +fi +DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" +export NIXOPS_STATE="$(dirname $DIR)/state/eldiron.nixops" +export NIXOPS_DEPLOYMENT="$DeploymentUuid" +source $(dirname $(dirname $DIR))/nix_path_env +nixops="$(nix-build --no-out-link "$(dirname $DIR)/custom_nixops.nix")/bin/nixops" + +TEMP=$(mktemp -d /tmp/XXXXXX-nixops-files) +chmod go-rwx $TEMP + +# __noChroot: ssh-config-file requires relaxed +export NIX_PATH="ssh-config-file=$(dirname $DIR)/ssh/config:$NIX_PATH" + + +finish() { + rm -rf "$TEMP" + $nixops set-args --unset privateFiles +} + +trap finish EXIT + +# pass cannot "just" list files in a directory without showing a tree :( +files=$(pass ls $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/files | sed -e '1d' -e 's/^.* //') + +for file in $files; do + pass show "$NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/files/$file" > $TEMP/$file +done +$nixops set-args --argstr privateFiles "$TEMP" + +$nixops "$@" diff --git a/nixops/scripts/pull_deployment b/nixops/scripts/pull_deployment new file mode 100755 index 00000000..10f71fec --- /dev/null +++ b/nixops/scripts/pull_deployment @@ -0,0 +1,34 @@ +#!/bin/bash + +DeploymentUuid="cef694f3-081d-11e9-b31f-0242ec186adf" +if [ -z "$NIXOPS_CONFIG_PASS_SUBTREE_PATH" ]; then + echo "Please set NIXOPS_CONFIG_PASS_SUBTREE_PATH to the password-store subtree path" + exit 1; +fi +DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" +export NIXOPS_STATE="$(dirname $DIR)/state/eldiron.nixops" +export NIXOPS_DEPLOYMENT="$DeploymentUuid" +source $(dirname $(dirname $DIR))/nix_path_env +nixops="$(nix-build --no-out-link "$(dirname $DIR)/custom_nixops.nix")/bin/nixops" + +export NIXOPS_STATE="$(dirname $DIR)/state/eldiron.nixops" + +if $nixops info -d $DeploymentUuid 2>/dev/null >/dev/null; then + cat </dev/null 2>&1 && pwd )" +export NIXOPS_STATE="$(dirname $DIR)/state/eldiron.nixops" +export NIXOPS_DEPLOYMENT="$DeploymentUuid" +source $(dirname $(dirname $DIR))/nix_path_env +nixops="$(nix-build --no-out-link "$(dirname $DIR)/custom_nixops.nix")/bin/nixops" + +$nixops export | pass insert -m $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/Deployment diff --git a/nixops/scripts/push_environment b/nixops/scripts/push_environment new file mode 100755 index 00000000..8b59240e --- /dev/null +++ b/nixops/scripts/push_environment @@ -0,0 +1,13 @@ +#!/bin/bash + +if [ -z "$NIXOPS_CONFIG_PASS_SUBTREE_PATH" ]; then + echo "Please set NIXOPS_CONFIG_PASS_SUBTREE_PATH to the password-store subtree path" + exit 1; +fi + +if [ -z "$NIXOPS_CONFIG_PASS_SUBTREE_REMOTE" ]; then + echo "Please set NIXOPS_CONFIG_PASS_SUBTREE_REMOTE to the password-store subtree remote name" + exit 1; +fi + +pass git subtree push --prefix=$NIXOPS_CONFIG_PASS_SUBTREE_PATH $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE master diff --git a/nixops/scripts/setup b/nixops/scripts/setup new file mode 100755 index 00000000..1586265d --- /dev/null +++ b/nixops/scripts/setup @@ -0,0 +1,163 @@ +#!/bin/bash + +set -euo pipefail + +RemoteRepo="gitolite@git.immae.eu:perso/Immae/Prive/Password_store/Sites" +DeploymentUuid="cef694f3-081d-11e9-b31f-0242ec186adf" + +if ! which nix 2>/dev/null >/dev/null; then + cat <<-EOF + nix is needed, please install it: + > curl https://nixos.org/nix/install | sh + (or any other way handled by your distribution) + EOF + exit 1 +fi + +if [ "${NIX_STORE:-/nix/store}" != "/nix/store" ]; then + cat <<-EOF + Nix store outside of /nix/store is not supported + EOF + exit 1 +fi + +if [ -z "$NIXOPS_CONFIG_PASS_SUBTREE_REMOTE" \ + -o -z "$NIXOPS_CONFIG_PASS_SUBTREE_PATH" ]; then + cat <<-EOF + Two environment variables are needed to setup the password store: + NIXOPS_CONFIG_PASS_SUBTREE_PATH : path where the subtree will be imported + NIXOPS_CONFIG_PASS_SUBTREE_REMOTE : remote name to give to the repository + EOF + exit 1 +fi + +if ! pass $NIXOPS_CONFIG_PASS_SUBTREE_PATH > /dev/null 2>/dev/null; then + cat <<-EOF + /!\ This will modify your password store to add and import a subtree + with the specific passwords files. Choose a path that doesn’t exist + yet in your password store. + > pass git remote add $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE $RemoteRepo + > pass git subtree add --prefix=$NIXOPS_CONFIG_PASS_SUBTREE_PATH $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE master + Later, you can use pull_environment and push_environment scripts to + update the passwords when needed + Continue? [y/N] + EOF + read y + if [ "$y" = "y" -o "$y" = "Y" ]; then + pass git remote add $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE $RemoteRepo + pass git subtree add --prefix=$NIXOPS_CONFIG_PASS_SUBTREE_PATH $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE master + else + echo "Aborting" + exit 1 + fi +fi + +# Repull it before using it, just in case +pass git subtree pull --prefix=$NIXOPS_CONFIG_PASS_SUBTREE_PATH $NIXOPS_CONFIG_PASS_SUBTREE_REMOTE master + +gpg_keys=$(pass ls $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/GPGKeys | sed -e "1d" | cut -d" " -f2) +for key in $gpg_keys; do + content=$(pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/GPGKeys/$key) + fpr=$(echo "$content" | gpg --import-options show-only --import --with-colons | grep -e "^pub" | cut -d':' -f5) + gpg --list-key "$fpr" >/dev/null 2>/dev/null && imported=yes || imported=no + # /usr/share/doc/gnupg/DETAILS field 2 + (echo "$content" | gpg --import-options show-only --import --with-colons | + grep -E '^pub:' | + cut -d':' -f2 | + grep -q '[fu]') && signed=yes || signed=no + if [ "$signed" = no -o "$imported" = no ] ; then + echo "The key for $key needs to be imported and signed (a local signature is enough)" + echo "$content" | gpg --import-options show-only --import + echo "Continue? [y/N]" + read y + if [ "$y" = "y" -o "$y" = "Y" ]; then + echo "$content" | gpg --import + gpg --expert --edit-key "$fpr" lsign quit + else + echo "Aborting" + exit 1 + fi + fi +done + +nix_group=$(stat -c %G /nix/store) +if [ "$nix_group" = "nixbld" ]; then + nix_user="nixbld1" +else + nix_user="$(stat -c %U /nix/store)" +fi + +if [ ! -f /etc/ssh/ssh_rsa_key_nixops ]; then + cat <<-EOF + The key to access private git repositories (websites hosted by the + server) needs to be accessible to nix builders. It will be put in + /etc/ssh/ssh_rsa_key_nixops (sudo right is needed for that) + > pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/SshKey | sudo tee /etc/ssh/ssh_rsa_key_nixops > /dev/null + > pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/SshKey.pub | sudo tee /etc/ssh/ssh_rsa_key_nixops.pub > /dev/null + > sudo chmod u=r,go-rwx /etc/ssh/ssh_rsa_key_nixops + > sudo chown $nix_user:$nix_group /etc/ssh/ssh_rsa_key_nixops /etc/ssh/ssh_rsa_key_nixops.pub + Continue? [y/N] + EOF + read y + if [ "$y" = "y" -o "$y" = "Y" ]; then + if ! id -u $nix_user 2>/dev/null >/dev/null; then + echo "User $nix_user seems inexistant, did you install nix?" + exit 1 + fi + mask=$(umask) + umask 0777 + # Don’t forward it directly to tee, it would break ncurse pinentry + key=$(pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/SshKey) + echo "$key" | sudo tee /etc/ssh/ssh_rsa_key_nixops > /dev/null + sudo chmod u=r,go=- /etc/ssh/ssh_rsa_key_nixops + pubkey=$(pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/SshKey.pub) + echo "$pubkey" | sudo tee /etc/ssh/ssh_rsa_key_nixops.pub > /dev/null + sudo chmod a=r /etc/ssh/ssh_rsa_key_nixops.pub + sudo chown $nix_user:$nix_group /etc/ssh/ssh_rsa_key_nixops /etc/ssh/ssh_rsa_key_nixops.pub + umask $mask + else + echo "Aborting" + exit 1 + fi +fi + +if nix show-config --json | jq -e '.sandbox.value == "true"' >/dev/null; then + cat <<-EOF + There are some impure derivations in the repo currently (grep __noChroot), please put + sandbox = "relaxed" + in /etc/nix/nix.conf + you may also want to add + keep-outputs = true + keep-derivations = true + to prevent garbage collector from deleting build dependencies (they take a lot of time to build) + EOF + exit 1 +fi + +DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" +source $(dirname $(dirname $DIR))/nix_path_env +nixops="$(nix-build --no-out-link "$(dirname $DIR)/custom_nixops.nix")/bin/nixops" +export NIXOPS_STATE="$(dirname $DIR)/state/eldiron.nixops" +export NIXOPS_DEPLOYMENT="$DeploymentUuid" + +if ! $nixops info 2>/dev/null >/dev/null; then + cat <<-EOF + Importing deployment file into nixops: + Continue? [y/N] + EOF + read y + if [ "$y" = "y" -o "$y" = "Y" ]; then + deployment=$(pass show $NIXOPS_CONFIG_PASS_SUBTREE_PATH/Nixops/Deployment) + echo "$deployment" | $nixops import + + $nixops modify "$(dirname $DIR)/eldiron.nix" + else + echo "Aborting" + exit 1 + fi +fi + +cat <<-EOF + All set up. + Please make sure you’re using scripts/nixops_wrap when deploying + EOF diff --git a/nixops/ssh/config b/nixops/ssh/config new file mode 100644 index 00000000..3d4dc3e4 --- /dev/null +++ b/nixops/ssh/config @@ -0,0 +1,5 @@ +Host git.immae.eu +IdentityFile /etc/ssh/ssh_rsa_key_nixops +StrictHostKeyChecking no +UserKnownHostsFile /dev/null +CheckHostIP no diff --git a/nixops/state/.gitkeep b/nixops/state/.gitkeep new file mode 100644 index 00000000..e69de29b -- cgit v1.2.3