Flakify lib, sas
Signed-off-by: Nikolaos Karaolidis <nick@karaolidis.com>
This commit is contained in:
209
scripts/add-host.sh
Executable file
209
scripts/add-host.sh
Executable file
@@ -0,0 +1,209 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -o errexit
|
||||
set -o nounset
|
||||
set -o pipefail
|
||||
|
||||
if [[ "$#" -ne 1 ]]; then
|
||||
echo "Usage: $0 <host>"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
host="$1"
|
||||
|
||||
mkdir -p "./secrets/hosts/$host"
|
||||
ssh-keygen -t ed25519 -f "./secrets/hosts/$host/ssh_host_ed25519_key" -C "root@$host" -N ""
|
||||
age_key=$(ssh-to-age < "./secrets/hosts/$host/ssh_host_ed25519_key.pub")
|
||||
|
||||
cat <<EOF > "./secrets/hosts/$host/sops.yaml"
|
||||
keys:
|
||||
- hosts:
|
||||
- &$host $age_key
|
||||
- namespaces:
|
||||
- &personal $(age-keygen -y ./secrets/domains/personal/key.txt | tr -d '\n')
|
||||
|
||||
creation_rules:
|
||||
- path_regex: .+\.(yaml|yml|json|env|ini|bin)
|
||||
key_groups:
|
||||
- age:
|
||||
- *$host
|
||||
- *personal
|
||||
EOF
|
||||
|
||||
luks=""
|
||||
luks_confirm=""
|
||||
|
||||
until [[ "$luks" == "$luks_confirm" && -n "$luks" ]]; do
|
||||
read -r -s -p "Enter LUKS passphrase for $host: " luks
|
||||
echo
|
||||
read -r -s -p "Confirm LUKS passphrase for $host: " luks_confirm
|
||||
echo
|
||||
|
||||
if [[ "$luks" != "$luks_confirm" ]]; then
|
||||
echo "They didn't match. Let's try again."
|
||||
fi
|
||||
done
|
||||
|
||||
machine_id=$(uuidgen -r | tr -d -)
|
||||
|
||||
cat <<EOF > "./secrets/hosts/$host/.decrypted~secrets.yaml"
|
||||
luks: '$luks'
|
||||
machineId: $machine_id
|
||||
EOF
|
||||
|
||||
tmp_age_key="$(mktemp)"
|
||||
echo "$age_key" > "$tmp_age_key"
|
||||
export SOPS_AGE_KEY_FILE="$tmp_age_key"
|
||||
|
||||
sops --config "./secrets/hosts/$host/sops.yaml" --encrypt "./secrets/hosts/$host/.decrypted~secrets.yaml" > "./secrets/hosts/$host/secrets.yaml"
|
||||
|
||||
unset SOPS_AGE_KEY_FILE
|
||||
rm -f "$tmp_age_key"
|
||||
rm -f "./secrets/hosts/$host/.decrypted~secrets.yaml"
|
||||
|
||||
mkdir -p "./hosts/$host/hardware"
|
||||
|
||||
cat <<'EOF' > "./hosts/$host/hardware/default.nix"
|
||||
{ ... }:
|
||||
{
|
||||
|
||||
}
|
||||
EOF
|
||||
|
||||
cat <<'EOF' > "./hosts/$host/format.nix"
|
||||
{
|
||||
disko.devices = {
|
||||
disk.main = {
|
||||
device = ""; # TODO: Set this to the device you want to install to
|
||||
type = "disk";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
boot = {
|
||||
name = "boot";
|
||||
size = "1M";
|
||||
type = "EF02";
|
||||
};
|
||||
esp = {
|
||||
name = "esp";
|
||||
size = "512M";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
mountOptions = [ "umask=0077" ];
|
||||
};
|
||||
};
|
||||
swap = {
|
||||
name = "swap";
|
||||
size = ""; # TODO: Set this to the swap size you want
|
||||
content = {
|
||||
type = "swap";
|
||||
resumeDevice = true;
|
||||
};
|
||||
};
|
||||
root = {
|
||||
name = "root";
|
||||
size = "100%";
|
||||
content = {
|
||||
name = "main";
|
||||
type = "luks";
|
||||
passwordFile = "/tmp/keyfile";
|
||||
settings = {
|
||||
allowDiscards = true;
|
||||
};
|
||||
content = {
|
||||
type = "btrfs";
|
||||
extraArgs = [ "-f" ];
|
||||
subvolumes =
|
||||
let
|
||||
mountOptions = [
|
||||
"compress=zstd:1"
|
||||
"noatime"
|
||||
];
|
||||
in
|
||||
{
|
||||
"@" = {
|
||||
mountpoint = "/";
|
||||
inherit mountOptions;
|
||||
};
|
||||
"@persist" = {
|
||||
mountpoint = "/persist";
|
||||
inherit mountOptions;
|
||||
};
|
||||
"@persist/user" = {
|
||||
mountpoint = "/persist/user";
|
||||
inherit mountOptions;
|
||||
};
|
||||
"@persist/state" = {
|
||||
mountpoint = "/persist/state";
|
||||
inherit mountOptions;
|
||||
};
|
||||
"@persist/cache" = {
|
||||
mountpoint = "/persist/cache";
|
||||
inherit mountOptions;
|
||||
};
|
||||
"@nix" = {
|
||||
mountpoint = "/nix";
|
||||
inherit mountOptions;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
EOF
|
||||
|
||||
cat <<EOF > "./hosts/$host/default.nix"
|
||||
{ inputs, ... }:
|
||||
{
|
||||
imports = [
|
||||
inputs.disko.nixosModules.disko
|
||||
./format.nix
|
||||
./hardware
|
||||
|
||||
../common/configs/system
|
||||
|
||||
../common/configs/system/boot
|
||||
../common/configs/system/btrfs
|
||||
../common/configs/system/documentation
|
||||
../common/configs/system/impermanence
|
||||
../common/configs/system/nix
|
||||
../common/configs/system/nix-cleanup
|
||||
../common/configs/system/nixpkgs
|
||||
../common/configs/system/ntp
|
||||
../common/configs/system/sops
|
||||
../common/configs/system/system
|
||||
../common/configs/system/users
|
||||
../common/configs/system/zsh
|
||||
];
|
||||
|
||||
networking.hostName = "$host";
|
||||
}
|
||||
EOF
|
||||
|
||||
cat <<EOF > "./hosts/$host/README.md"
|
||||
# $host
|
||||
EOF
|
||||
|
||||
sed -i "/nixosConfigurations = {/a\\
|
||||
$host = mkNixosConfiguration inputs system [ ./hosts/$host ];\n" flake.nix
|
||||
|
||||
sed -i "/knownHosts = {/a\\ $host.publicKeyFile = \"\${inputs.secrets}/$host/ssh_host_ed25519_key.pub\";" ./hosts/common/configs/system/ssh/default.nix
|
||||
|
||||
new_entry="| \`$host\` | [hosts/$host/README.md](./hosts/$host/README.md) |"
|
||||
last_table_line=$(grep -n "^| " README.md | tail -n 1 | cut -d: -f1)
|
||||
sed -i "${last_table_line}a$new_entry" README.md
|
||||
|
||||
nix fmt
|
||||
|
||||
echo "Host $host has been successfully added."
|
||||
echo "Age Public Key: $age_key"
|
||||
echo
|
||||
echo "If you need user-level SSH keys, generate them like this:"
|
||||
echo " ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_${host}_<user>"
|
||||
Reference in New Issue
Block a user