33 lines
1.1 KiB
Bash
Executable File
33 lines
1.1 KiB
Bash
Executable File
#!/usr/bin/env -S nix shell nixpkgs#ssh-to-age -c bash
|
|
|
|
set -o errexit
|
|
set -o nounset
|
|
set -o pipefail
|
|
|
|
if [[ "$#" -ne 2 ]]; then
|
|
echo "Usage: $0 <host> <sops-master-key>"
|
|
exit 1
|
|
fi
|
|
|
|
host="$1"
|
|
|
|
mkdir -p "./hosts/$host/secrets"
|
|
|
|
ssh-keygen -t ed25519 -f "./hosts/$host/secrets/ssh_host_ed25519_key" -N ""
|
|
|
|
age_key=$(cat './hosts/$host/secrets/ssh_host_ed25519_key.pub' | ssh-to-age)
|
|
|
|
find . -type f -name "sops.yaml" | while IFS= read -r sops_file; do
|
|
sed -i "/- hosts:/a\ - &$host $age_key" "$sops_file"
|
|
sed -i "/- age:/a\ - *$host" "$sops_file"
|
|
done
|
|
|
|
sed -i "/knownHosts = {/a\ $host.publicKeyFile = ../../../../$host/secrets/ssh_host_ed25519_key.pub;" ./hosts/common/configs/system/ssh/default.nix
|
|
sed -i "/userKnownHostsFile = lib.strings.concatStringsSep \" \" \[/a\ ../../../../../$host/secrets/ssh_host_ed25519_key.pub" ./hosts/common/configs/user/console/ssh/default.nix
|
|
|
|
"$(dirname "$0")/update-keys.sh" "$2"
|
|
|
|
echo "Host $host has been successfully added."
|
|
echo "You can generate SSH key pairs for any users that need to connect to user@host using the following command:"
|
|
echo "ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_$host_<user>"
|