blob: f40493599757c9bdb53cc81d5ff32f1f4f6addb7 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
|
#! /bin/sh
#
# copy-secrets system_name target
#
set -euf
system_name=$1
target=$2
nixos_config=$config_root/modules/$system_name
secrets_nix=$secrets_root/$system_name/nix
secrets_rsync=$secrets_root/$system_name/rsync
if ! test -e "$secrets_rsync"; then
exit # nothing to do
fi
# XXX this is ugly
# Notice NIX_PATH used from host
# Notice secrets required to evaluate configuration
NIX_PATH=$NIX_PATH:nixos-config=$PWD/modules/$system_name
NIX_PATH=$NIX_PATH:secrets=$PWD/secrets/$system_name/nix
export NIX_PATH
case $(nixos-query tv.retiolum.enable 2>/dev/null) in true)
retiolum_secret=$(nixos-query tv.retiolum.privateKeyFile)
retiolum_uid=$(nixos-query users.extraUsers.retiolum-tinc.uid)
esac
case $(nixos-query services.ejabberd-cd.enable 2>/dev/null) in true)
ejabberd_secret=$(nixos-query services.ejabberd-cd.certFile)
ejabberd_uid=$(nixos-query users.extraUsers.ejabberd.uid)
esac
case $(nixos-query tv.consul.enable 2>/dev/null) in true)
consul_secret=$(nixos-query tv.consul.encrypt-file)
consul_uid=$(nixos-query users.extraUsers.consul.uid)
esac
(set -x
rsync \
--rsync-path="mkdir -p \"$2\" && rsync" \
-vzrlptD \
"$secrets_rsync/" \
"$target:/")
ssh "$target" -T <<EOF
set -euf
retiolum_secret=${retiolum_secret-}
retiolum_uid=${retiolum_uid-}
ejabberd_secret=${ejabberd_secret-}
ejabberd_uid=${ejabberd_uid-}
consul_secret=${consul_secret-}
consul_uid=${consul_uid-}
if test -n "\$retiolum_secret"; then
chown -v "\$retiolum_uid:0" "\$retiolum_secret"
fi
if test -n "\$ejabberd_secret"; then
chown -v "\$ejabberd_uid:0" "\$ejabberd_secret"
fi
if test -n "\$consul_secret"; then
chown -v "\$consul_uid:0" "\$consul_secret"
fi
EOF
|
