diff options
author | jeschli <jeschli@gmail.com> | 2018-06-19 09:52:04 +0200 |
---|---|---|
committer | jeschli <jeschli@gmail.com> | 2018-06-19 09:52:04 +0200 |
commit | 324a8615f19c267d67b8a96d8e74b648c875ba04 (patch) | |
tree | 8f7444a8e69ae254354a83a119d1c62bfaf95989 /lass/5pkgs/l-gen-secrets/default.nix | |
parent | 2a3f60d6fb3cd8d5f1ead4e5ff43fc9364eedad3 (diff) | |
parent | 8eca9165ce6ffaba1076a916bfa475eb935f0a6f (diff) |
Merge remote-tracking branch 'origin/staging/jeschli'
Diffstat (limited to 'lass/5pkgs/l-gen-secrets/default.nix')
-rw-r--r-- | lass/5pkgs/l-gen-secrets/default.nix | 46 |
1 files changed, 46 insertions, 0 deletions
diff --git a/lass/5pkgs/l-gen-secrets/default.nix b/lass/5pkgs/l-gen-secrets/default.nix new file mode 100644 index 000000000..b6cb2ec7e --- /dev/null +++ b/lass/5pkgs/l-gen-secrets/default.nix @@ -0,0 +1,46 @@ +{ pkgs }: +pkgs.writeDashBin "l-gen-secrets" '' + HOSTNAME="$1" + TMPDIR=$(${pkgs.coreutils}/bin/mktemp -d) + PASSWORD=$(${pkgs.pwgen}/bin/pwgen 25 1) + HASHED_PASSWORD=$(echo $PASSWORD | ${pkgs.hashPassword}/bin/hashPassword -s) > /dev/null + + ${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f $TMPDIR/ssh.id_ed25519 -P "" -C "" >/dev/null + ${pkgs.openssl}/bin/openssl genrsa -out $TMPDIR/retiolum.rsa_key.priv 4096 2>/dev/null > /dev/null + ${pkgs.openssl}/bin/openssl rsa -in $TMPDIR/retiolum.rsa_key.priv -pubout -out $TMPDIR/retiolum.rsa_key.pub 2>/dev/null > /dev/null + cat <<EOF > $TMPDIR/hashedPasswords.nix + { + root = "$HASHED_PASSWORD"; + mainUser = "$HASHED_PASSWORD"; + } + EOF + + cd $TMPDIR + for x in *; do + ${pkgs.coreutils}/bin/cat $x | ${pkgs.pass}/bin/pass insert -m hosts/$HOSTNAME/$x > /dev/null + done + echo $PASSWORD | ${pkgs.pass}/bin/pass insert -m admin/$HOSTNAME/pass > /dev/null + + cat <<EOF + $HOSTNAME = { + cores = 1; + nets = { + retiolum = { + ip4.addr = "10.243.0.changeme"; + ip6.addr = "42:0:0:0:0:0:0:changeme"; + aliases = [ + "$HOSTNAME.r" + ]; + tinc.pubkey = ${"''"} + $(cat $TMPDIR/retiolum.rsa_key.pub) + ${"''"}; + }; + }; + ssh.privkey.path = <secrets/ssh.id_ed25519>; + ssh.pubkey = "$(cat $TMPDIR/ssh.id_ed25519.pub)"; + }; + EOF + + rm -rf $TMPDIR +'' + |