diff options
author | lassulus <git@lassul.us> | 2023-09-07 12:26:31 +0200 |
---|---|---|
committer | lassulus <git@lassul.us> | 2023-09-07 12:40:43 +0200 |
commit | 2e5167de1560ad0d7b8e294c72e1913f694160c2 (patch) | |
tree | b618daa9f125650e9276bae7848f854c48d6c95e /lass/5pkgs/l-gen-secrets | |
parent | 6a3a423dad19264c0c42821c7676e85ecc122d21 (diff) |
lass: migrate awayriplass
Diffstat (limited to 'lass/5pkgs/l-gen-secrets')
-rw-r--r-- | lass/5pkgs/l-gen-secrets/default.nix | 82 |
1 files changed, 0 insertions, 82 deletions
diff --git a/lass/5pkgs/l-gen-secrets/default.nix b/lass/5pkgs/l-gen-secrets/default.nix deleted file mode 100644 index 27e59bb96..000000000 --- a/lass/5pkgs/l-gen-secrets/default.nix +++ /dev/null @@ -1,82 +0,0 @@ -{ pkgs }: -pkgs.writers.writeDashBin "l-gen-secrets" '' - set -efu - HOSTNAME=$1 - TMPDIR=$(${pkgs.coreutils}/bin/mktemp -d) - if [ "''${DRYRUN-n}" = "n" ]; then - trap 'rm -rf $TMPDIR' EXIT - else - echo "$TMPDIR" - set -x - fi - mkdir -p $TMPDIR/out - - PASSWORD=$(${pkgs.pwgen}/bin/pwgen 25 1) - HASHED_PASSWORD=$(echo $PASSWORD | ${pkgs.hashPassword}/bin/hashPassword -s) > /dev/null - - # ssh - ${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f $TMPDIR/ssh.id_ed25519 -P "" -C "" >/dev/null - ${pkgs.coreutils}/bin/mv $TMPDIR/ssh.id_ed25519 $TMPDIR/out/ - - # tor - ${pkgs.coreutils}/bin/timeout 1 ${pkgs.tor}/bin/tor --HiddenServiceDir $TMPDIR/tor --HiddenServicePort 1 --SocksPort 0 >/dev/null || : - ${pkgs.coreutils}/bin/mv $TMPDIR/tor/hs_ed25519_secret_key $TMPDIR/out/ssh-tor.priv - - # tinc - ${pkgs.coreutils}/bin/mkdir -p $TMPDIR/tinc - ${pkgs.tinc_pre}/bin/tinc --config $TMPDIR/tinc generate-keys 4096 </dev/null - ${pkgs.coreutils}/bin/mv $TMPDIR/tinc/ed25519_key.priv $TMPDIR/out/retiolum.ed25519_key.priv - ${pkgs.coreutils}/bin/mv $TMPDIR/tinc/rsa_key.priv $TMPDIR/out/retiolum.rsa_key.priv - - # wireguard - ${pkgs.wireguard-tools}/bin/wg genkey > $TMPDIR/out/wiregrill.key - ${pkgs.coreutils}/bin/cat $TMPDIR/out/wiregrill.key | ${pkgs.wireguard-tools}/bin/wg pubkey > $TMPDIR/wiregrill.pub - - # system passwords - cat <<EOF > $TMPDIR/out/hashedPasswords.nix - { - root = "$HASHED_PASSWORD"; - mainUser = "$HASHED_PASSWORD"; - } - EOF - - set +f - if [ "''${DRYRUN-n}" = "n" ]; then - cd $TMPDIR/out - for x in *; do - ${pkgs.coreutils}/bin/cat $x | ${pkgs.pass}/bin/pass insert -m hosts/$HOSTNAME/$x > /dev/null - done - echo $PASSWORD | ${pkgs.pass}/bin/pass insert -m admin/$HOSTNAME/pass > /dev/null - ${pkgs.coreutils}/bin/cat $TMPDIR/tor/hostname | ${pkgs.pass}/bin/pass insert -m admin/$HOSTNAME/torname > /dev/null - fi - set -f - - cat <<EOF - { r6, w6, ... }: - { - nets = { - retiolum = { - ip4.addr = "10.243.0.changeme"; - ip6.addr = r6 "changeme"; - aliases = [ - "$HOSTNAME.r" - ]; - tinc.pubkey = ${"''"} - $(cat $TMPDIR/tinc/rsa_key.pub | sed 's/^/ /') - ${"''"}; - tinc.pubkey_ed25519 = "$(cat $TMPDIR/tinc/ed25519_key.pub | ${pkgs.gnused}/bin/sed 's/.* = //')"; - }; - wiregrill = { - ip6.addr = w6 "changeme"; - aliases = [ - "$HOSTNAME.w" - ]; - wireguard.pubkey = ${"''"} - $(cat $TMPDIR/wiregrill.pub) - ${"''"}; - }; - }; - ssh.pubkey = "$(cat $TMPDIR/ssh.id_ed25519.pub)"; - } - EOF -'' |