2024-05-14 18:26:45 +01:00
#!/usr/bin/env bash
echo -e "
Before using this tool, ensure that the host has been setup correctly.
Boot the latest Nixos-minimal install ISO on the host and access the tty.
Use 'ip a' to get the ip address, then 'sudo su' to change to root. Finally
Run 'passwd' and set a temporary password ( something simple like '1234' )
for the root user.
"
read -p "Confirm host had been setup using the above steps...(yes|no): " confirm
[ " $confirm " != "yes" ] && echo "Exiting" && exit 0
cd ~
read -p "Enter hostname: " hostname
read -p "Enter username: " username
read -p "Enter ip address: " ip
2024-05-16 20:19:01 +01:00
read -p "Enter nixosSystem to build, e.g. 'bootstrap': " config
2024-05-14 18:26:45 +01:00
KEY_DIR = " $HOME /keys/ $hostname / "
mkdir -p $KEY_DIR
echo "Creating ssh keys for new host. Will create in current directory: " $KEY_DIR
KEY_NAME = " ssh_ed25519_key_ $hostname "
KNOWN_HOSTS = $( grep " $ip " ~/.ssh/known_hosts)
confirm_delete = ""
[ " $KNOWN_HOSTS " != "" ] && echo -e " Host found in: ~/.ssh/known_hosts\n\n $KNOWN_HOSTS \n " && read -p "Delete existing hosts from ~/.ssh/known_hosts? (yes|no) " confirm_delete
[ " $confirm_delete " = "yes" ] && sed -i " / $ip /d " ~/.ssh/known_hosts
2024-05-16 20:19:01 +01:00
echo "Copying pubkey to target host"
ssh-copy-id -i " $( readlink -n " $HOME /.ssh/gitea.pub " ) " " root@ $ip "
2024-05-15 15:39:30 +01:00
overwrite = ""
[ -f " $KEY_DIR / $KEY_NAME " ] && read -p "Key exists, would you like to overwrite it? (yes|no) " overwrite
2024-05-16 16:54:21 +01:00
[ -z " $overwrite " ] || [ " $overwrite " = = "yes" ] && ssh-keygen -t ed25519 -f " $KEY_DIR / $KEY_NAME " -C " $hostname @ $ip " -N ""
2024-05-14 18:26:45 +01:00
echo "Copying ssh key to target host:"
scp -i " $KEY_DIR /ssh_ed25519_key_ $hostname " * " root@ $ip :/etc/ssh/ "
[ $? != 0 ] && echo "Error copying keys to target host" && exit 1
echo "Generating age key from ssh key"
2024-05-15 15:39:30 +01:00
nix-shell -p ssh-to-age --run " cat $KEY_DIR / $KEY_NAME .pub | ssh-to-age > $KEY_DIR /age_key_ $hostname "
2024-05-14 18:26:45 +01:00
[ $? != 0 ] && echo "Error generating age key" && exit 1
AGE_KEY = $( cat " $KEY_DIR /age_key_ $hostname " )
echo -e " Age key:\n $AGE_KEY \n "
echo "This needs to be inserted into .sops.yaml file."
# Install Nixos bootstrap
cd " $HOME /nixos "
2024-05-16 19:14:21 +01:00
SHELL = /bin/sh nix run github:nix-community/nixos-anywhere -- --flake .#" $config " root@" $ip " -i " $KEY_DIR /ssh_ed25519_key_ $hostname "
2024-05-14 18:26:45 +01:00
[ $? != 0 ] && echo "Error installing Nixos" && exit 1
echo "Deleting host from known_hosts"
sed -i " / $ip /d " ~/.ssh/known_hosts
2024-05-15 19:44:13 +01:00
while true;
do
read -p "Confirm live CD has been removed... (yes|no)" confirm
[ " $confirm " = "yes" ] && break
done
2024-05-15 15:39:30 +01:00
2024-05-15 19:44:13 +01:00
echo " Waiting for $ip to come back online and port 22 to be open... "
2024-05-15 15:39:30 +01:00
2024-05-15 19:44:13 +01:00
while ! ping -c 1 $ip & > /dev/null || ! nc -zvw3 $ip 22 & > /dev/null
do
echo " $ip is still offline or port 22 is not open. Checking again in 5 seconds... "
sleep 5
done
echo " $ip is now online and port 22 is open! "
echo "Configuring ssh keys on target host to enable connection to gitea:"
ssh-copy-id -i " $HOME /.ssh/gitea.pub " " $username @ $ip "
2024-05-15 15:39:30 +01:00
read -r -d '' config << EOM
Host git.bitlab21.com
IdentitiesOnly yes
2024-05-15 19:44:13 +01:00
StrictHostKeyChecking no
2024-05-15 15:39:30 +01:00
IdentityFile ~/.ssh/gitea
EOM
# Append the string to file on target machine
2024-05-15 19:44:13 +01:00
echo " $config " | ssh " $username @ $ip " 'mkdir -p ~/.ssh/ && cat > ~/.ssh/config'
2024-05-15 15:39:30 +01:00
2024-05-14 18:26:45 +01:00
echo -e "
Complete!
2024-05-15 15:39:30 +01:00
Now add the age key to .sops.yaml, like this:
2024-05-14 18:26:45 +01:00
keys:
- & hosts:
- & $hostname $AGE_KEY
creation_rules:
- path_regex: secrets.yaml$
key_groups:
- age:
- *$hostname
Then to update the keys for the secrets.yaml file, run:
'sops --config .sops.yaml updatekeys secrets.yaml'
2024-05-15 15:39:30 +01:00
or with nix-shell:
'nix-shell -p sops --run ' sops --config .sops.yaml updatekeys secrets.yaml''
then run 'nix flake lock --update-input nix-secrets $HOME/nixos'
Finally, commit and push these changes to remote so they can be accessed on
the new host.
2024-05-14 18:26:45 +01:00
"
2024-05-15 15:39:30 +01:00
while true;
do
2024-05-15 19:44:13 +01:00
read -p "Confirm keys have been added to .sops.yaml using the above steps, and the changes (if any) have been commited and pushed...(yes|no): " confirm
2024-05-15 15:39:30 +01:00
[ " $confirm " = "yes" ] && break
done
2024-05-14 18:26:45 +01:00
echo "Copying gitea private ssh key to host"
2024-05-15 15:39:30 +01:00
echo "New password is 'nixos'"
2024-05-15 19:44:13 +01:00
rsync -av " $( readlink -n " $HOME /.ssh/gitea " ) " " $username @ $ip " :~/.ssh/gitea
ssh " $username @ $ip " "nix-shell -p git --run 'git clone git@git.bitlab21.com:sam/nixos.git'"
ssh " $username @ $ip " "nix-shell -p git --run 'git clone git@git.bitlab21.com:sam/nix-secrets.git'"
2024-05-14 18:26:45 +01:00
2024-05-15 15:39:30 +01:00
echo "Successfully installed Nixos on the target host!"
2024-05-15 19:54:39 +01:00
echo " Please remote into the new host and run 'sudo nixos-generate-config && cp /etc/nixos/hardware-configuration.nix /home/ $username /nixos/hosts/ $hostname /' "