nixos/scripts/bootstrap.sh

134 lines
5.0 KiB
Bash
Raw Normal View History

2024-05-14 18:26:45 +01:00
#!/usr/bin/env bash
echo -e "
Before using this tool, ensure that the host has been setup correctly.
Boot the latest Nixos-minimal install ISO on the host and access the tty.
Use 'ip a' to get the ip address, then 'sudo su' to change to root. Finally
Run 'passwd' and set a temporary password (something simple like '1234')
for the root user.
"
read -p "Confirm host had been setup using the above steps...(yes|no): " confirm
[ "$confirm" != "yes" ] && echo "Exiting" && exit 0
# Target host details
2024-05-19 23:33:42 +01:00
cd ~
read -p "Enter hostname: " hostname
read -p "Enter username: " username
read -p "Enter ip address: " ip
read -p "Enter nixosSystem to build, e.g. 'bootstrap': " config
# Generate key name and dir
2024-05-14 18:26:45 +01:00
KEY_DIR="$HOME/keys/$hostname/"
mkdir -p $KEY_DIR
2024-05-19 23:33:42 +01:00
KEY_NAME="$username@$hostname-ssh-ed25519"
2024-05-14 18:26:45 +01:00
# Delete key in known hosts if exists
2024-05-14 18:26:45 +01:00
confirm_delete=""
KNOWN_HOSTS=$(grep "$ip" ~/.ssh/known_hosts)
2024-05-14 18:26:45 +01:00
[ "$KNOWN_HOSTS" != "" ] && echo -e "Host found in: ~/.ssh/known_hosts\n\n$KNOWN_HOSTS\n" && read -p "Delete existing hosts from ~/.ssh/known_hosts? (yes|no) " confirm_delete
[ "$confirm_delete" = "yes" ] && sed -i "/$ip/d" ~/.ssh/known_hosts
2024-05-19 23:33:42 +01:00
# Generate new keys for target host if not exists
echo "Creating ssh keys for new host."
overwrite=""
[ -f "$KEY_DIR/$KEY_NAME" ] && read -p "Target host key '$KEY_NAME' already exists, would you like to overwrite it? (yes|no) " overwrite
[ -z "$overwrite" ] || [ "$overwrite" == "yes" ] && ssh-keygen -t ed25519 -f "$KEY_DIR/$KEY_NAME" -C "$username@$hostname" -N ""
# Authorise source public key
echo "Copying pubkey to target host"
ssh-copy-id -i "$(readlink -f "$HOME/.ssh/ssh_host_ed25519_key.pub")" "root@$ip"
2024-05-19 23:33:42 +01:00
# Generate age key from target host public ssh key
echo "Generating age key from target host ssh key"
nix-shell -p ssh-to-age --run "cat $KEY_DIR/$KEY_NAME.pub | ssh-to-age > $KEY_DIR/age_key_$hostname"
[ $? != 0 ] && echo "Error generating age key" && exit 1
AGE_KEY=$(cat "$KEY_DIR/age_key_$hostname")
echo -e "Age key:\n$AGE_KEY\n"
echo "This key needs to be inserted into .sops.yaml file. This will be prompted again later."
# Install Nixos to target
2024-05-14 18:26:45 +01:00
cd "$HOME/nixos"
SHELL=/bin/sh nix run github:nix-community/nixos-anywhere -- --flake .#"$config" root@"$ip" -i "$HOME/.ssh/ssh_host_ed25519_key"
2024-05-14 18:26:45 +01:00
[ $? != 0 ] && echo "Error installing Nixos" && exit 1
## Delete keys from local known_hosts
2024-05-14 18:26:45 +01:00
echo "Deleting host from known_hosts"
sed -i "/$ip/d" ~/.ssh/known_hosts
# Check host OS has booted (and not booted back into live cd)
2024-05-15 19:44:13 +01:00
while true;
do
read -p "Confirm live CD has been removed... (yes|no): " confirm
2024-05-15 19:44:13 +01:00
[ "$confirm" = "yes" ] && break
done
echo "Waiting for $ip to come back online and port 22 to be open..."
while ! ping -c 1 $ip &> /dev/null || ! nc -zvw3 $ip 22 &> /dev/null
do
echo "$ip is still offline or port 22 is not open. Checking again in 5 seconds..."
sleep 5
done
echo "$ip is now online and port 22 is open!"
# Authorise source public key
echo "Copying pubkey to target host"
ssh-copy-id -i "$(readlink -f "$HOME/.ssh/ssh_host_ed25519_key.pub")" "$username@$ip"
2024-05-19 23:33:42 +01:00
# Copy deploy_key to target for personal repo authorisation
scp -i "$(readlink -f "$HOME/.ssh/ssh_host_ed25519_key")" "$(readlink -f "$HOME/.ssh/deploy_key-ssh-ed25519")" "media@$ip:~/.ssh/deploy_key-ssh-ed25519"
scp -i "$(readlink -f "$HOME/.ssh/ssh_host_ed25519_key")" "$(readlink -f "$HOME/.ssh/deploy_key-ssh-ed25519.pub")" "media@$ip:~/.ssh/deploy_key-ssh-ed25519.pub"
echo "Configuring target host ssh connection to enable connection to gitea repos:"
2024-05-15 15:39:30 +01:00
read -r -d '' config << EOM
Host git.bitlab21.com
IdentitiesOnly yes
2024-05-15 19:44:13 +01:00
StrictHostKeyChecking no
2024-05-17 20:17:53 +01:00
IdentityFile ~/.ssh/deploy_key-ssh-ed25519
2024-05-15 15:39:30 +01:00
EOM
2024-05-15 19:44:13 +01:00
echo "$config" | ssh "$username@$ip" 'mkdir -p ~/.ssh/ && cat > ~/.ssh/config'
2024-05-15 15:39:30 +01:00
2024-05-14 18:26:45 +01:00
echo -e "
Complete!
Now add the new target host age key to .sops.yaml. This is needed to enable the
new host to decrypt the secrets.yaml file from the ssh key we generated
previously.
Enter the details as following:
2024-05-14 18:26:45 +01:00
keys:
- &hosts:
- &$hostname $AGE_KEY
creation_rules:
- path_regex: secrets.yaml$
key_groups:
- age:
- *$hostname
Then update (i.e. re-encrypt) the secrets.yaml file with the new keys, run:
'sops --config .sops.yaml updatekeys secrets.yaml'
or with just:
'just update-sops-secrets'
Then commit and push these changes to remote so they can be accessed on the new
host.
2024-05-14 18:26:45 +01:00
"
2024-05-15 15:39:30 +01:00
while true;
do
2024-05-15 19:44:13 +01:00
read -p "Confirm keys have been added to .sops.yaml using the above steps, and the changes (if any) have been commited and pushed...(yes|no): " confirm
2024-05-15 15:39:30 +01:00
[ "$confirm" = "yes" ] && break
done
ssh -i "$(readlink -f "$HOME/.ssh/ssh_host_ed25519_key")" "$username@$ip" "nix-shell -p git --run 'git clone git@git.bitlab21.com:sam/nixos.git'"
ssh -i "$(readlink -f "$HOME/.ssh/ssh_host_ed25519_key")" "$username@$ip" "nix-shell -p git --run 'git clone git@git.bitlab21.com:sam/nix-secrets.git'"
2024-05-14 18:26:45 +01:00
2024-05-15 15:39:30 +01:00
echo "Successfully installed Nixos on the target host!"
2024-05-15 19:54:39 +01:00
echo "Please remote into the new host and run 'sudo nixos-generate-config && cp /etc/nixos/hardware-configuration.nix /home/$username/nixos/hosts/$hostname/'"
2024-05-19 23:33:42 +01:00