nixcfg/sshtool

132 lines
2.4 KiB
Text
Raw Permalink Normal View History

2022-04-20 11:01:51 +00:00
#!/usr/bin/env bash
CMDFILE="$1"
2022-12-24 21:59:37 +00:00
if [ -z "$CMDFILE" ] || [ ! -f "$CMDFILE" ]; then
echo "sshtool is not meant to be called on its own."
echo "See scripts that use it (e.g. deploy_nixos) for usage examples."
exit 1
fi
2022-04-20 11:01:51 +00:00
shift 1
2022-12-22 23:07:02 +00:00
cd $(dirname $CMDFILE)
CMDFILE=./$(basename $CMDFILE)
2022-04-20 11:01:51 +00:00
CLUSTER="$1"
if [ -z "$CLUSTER" ] || [ ! -d "cluster/$CLUSTER" ]; then
2024-05-31 09:34:38 +00:00
echo "Usage: $CMDFILE <cluster name> [host1] [host2] [...]"
2022-04-20 11:01:51 +00:00
echo "The cluster name must be the name of a subdirectory of cluster/"
exit 1
fi
shift 1
if [ -z "$1" ]; then
2022-07-27 08:39:09 +00:00
NIXHOSTLIST=$(ls cluster/$CLUSTER/node | grep '\.nix$' | grep -v '\.site\.')
2022-04-20 11:01:51 +00:00
else
NIXHOSTLIST="$@"
fi
if [ -z "$ROOT_PASS" ]; then
read -r -s -p "Enter remote sudo password: " ROOT_PASS
2022-04-20 11:01:51 +00:00
echo
fi
SSH_CONFIG=cluster/$CLUSTER/ssh_config
function header {
2023-03-15 16:49:09 +00:00
RANDNAME=$(openssl rand -hex 12)
2022-04-20 11:01:51 +00:00
cat <<EOF
2023-03-15 16:49:09 +00:00
cat > /tmp/deploytool_askpass_$RANDNAME <<EOG
2022-04-20 11:01:51 +00:00
#!/usr/bin/env sh
echo "\\\$DEPLOYTOOL_ROOT_PASSWORD" | base64 -d
2022-04-20 11:01:51 +00:00
EOG
2023-03-15 16:49:09 +00:00
chmod +x /tmp/deploytool_askpass_$RANDNAME
export SUDO_ASKPASS=/tmp/deploytool_askpass_$RANDNAME
export DEPLOYTOOL_ROOT_PASSWORD=$(echo $ROOT_PASS | base64)
2022-04-20 13:29:24 +00:00
sudo -A sh - <<'EOEVERYTHING'
2022-12-22 23:07:02 +00:00
set -e
2022-04-20 11:01:51 +00:00
EOF
}
function footer {
2023-03-15 16:49:09 +00:00
echo rm -v '/tmp/deploytool_askpass*'
2022-04-20 11:01:51 +00:00
echo EOEVERYTHING
}
function message {
2022-12-22 22:59:51 +00:00
echo "base64 -d <<EOG"
echo "$@" | base64
echo "EOG"
2022-04-20 11:01:51 +00:00
}
function cmd {
echo "echo '- run $@'"
echo "$@"
}
function set_env {
echo "echo '- set $@'"
echo "export $@"
}
function copy {
local FROM=$1
local TO=$2
cat <<EOF
echo '- write $TO from $FROM'
base64 -d <<EOG | tee $TO > /dev/null
$(base64 <$FROM)
EOG
EOF
}
2022-04-20 11:07:39 +00:00
function copy_secret {
local FROM=$1
local TO=$2
cat <<EOF
echo '- write secret $TO from $FROM'
base64 -d <<EOG | tee $TO > /dev/null
$(base64 <$FROM)
EOG
chown root:root $TO
chmod 0600 $TO
EOF
}
2022-04-20 12:14:15 +00:00
function write_pass {
local PASSKEY=$1
local TO=$2
cat <<EOF
echo '- write secret $TO from pass $PASSKEY'
base64 -d <<EOG | tee $TO > /dev/null
$(pass $PASSKEY | base64)
EOG
chown root:root $TO
chmod 0600 $TO
EOF
}
2022-12-22 23:07:02 +00:00
function pipe_pass {
local PASSKEY=$1
local CMD=$2
cat <<EOF
echo '- pipe secret $PASSKEY to command $CMD'
base64 -d <<EOG | $CMD > /dev/null
$(pass $PASSKEY | base64)
EOG
EOF
}
2022-04-20 11:01:51 +00:00
for NIXHOST in $NIXHOSTLIST; do
NIXHOST=${NIXHOST%.*}
if [ -z "$SSH_USER" ]; then
SSH_DEST=$NIXHOST
else
SSH_DEST=$SSH_USER@$NIXHOST
fi
echo "==== DOING $NIXHOST ===="
(header; . $CMDFILE; footer) | ssh -F $SSH_CONFIG $SSH_DEST sh -
done