nixcfg/deploy.sh

#!/usr/bin/env bash

cd $(dirname $0)

if [ -z "$@" ]; then
	NIXHOSTLIST=$(ls node | grep -v '\.site\.')
else
	NIXHOSTLIST="$@"
fi

TMP_PATH=/tmp/tmp-deploy-$(date +%s)

YEAR=$(date +%Y)

for NIXHOST in $NIXHOSTLIST; do
	NIXHOST=${NIXHOST%.*}

	if [ -z "$SSH_USER" ]; then
		SSH_DEST=$NIXHOST
	else
		SSH_DEST=$SSH_USER@$NIXHOST
	fi

	echo "==== DOING $NIXHOST ===="

	echo "Sending NixOS config files"

	ssh -F ssh_config $SSH_DEST mkdir -p $TMP_PATH $TMP_PATH/pki
	cat configuration.nix | ssh -F ssh_config $SSH_DEST tee $TMP_PATH/configuration.nix > /dev/null
	cat node/$NIXHOST.nix | ssh -F ssh_config $SSH_DEST tee $TMP_PATH/node.nix > /dev/null
	cat node/$NIXHOST.site.nix | ssh -F ssh_config $SSH_DEST tee $TMP_PATH/site.nix > /dev/null

	echo "Sending secret files"
	for SECRET in rclone.conf pki/nomad-ca.crt pki/nomad$YEAR.crt pki/nomad$YEAR.key; do
		test -f secrets/$SECRET && (cat secrets/$SECRET | ssh -F ssh_config $SSH_DEST tee $TMP_PATH/$SECRET > /dev/null)
	done

	echo "Rebuilding NixOS"

	ssh -F ssh_config $SSH_DEST tee $TMP_PATH/deploy.sh > /dev/null <<EOF
set -ex

cd $TMP_PATH
mv configuration.nix node.nix site.nix /etc/nixos

test -f rclone.conf && (mv rclone.conf /root; chmod 600 /root/rclone.conf)

mkdir -p /var/lib/nomad/pki
test -f pki/nomad-ca.crt && mv -v pki/nomad* /var/lib/nomad/pki

nixos-rebuild switch
EOF

	ssh -t -F ssh_config $SSH_DEST sudo sh $TMP_PATH/deploy.sh
	ssh -F ssh_config $SSH_DEST rm -rv $TMP_PATH
done