diff --git a/flake.lock b/flake.lock index 4e683c3..962ca73 100644 --- a/flake.lock +++ b/flake.lock @@ -240,11 +240,11 @@ }, "nixpkgs_3": { "locked": { - "lastModified": 1715266358, - "narHash": "sha256-doPgfj+7FFe9rfzWo1siAV2mVCasW+Bh8I1cToAXEE4=", + "lastModified": 1715447595, + "narHash": "sha256-VsVAUQOj/cS1LCOmMjAGeRksXIAdPnFIjCQ0XLkCsT0=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "f1010e0469db743d14519a1efd37e23f8513d714", + "rev": "062ca2a9370a27a35c524dc82d540e6e9824b652", "type": "github" }, "original": { diff --git a/flake.nix b/flake.nix index 06f22f9..a82af9f 100644 --- a/flake.nix +++ b/flake.nix @@ -132,6 +132,7 @@ nix-remove-result-links nixfiles-auto-install nixfiles-generate-config + nixfiles-generate-backup-secrets nixfiles-update-ssh-host-keys print-afra ssh-gpg diff --git a/hosts/hydra-1/cache.nix.clerie.de/index.txt b/hosts/hydra-1/cache.nix.clerie.de/index.txt new file mode 100644 index 0000000..ac9b577 --- /dev/null +++ b/hosts/hydra-1/cache.nix.clerie.de/index.txt @@ -0,0 +1,24 @@ +Nix Cache by clerie + +Public key: + + cache.nix.clerie.de:bAt1GJTS9BOTcXFWj3nURrSlcjqikCev9yDvqArMP5g= + +NixOS Configuration: + + nix.settings = { + substituters = [ + "https://cache.nix.clerie.de" + ]; + trusted-public-keys = [ + "cache.nix.clerie.de:bAt1GJTS9BOTcXFWj3nURrSlcjqikCev9yDvqArMP5g=" + ]; + } + +Try: + + nix build --substituters "https://cache.nix.clerie.de" \ + --trusted-public-keys "cache.nix.clerie.de:bAt1GJTS9BOTcXFWj3nURrSlcjqikCev9yDvqArMP5g=" \ + "git+https://git.clerie.de/clerie/fieldpoc.git#fieldpoc" + +.-*..*-. diff --git a/hosts/hydra-1/nix-cache.nix b/hosts/hydra-1/nix-cache.nix index fbfc206..c85c237 100644 --- a/hosts/hydra-1/nix-cache.nix +++ b/hosts/hydra-1/nix-cache.nix @@ -13,9 +13,40 @@ enableACME = true; forceSSL = true; locations."= /" = { - return = ''200 'Nix Cache by clerie\n\nPublic key:\n\n nix-cache.clerie.de:bAt1GJTS9BOTcXFWj3nURrSlcjqikCev9yDvqArMP5g=\n\nNixOS Configuration:\n\n nix.settings = {\n substituters = [\n "https://nix-cache.clerie.de"\n ];\n trusted-public-keys = [\n "nix-cache.clerie.de:bAt1GJTS9BOTcXFWj3nURrSlcjqikCev9yDvqArMP5g="\n ];\n }\n\nTry:\n\n nix build --substituters "https://nix-cache.clerie.de" \\\n --trusted-public-keys "nix-cache.clerie.de:bAt1GJTS9BOTcXFWj3nURrSlcjqikCev9yDvqArMP5g=" \\\n "git+https://git.clerie.de/clerie/fieldpoc.git#fieldpoc"\n\n.-*..*-.' ''; + index = "/index.txt"; + }; + locations."= /index.txt" = { + root = ./cache.nix.clerie.de; + }; + locations."/" = { + proxyPass = "http://[::1]:5005"; extraConfig = '' - types { } default_type "text/plain; charset=utf-8"; + proxy_redirect http:// https://; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + ''; + }; + }; + "cache.nix.clerie.de" = { + enableACME = true; + forceSSL = true; + locations."= /" = { + index = "/index.txt"; + }; + locations."= /index.txt" = { + root = ./cache.nix.clerie.de; + }; + locations."= /nix/store/" = { + extraConfig = '' + return 404; + ''; + }; + locations."/nix/store/" = { + root = "/"; + extraConfig = '' + autoindex on; + autoindex_exact_size off; ''; }; locations."/" = { diff --git a/pkgs/clerie-sops/clerie-sops-edit.sh b/pkgs/clerie-sops/clerie-sops-edit.sh index 79e2b95..7e03445 100755 --- a/pkgs/clerie-sops/clerie-sops-edit.sh +++ b/pkgs/clerie-sops/clerie-sops-edit.sh @@ -5,8 +5,42 @@ set -euo pipefail +print_help() { + cat << EOF +clerie-sops-edit + + This script allows editing single secrets in a secrets file by key. + + is a sops secrets file + is one of "edit", "read", "set" and "append" + is the key of the secret in the secrets file to modify +EOF +} + +if [[ $# != 3 ]]; then + print_help + exit 1 +fi + SECRETS_FILE="$1" -KEY="$2" + +if [[ ! -f "${SECRETS_FILE}" ]]; then + echo "File \"${SECRETS_FILE}\" does not exist" + echo + print_help + exit 1 +fi + +ACTION="$2" + +if ! echo "edit read set append" | grep -wq "${ACTION}"; then + echo "Action \"${ACTION}\" not supported" + echo + print_help + exit 1 +fi + +KEY="$3" KEY_SELECTOR="$(jq -Rsc '[.]' <(echo -n "${KEY}"))" if [[ -n $EDITOR ]]; then @@ -14,12 +48,36 @@ if [[ -n $EDITOR ]]; then fi TMP_FILE="$(mktemp)" +DECRYPT_ERROR_FILE="$(mktemp)" -clerie-sops --decrypt --extract "${KEY_SELECTOR}" "${SECRETS_FILE}" > "${TMP_FILE}" +if ! clerie-sops --decrypt --extract "${KEY_SELECTOR}" "${SECRETS_FILE}" > "${TMP_FILE}" 2> "${DECRYPT_ERROR_FILE}"; then + # Ignore that the key does not exist, but fail for all other errors + if ! grep -q "component .* not found" "${DECRYPT_ERROR_FILE}"; then + cat "${DECRYPT_ERROR_FILE}" + exit 1 + fi +fi TMP_FILE_HASH_BEFORE="$(sha256sum "${TMP_FILE}")" -vim "${TMP_FILE}" +case "${ACTION}" in + edit) + "${EDITOR}" "${TMP_FILE}" + ;; + read) + cat "${TMP_FILE}" + ;; + set) + cat > "${TMP_FILE}" + ;; + append) + cat >> "${TMP_FILE}" + ;; + *) + echo "Unsupported action" + exit 1 + ;; +esac TMP_FILE_HASH_AFTER="$(sha256sum "${TMP_FILE}")" diff --git a/pkgs/nixfiles/nixfiles-generate-backup-secrets.nix b/pkgs/nixfiles/nixfiles-generate-backup-secrets.nix index 9c2885e..47253ab 100644 --- a/pkgs/nixfiles/nixfiles-generate-backup-secrets.nix +++ b/pkgs/nixfiles/nixfiles-generate-backup-secrets.nix @@ -4,7 +4,7 @@ pkgs.writeShellApplication { name = "nixfiles-generate-backup-secrets"; text = builtins.readFile ./nixfiles-generate-backup-secrets.sh; runtimeInputs = with pkgs; [ - agenix + clerie-sops-edit apacheHttpd git pwgen diff --git a/pkgs/nixfiles/nixfiles-generate-backup-secrets.sh b/pkgs/nixfiles/nixfiles-generate-backup-secrets.sh index 28dcb42..9286c26 100755 --- a/pkgs/nixfiles/nixfiles-generate-backup-secrets.sh +++ b/pkgs/nixfiles/nixfiles-generate-backup-secrets.sh @@ -12,21 +12,9 @@ target_cyan_htpasswd="$(htpasswd -nbB "${host}" "${target_cyan}")" target_magenta="$(pwgen -1 64 1)" target_magenta_htpasswd="$(htpasswd -nbB "${host}" "${target_magenta}")" -mkdir -p "hosts/${host}/secrets" +echo "$job_main" | clerie-sops-edit "hosts/${host}/secrets.json" set "clerie-backup-job-main" +echo "$target_cyan" | clerie-sops-edit "hosts/${host}/secrets.json" set "clerie-backup-target-cyan" +echo "$target_magenta" | clerie-sops-edit "hosts/${host}/secrets.json" set "clerie-backup-target-magenta" -echo "$job_main" | agenix -e "hosts/${host}/secrets/new" -mv "hosts/${host}/secrets/new" "hosts/${host}/secrets/clerie-backup-job-main.age" - -echo "$target_cyan" | agenix -e "hosts/${host}/secrets/new" -mv "hosts/${host}/secrets/new" "hosts/${host}/secrets/clerie-backup-target-cyan.age" - -echo "$target_magenta" | agenix -e "hosts/${host}/secrets/new" -mv "hosts/${host}/secrets/new" "hosts/${host}/secrets/clerie-backup-target-magenta.age" - -prev_htpasswd_cyan="$(agenix -d hosts/clerie-backup/secrets/restic-server-cyan-htpasswd.age)" -cat <(echo "$prev_htpasswd_cyan") <(echo "$target_cyan_htpasswd") | agenix -e "hosts/clerie-backup/secrets/new" -mv "hosts/clerie-backup/secrets/new" "hosts/clerie-backup/secrets/restic-server-cyan-htpasswd.age" - -prev_htpasswd_magenta="$(agenix -d "hosts/backup-4/secrets/restic-server-magenta-htpasswd.age")" -cat <(echo "$prev_htpasswd_magenta") <(echo "$target_magenta_htpasswd") | agenix -e "hosts/backup-4/secrets/new" -mv "hosts/backup-4/secrets/new" "hosts/backup-4/secrets/restic-server-magenta-htpasswd.age" +echo "${target_cyan_htpasswd}" | clerie-sops-edit "hosts/clerie-backup/secrets.json" append "restic-server-cyan-htpasswd" +echo "$target_magenta_htpasswd" | clerie-sops-edit "hosts/backup-4/secrets.json" append "restic-server-magenta-htpasswd" diff --git a/pkgs/overlay.nix b/pkgs/overlay.nix index 4f53201..97c7fdf 100644 --- a/pkgs/overlay.nix +++ b/pkgs/overlay.nix @@ -11,6 +11,7 @@ final: prev: { nix-remove-result-links = final.callPackage ./nix-remove-result-links {}; nixfiles-auto-install = final.callPackage ./nixfiles/nixfiles-auto-install.nix {}; nixfiles-generate-config = final.callPackage ./nixfiles/nixfiles-generate-config.nix {}; + nixfiles-generate-backup-secrets = final.callPackage ./nixfiles/nixfiles-generate-backup-secrets.nix {}; nixfiles-update-ssh-host-keys = final.callPackage ./nixfiles/nixfiles-update-ssh-host-keys.nix {}; print-afra = final.callPackage ./print-afra {}; ssh-gpg = final.callPackage ./ssh-gpg {}; diff --git a/users/clerie/clerie_id-2023.pub b/users/clerie/clerie_id-2023.pub deleted file mode 100644 index 3355d9a..0000000 --- a/users/clerie/clerie_id-2023.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIzEQEWeunhkzP+invKjdsZe4rbUloixa374bYEhBSA5 clerie_id