bin/add-secret.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+
+set -euo pipefail
+
+cd $(git rev-parse --show-toplevel)
+
+host=$1
+secret=$2
+
+mkdir -p hosts/${host}/secrets
+
+nix run github:ryantm/agenix -- -e hosts/${host}/secrets/new
+
+mv hosts/${host}/secrets/new hosts/${host}/secrets/${secret}.age
+

bin/generate-backup-secrets.sh

@@ -0,0 +1,32 @@
+#!/bin/bash
+
+set -euo pipefail
+
+cd $(git rev-parse --show-toplevel)
+
+host=$1
+
+job_main=$(nix run nixpkgs#pwgen -- -1 64 1)
+target_cyan=$(nix run nixpkgs#pwgen -- -1 64 1)
+target_cyan_htpasswd=$(nix shell nixpkgs#apacheHttpd -c htpasswd -nbB ${host} ${target_cyan})
+target_magenta=$(nix run nixpkgs#pwgen -- -1 64 1)
+target_magenta_htpasswd=$(nix shell nixpkgs#apacheHttpd -c htpasswd -nbB ${host} ${target_magenta})
+
+mkdir -p hosts/${host}/secrets
+
+echo "$job_main" | nix run github:ryantm/agenix -- -e hosts/${host}/secrets/new
+mv hosts/${host}/secrets/new hosts/${host}/secrets/clerie-backup-job-main.age
+
+echo "$target_cyan" | nix run github:ryantm/agenix -- -e hosts/${host}/secrets/new
+mv hosts/${host}/secrets/new hosts/${host}/secrets/clerie-backup-target-cyan.age
+
+echo "$target_magenta" | nix run github:ryantm/agenix -- -e hosts/${host}/secrets/new
+mv hosts/${host}/secrets/new hosts/${host}/secrets/clerie-backup-target-magenta.age
+
+prev_htpasswd_cyan=$(nix run github:ryantm/agenix -- -d hosts/clerie-backup/secrets/restic-server-cyan-htpasswd.age)
+cat <(echo "$prev_htpasswd_cyan") <(echo "$target_cyan_htpasswd") | nix run github:ryantm/agenix -- -e hosts/clerie-backup/secrets/new
+mv hosts/clerie-backup/secrets/new hosts/clerie-backup/secrets/restic-server-cyan-htpasswd.age
+
+prev_htpasswd_magenta=$(nix run github:ryantm/agenix -- -d hosts/backup-4/secrets/restic-server-magenta-htpasswd.age)
+cat <(echo "$prev_htpasswd_magenta") <(echo "$target_magenta_htpasswd") | nix run github:ryantm/agenix -- -e hosts/backup-4/secrets/new
+mv hosts/backup-4/secrets/new hosts/backup-4/secrets/restic-server-magenta-htpasswd.age

bin/update-ssh-host-keys.sh

@@ -1,8 +1,8 @@
-#!/usr/bin/env bash
+#!/bin/bash
 
-cd "$(git rev-parse --show-toplevel)"
+cd $(git rev-parse --show-toplevel)
 
 for host in $(nix eval --apply 'attrs: builtins.concatStringsSep "\n" (builtins.filter (name: (builtins.substring 0 1 name) != "_") (builtins.attrNames attrs))' --raw .#clerie.hosts); do
-	echo "$host"
-	ssh-keyscan -t ed25519 "${host}.net.clerie.de" 2>/dev/null | sed -E 's/(\S+) (.+)/\2/g' > "hosts/${host}/ssh.pub"
+	echo $host
+	ssh-keyscan -t ed25519 ${host}.net.clerie.de 2>/dev/null | sed -E 's/(\S+) (.+)/\2/g' > hosts/${host}/ssh.pub
 done

flake.lock

@@ -183,11 +183,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1693588489,
-        "narHash": "sha256-hUGiONyurfBxmTtRUttdlkdq+ml16L1MiKKAS1047OE=",
+        "lastModified": 1692952286,
+        "narHash": "sha256-TsrtPv3+Q1KR0avZxpiJH+b6fX/R/hEQVHbjl1ebotY=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "fe0ea731b84b10143fc68cd557368ac70f0fb65c",
+        "rev": "817e297fc3352fadc15f2c5306909aa9192d7d97",
         "type": "github"
       },
       "original": {
@@ -215,11 +215,11 @@
     },
     "nixpkgs-krypton": {
       "locked": {
-        "lastModified": 1693471703,
-        "narHash": "sha256-0l03ZBL8P1P6z8MaSDS/MvuU8E75rVxe5eE1N6gxeTo=",
+        "lastModified": 1693377291,
+        "narHash": "sha256-vYGY9bnqEeIncNarDZYhm6KdLKgXMS+HA2mTRaWEc80=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3e52e76b70d5508f3cec70b882a29199f4d1ee85",
+        "rev": "e7f38be3775bab9659575f192ece011c033655f0",
         "type": "github"
       },
       "original": {
@@ -231,11 +231,11 @@
     },
     "nixpkgs-schule": {
       "locked": {
-        "lastModified": 1693471703,
-        "narHash": "sha256-0l03ZBL8P1P6z8MaSDS/MvuU8E75rVxe5eE1N6gxeTo=",
+        "lastModified": 1693377291,
+        "narHash": "sha256-vYGY9bnqEeIncNarDZYhm6KdLKgXMS+HA2mTRaWEc80=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3e52e76b70d5508f3cec70b882a29199f4d1ee85",
+        "rev": "e7f38be3775bab9659575f192ece011c033655f0",
         "type": "github"
       },
       "original": {
@@ -247,11 +247,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1693471703,
-        "narHash": "sha256-0l03ZBL8P1P6z8MaSDS/MvuU8E75rVxe5eE1N6gxeTo=",
+        "lastModified": 1693377291,
+        "narHash": "sha256-vYGY9bnqEeIncNarDZYhm6KdLKgXMS+HA2mTRaWEc80=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3e52e76b70d5508f3cec70b882a29199f4d1ee85",
+        "rev": "e7f38be3775bab9659575f192ece011c033655f0",
         "type": "github"
       },
       "original": {

flake.nix

@@ -26,7 +26,7 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
   };
-  outputs = { self, agenix, nixpkgs, nixos-hardware, chaosevents, fernglas, nixos-exporter, solid-xmpp-alarm, ... }@inputs: let
+  outputs = { self, nixpkgs, nixos-hardware, chaosevents, fernglas, nixos-exporter, solid-xmpp-alarm, ... }@inputs: let
     helper = (import ./lib/flake-helper.nix) inputs;
   in {
     clerie.hosts = {
@@ -86,12 +86,6 @@
       pkgs = import nixpkgs {
         overlays = [
           (import ./pkgs/overlay.nix)
-          (_: _: {
-            inherit (agenix.packages."x86_64-linux")
-              agenix;
-            inherit (chaosevents.packages."x86_64-linux")
-              chaosevents;
-           })
         ];
         system = "x86_64-linux";
       };
@@ -100,10 +94,7 @@
         anycast_healthchecker
         flask-excel
         iot-data
-        nixfiles-add-secret
-        nixfiles-generate-backup-secrets
         nixfiles-updated-inputs
-        nixfiles-update-ssh-host-keys
         pyexcel-xlsx
         pyexcel-webio
         uptimestatus

hosts/osmium/configuration.nix

@@ -5,8 +5,6 @@
     [
       ./hardware-configuration.nix
       ../../configuration/proxmox-vm
-
-      ./nixfiles-updated-inputs.nix
     ];
 
   boot.loader.grub.enable = true;

hosts/osmium/nixfiles-updated-inputs.nix

@@ -1,21 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  systemd.services.nixfiles-updated-inputs = {
-    environment = {
-      GIT_SSH_COMMAND = "ssh -o UserKnownHostsFile=${pkgs.writeText "known_hosts" "git.clerie.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIHQDwfRlw6L+pkLjXDgW2BUWlY1zNEDtVhNEsClgqaL"} -i %d/nixfiles-updated-inputs-ssh";
-      # nix likes a home directory to place the cache there
-      HOME = "/var/lib/nixfiles-updated-inputs";
-    };
-    serviceConfig = {
-      Type = "oneshot";
-      ExecStart = pkgs.nixfiles-updated-inputs + "/bin/nixfiles-updated-inputs";
-      StateDirectory = "nixfiles-updated-inputs";
-      WorkingDirectory = "/var/lib/nixfiles-updated-inputs";
-      DynamicUser = true;
-      # this sets the correct file permissions for the ssh key because we use DynamicUser
-      LoadCredential = "nixfiles-updated-inputs-ssh:${config.age.secrets."nixfiles-updated-inputs-ssh".path}";
-    };
-    startAt = "*-*-* 03:03:00";
-  };
-}

pkgs/nixfiles/default.nix

@@ -1,12 +1,10 @@
 { pkgs, ... }:
 
 pkgs.writeShellApplication {
-  name = "nixfiles-updated-inputs";
+  name = "nixfiles-updated-inputs.sh";
   text = builtins.readFile ./nixfiles-updated-inputs.sh;
-  runtimeInputs = with pkgs; [
-    git
-    nix
-    openssh
+  runtimeInputs = [
+    pkgs.git
   ];
 }
 

pkgs/nixfiles/nixfiles-add-secret.nix

@@ -1,11 +0,0 @@
-{ pkgs, ... }:
-
-pkgs.writeShellApplication {
-  name = "nixfiles-add-secret";
-  text = builtins.readFile ./nixfiles-add-secret.sh;
-  runtimeInputs = with pkgs; [
-    agenix
-    git
-  ];
-}
-

pkgs/nixfiles/nixfiles-add-secret.sh

@@ -1,15 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-cd "$(git rev-parse --show-toplevel)"
-
-host="$1"
-secret="$2"
-
-mkdir -p "hosts/${host}/secrets"
-
-agenix -e "hosts/${host}/secrets/new"
-
-mv "hosts/${host}/secrets/new" "hosts/${host}/secrets/${secret}.age"
-

pkgs/nixfiles/nixfiles-generate-backup-secrets.nix

@@ -1,13 +0,0 @@
-{ pkgs, ... }:
-
-pkgs.writeShellApplication {
-  name = "nixfiles-generate-backup-secrets";
-  text = builtins.readFile ./nixfiles-generate-backup-secrets.sh;
-  runtimeInputs = with pkgs; [
-    agenix
-    apacheHttpd
-    git
-    pwgen
-  ];
-}
-

pkgs/nixfiles/nixfiles-generate-backup-secrets.sh

@@ -1,32 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-cd "$(git rev-parse --show-toplevel)"
-
-host="$1"
-
-job_main="$(pwgen -1 64 1)"
-target_cyan="$(pwgen -1 64 1)"
-target_cyan_htpasswd="$(htpasswd -nbB "${host}" "${target_cyan}")"
-target_magenta="$(pwgen -1 64 1)"
-target_magenta_htpasswd="$(htpasswd -nbB "${host}" "${target_magenta}")"
-
-mkdir -p "hosts/${host}/secrets"
-
-echo "$job_main" | agenix -e "hosts/${host}/secrets/new"
-mv "hosts/${host}/secrets/new" "hosts/${host}/secrets/clerie-backup-job-main.age"
-
-echo "$target_cyan" | agenix -e "hosts/${host}/secrets/new"
-mv "hosts/${host}/secrets/new" "hosts/${host}/secrets/clerie-backup-target-cyan.age"
-
-echo "$target_magenta" | agenix -e "hosts/${host}/secrets/new"
-mv "hosts/${host}/secrets/new" "hosts/${host}/secrets/clerie-backup-target-magenta.age"
-
-prev_htpasswd_cyan="$(agenix -d hosts/clerie-backup/secrets/restic-server-cyan-htpasswd.age)"
-cat <(echo "$prev_htpasswd_cyan") <(echo "$target_cyan_htpasswd") | agenix -e "hosts/clerie-backup/secrets/new"
-mv "hosts/clerie-backup/secrets/new" "hosts/clerie-backup/secrets/restic-server-cyan-htpasswd.age"
-
-prev_htpasswd_magenta="$(agenix -d "hosts/backup-4/secrets/restic-server-magenta-htpasswd.age")"
-cat <(echo "$prev_htpasswd_magenta") <(echo "$target_magenta_htpasswd") | agenix -e "hosts/backup-4/secrets/new"
-mv "hosts/backup-4/secrets/new" "hosts/backup-4/secrets/restic-server-magenta-htpasswd.age"

pkgs/nixfiles/nixfiles-update-ssh-host-keys.nix

@@ -1,12 +0,0 @@
-{ pkgs, ... }:
-
-pkgs.writeShellApplication {
-  name = "nixfiles-update-ssh-host-keys";
-  text = builtins.readFile ./nixfiles-update-ssh-host-keys.sh;
-  runtimeInputs = with pkgs; [
-    git
-    nix
-    openssh
-  ];
-}
-

pkgs/nixfiles/nixfiles-updated-inputs.sh

@@ -4,15 +4,10 @@ set -euo pipefail
 
 NOW="$(date --utc --iso-8601=minutes)"
 
-git status || git clone gitea@git.clerie.de:clerie/nixfiles.git .
-echo "[!] Download changes"
-git fetch --all
+git fetch origin master
 git checkout updated-inputs
-git -c "user.name=Flake Update Bot" -c "user.email=flake-update-bot@clerie.de" merge -s ort -X theirs origin/master -m "Update from master ${NOW}"
-echo "[!] Update inputs"
+git merge -s ort -X theirs origin/master -m "Update from master ${NOW}"
 nix flake update
-echo "[!] Commit changes"
 git add flake.lock
-git -c "user.name=Flake Update Bot" -c "user.email=flake-update-bot@clerie.de" commit -m "Flake update ${NOW}" || true
-echo "[!] Publish"
+git commit -m "Flake update ${NOW}" || true
 git push origin updated-inputs

pkgs/overlay.nix

@@ -2,10 +2,7 @@ self: super: {
   anycast_healthchecker = self.python3.pkgs.callPackage ./anycast_healthchecker {};
   flask-excel = self.python3.pkgs.callPackage ./flask-excel {};
   iot-data = self.python3.pkgs.callPackage ./iot-data {};
-  nixfiles-add-secret = self.callPackage ./nixfiles/nixfiles-add-secret.nix {};
-  nixfiles-generate-backup-secrets = self.callPackage ./nixfiles/nixfiles-generate-backup-secrets.nix {};
-  nixfiles-updated-inputs = self.callPackage ./nixfiles/nixfiles-updated-inputs.nix {};
-  nixfiles-update-ssh-host-keys = self.callPackage ./nixfiles/nixfiles-update-ssh-host-keys.nix {};
+  nixfiles-updated-inputs = self.callPackage ./nixfiles {};
   pyexcel-xlsx = self.python3.pkgs.callPackage ./pyexcel-xlsx {};
   pyexcel-webio = self.python3.pkgs.callPackage ./pyexcel-webio {};
   uptimestatus = self.python3.pkgs.callPackage ./uptimestatus {};