[sops] change reproducible secrets file structure
This commit is contained in:
@@ -25,7 +25,9 @@ fi
|
||||
|
||||
hostname=$1
|
||||
ipaddress=$2
|
||||
pwpath="machines/secrets/keys/itag"
|
||||
pwpath="machines/$hostname/secrets"
|
||||
hostkey="ssh_host_ed25519_key"
|
||||
initrdkey="initrd_ed25519_key"
|
||||
|
||||
# Create a temporary directory
|
||||
temp=$(mktemp -d)
|
||||
@@ -40,13 +42,13 @@ trap cleanup EXIT
|
||||
install -d -m755 "$temp/etc/ssh/"
|
||||
install -d -m755 "$temp/root/"
|
||||
|
||||
diskKey=$(sops -d $pwpath/$hostname/disk.key)
|
||||
diskKey=$(sops -d $pwpath/disk.key)
|
||||
echo "$diskKey" > /tmp/secret.key
|
||||
echo "$diskKey" > $temp/root/secret.key
|
||||
|
||||
sops -d "$pwpath/$hostname/$hostname" > "$temp/etc/ssh/$hostname"
|
||||
sops -d "$pwpath/$hostkey" > "$temp/etc/ssh/$hostname"
|
||||
|
||||
sopd -d "$pwpath/$hostname/$hostname"-init > "$temp/etc/ssh/initrd"
|
||||
sopd -d "$pwpath/$initrdkey" > "$temp/etc/ssh/initrd"
|
||||
|
||||
# # Set the correct permissions so sshd will accept the key
|
||||
chmod 600 "$temp/etc/ssh/$hostname"
|
||||
@@ -62,4 +64,4 @@ if [ $# = 3 ]
|
||||
else
|
||||
nix run github:numtide/nixos-anywhere -- --extra-files "$temp" \
|
||||
--disk-encryption-keys /tmp/secret.key /tmp/secret.key --flake .#$hostname root@$ipaddress
|
||||
fi
|
||||
fi
|
||||
|
||||
Reference in New Issue
Block a user