aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAlex Auvolat <alex@adnab.me>2022-04-20 13:07:39 +0200
committerAlex Auvolat <alex@adnab.me>2022-04-20 13:07:39 +0200
commitd056b385d71d5b33165ab87cbedffb243d168c8a (patch)
tree36dd218ff23ca150775815ae71c87d711301afa6
parent9c9c776213478023d4cab6290efcb6adfdbbbe86 (diff)
downloadnixcfg-d056b385d71d5b33165ab87cbedffb243d168c8a.tar.gz
nixcfg-d056b385d71d5b33165ab87cbedffb243d168c8a.zip
Refactor secrets
-rwxr-xr-xdeploy_pki7
-rwxr-xr-xsshtool13
2 files changed, 16 insertions, 4 deletions
diff --git a/deploy_pki b/deploy_pki
index fffb3d0..841088c 100755
--- a/deploy_pki
+++ b/deploy_pki
@@ -7,18 +7,17 @@ cmd mkdir -p /var/lib/nomad/pki /var/lib/consul/pki
for file in consul-ca.crt consul$YEAR.crt consul$YEAR.key consul$YEAR-client.crt consul$YEAR-client.key; do
if [ -f "$PKI/$file" ]; then
- copy $PKI/$file /var/lib/consul/pki/$file
+ copy_secret $PKI/$file /var/lib/consul/pki/$file
cmd chown consul:root /var/lib/consul/pki/$file
- cmd chmod 0400 /var/lib/consul/pki/$file
fi
done
cmd systemctl restart consul
cmd sleep 10
-for file in nomad-ca.crt nomad$YEAR.crt nomad$YER.key; do
+for file in nomad-ca.crt nomad$YEAR.crt nomad$YEAR.key; do
if [ -f "$PKI/$file" ]; then
- copy $PKI/$file /var/lib/nomad/pki/$file
+ copy_secret $PKI/$file /var/lib/nomad/pki/$file
fi
done
diff --git a/sshtool b/sshtool
index 94a3ea0..b5de384 100755
--- a/sshtool
+++ b/sshtool
@@ -68,6 +68,19 @@ EOG
EOF
}
+function copy_secret {
+ local FROM=$1
+ local TO=$2
+ cat <<EOF
+echo '- write secret $TO from $FROM'
+base64 -d <<EOG | tee $TO > /dev/null
+$(base64 <$FROM)
+EOG
+chown root:root $TO
+chmod 0600 $TO
+EOF
+}
+
for NIXHOST in $NIXHOSTLIST; do
NIXHOST=${NIXHOST%.*}