diff options
author | Quentin Dufour <quentin@deuxfleurs.fr> | 2022-04-21 22:57:55 +0200 |
---|---|---|
committer | Quentin Dufour <quentin@deuxfleurs.fr> | 2022-04-21 22:57:55 +0200 |
commit | c430d8eaf1d091ad27e842c0000b77d87d791da6 (patch) | |
tree | c50e276da7fbe7a9b81548e65b72e3bf2a3621a1 /os/runners | |
parent | c99c0ffd30c3a6f3ea67323437f1a9773c3e283e (diff) | |
download | nixcfg-c430d8eaf1d091ad27e842c0000b77d87d791da6.tar.gz nixcfg-c430d8eaf1d091ad27e842c0000b77d87d791da6.zip |
Start refactor
Diffstat (limited to 'os/runners')
-rwxr-xr-x | os/runners/bash/deploy_nixos | 12 | ||||
-rwxr-xr-x | os/runners/bash/deploy_passwords | 5 | ||||
-rwxr-xr-x | os/runners/bash/deploy_pki | 38 | ||||
-rwxr-xr-x | os/runners/bash/deploy_wesher_key | 4 | ||||
-rwxr-xr-x | os/runners/bash/gen_wesher_key | 17 | ||||
-rwxr-xr-x | os/runners/bash/sshtool | 109 | ||||
-rwxr-xr-x | os/runners/bash/tlsproxy | 47 | ||||
-rwxr-xr-x | os/runners/bash/upgrade_nixos | 11 |
8 files changed, 243 insertions, 0 deletions
diff --git a/os/runners/bash/deploy_nixos b/os/runners/bash/deploy_nixos new file mode 100755 index 0000000..484bead --- /dev/null +++ b/os/runners/bash/deploy_nixos @@ -0,0 +1,12 @@ +#!/usr/bin/env ./sshtool + +copy nix/configuration.nix /etc/nixos/configuration.nix +copy nix/deuxfleurs.nix /etc/nixos/deuxfleurs.nix +copy nix/remote-unlock.nix /etc/nixos/remote-unlock.nix +copy nix/wesher.nix /etc/nixos/wesher.nix +copy nix/wesher_service.nix /etc/nixos/wesher_service.nix +copy cluster/$CLUSTER/cluster.nix /etc/nixos/cluster.nix +copy cluster/$CLUSTER/node/$NIXHOST.nix /etc/nixos/node.nix +copy cluster/$CLUSTER/node/$NIXHOST.site.nix /etc/nixos/site.nix + +cmd nixos-rebuild switch diff --git a/os/runners/bash/deploy_passwords b/os/runners/bash/deploy_passwords new file mode 100755 index 0000000..37c2143 --- /dev/null +++ b/os/runners/bash/deploy_passwords @@ -0,0 +1,5 @@ +#!/usr/bin/env ./sshtool + +write_pass deuxfleurs/cluster/$CLUSTER/passwords /root/deploy_tmp_passwords +cmd 'chpasswd -e < /root/deploy_tmp_passwords' +cmd rm /root/deploy_tmp_passwords diff --git a/os/runners/bash/deploy_pki b/os/runners/bash/deploy_pki new file mode 100755 index 0000000..167ac50 --- /dev/null +++ b/os/runners/bash/deploy_pki @@ -0,0 +1,38 @@ +#!/usr/bin/env ./sshtool + +PKI=deuxfleurs/cluster/$CLUSTER +YEAR=$(date +%Y) + +cmd mkdir -p /var/lib/nomad/pki /var/lib/consul/pki + +for file in consul-ca.crt consul$YEAR.crt consul$YEAR.key \ + consul$YEAR-client.crt consul$YEAR-client.key +do + if pass $PKI/$file >/dev/null; then + write_pass $PKI/$file /var/lib/consul/pki/$file + cmd chown consul:root /var/lib/consul/pki/$file + fi +done + +cmd systemctl restart consul +cmd sleep 10 + +for file in nomad-ca.crt nomad$YEAR.crt nomad$YEAR.key \ + consul$YEAR.crt consul$YEAR-client.crt consul$YEAR-client.key +do + if pass $PKI/$file >/dev/null; then + write_pass $PKI/$file /var/lib/nomad/pki/$file + cmd "chown \$(stat -c %u /var/lib/private/nomad) /var/lib/nomad/pki/$file" + fi +done + +cmd systemctl restart nomad + +set_env CONSUL_HTTP_ADDR=https://localhost:8501 +set_env CONSUL_CACERT=/var/lib/consul/pki/consul-ca.crt +set_env CONSUL_CLIENT_CERT=/var/lib/consul/pki/consul$YEAR-client.crt +set_env CONSUL_CLIENT_KEY=/var/lib/consul/pki/consul$YEAR-client.key + +cmd "consul kv put secrets/consul/consul-ca.crt - < /var/lib/consul/pki/consul-ca.crt" +cmd "consul kv put secrets/consul/consul-client.crt - < /var/lib/consul/pki/consul$YEAR-client.crt" +cmd "consul kv put secrets/consul/consul-client.key - < /var/lib/consul/pki/consul$YEAR-client.key" diff --git a/os/runners/bash/deploy_wesher_key b/os/runners/bash/deploy_wesher_key new file mode 100755 index 0000000..8f7ed77 --- /dev/null +++ b/os/runners/bash/deploy_wesher_key @@ -0,0 +1,4 @@ +#!/usr/bin/env ./sshtool + +write_pass deuxfleurs/cluster/$CLUSTER/wesher_key /var/lib/wesher/secrets +cmd systemctl restart wesher diff --git a/os/runners/bash/gen_wesher_key b/os/runners/bash/gen_wesher_key new file mode 100755 index 0000000..c66fade --- /dev/null +++ b/os/runners/bash/gen_wesher_key @@ -0,0 +1,17 @@ +#!/usr/bin/env sh + +cd $(dirname $0) + +CLUSTER="$1" +if [ -z "$CLUSTER" ] || [ ! -d "cluster/$CLUSTER" ]; then + echo "Usage: $0 <cluster name>" + echo "The cluster name must be the name of a subdirectory of cluster/" + exit 1 +fi + +K=deuxfleurs/cluster/$CLUSTER/wesher_key +if ! pass $K >/dev/null; then + pass insert -m $K <<EOF +WESHER_CLUSTER_KEY=$(head -c 32 /dev/urandom | base64) +EOF +fi diff --git a/os/runners/bash/sshtool b/os/runners/bash/sshtool new file mode 100755 index 0000000..58b00ef --- /dev/null +++ b/os/runners/bash/sshtool @@ -0,0 +1,109 @@ +#!/usr/bin/env bash + +cd $(dirname $0) + +CMDFILE="$1" +shift 1 + +CLUSTER="$1" +if [ -z "$CLUSTER" ] || [ ! -d "cluster/$CLUSTER" ]; then + echo "Usage: $CMDFILE <cluster name>" + echo "The cluster name must be the name of a subdirectory of cluster/" + exit 1 +fi +shift 1 + +if [ -z "$1" ]; then + NIXHOSTLIST=$(ls cluster/$CLUSTER/node | grep -v '\.site\.') +else + NIXHOSTLIST="$@" +fi + +if [ -z "$ROOT_PASS" ]; then + read -s -p "Enter remote sudo password: " ROOT_PASS + echo +fi + +SSH_CONFIG=cluster/$CLUSTER/ssh_config + +function header { + cat <<EOF +export DEPLOYTOOL_ROOT_PASSWORD=$ROOT_PASS +cat > /tmp/deploytool_askpass <<EOG +#!/usr/bin/env sh +echo \$DEPLOYTOOL_ROOT_PASSWORD +EOG +chmod +x /tmp/deploytool_askpass +export SUDO_ASKPASS=/tmp/deploytool_askpass +sudo -A sh - <<'EOEVERYTHING' +EOF +} + +function footer { + echo EOEVERYTHING +} + +function message { + echo "echo '$@'" +} + +function cmd { + echo "echo '- run $@'" + echo "$@" +} + +function set_env { + echo "echo '- set $@'" + echo "export $@" +} + +function copy { + local FROM=$1 + local TO=$2 + cat <<EOF +echo '- write $TO from $FROM' +base64 -d <<EOG | tee $TO > /dev/null +$(base64 <$FROM) +EOG +EOF +} + +function copy_secret { + local FROM=$1 + local TO=$2 + cat <<EOF +echo '- write secret $TO from $FROM' +base64 -d <<EOG | tee $TO > /dev/null +$(base64 <$FROM) +EOG +chown root:root $TO +chmod 0600 $TO +EOF +} + +function write_pass { + local PASSKEY=$1 + local TO=$2 + cat <<EOF +echo '- write secret $TO from pass $PASSKEY' +base64 -d <<EOG | tee $TO > /dev/null +$(pass $PASSKEY | base64) +EOG +chown root:root $TO +chmod 0600 $TO +EOF +} + +for NIXHOST in $NIXHOSTLIST; do + NIXHOST=${NIXHOST%.*} + + if [ -z "$SSH_USER" ]; then + SSH_DEST=$NIXHOST + else + SSH_DEST=$SSH_USER@$NIXHOST + fi + + echo "==== DOING $NIXHOST ====" + + (header; . $CMDFILE; footer) | ssh -F $SSH_CONFIG $SSH_DEST sh - +done diff --git a/os/runners/bash/tlsproxy b/os/runners/bash/tlsproxy new file mode 100755 index 0000000..7546b81 --- /dev/null +++ b/os/runners/bash/tlsproxy @@ -0,0 +1,47 @@ +#!/bin/sh + +set -xe + +# Enter proper cluster subdirectory + +cd $(dirname $0) + +CLUSTER="$1" +if [ ! -d "cluster/$CLUSTER" ]; then + echo "Usage: $0 <cluster name>" + echo "The cluster name must be the name of a subdirectory of cluster/" + exit 1 +fi + +PREFIX="deuxfleurs/cluster/$CLUSTER" + +# Do actual stuff + +YEAR=$(date +%Y) + +CERTDIR=$(mktemp -d) + +_int() { + echo "Caught SIGINT signal!" + rm -rv $CERTDIR + kill -INT "$child1" 2>/dev/null + kill -INT "$child2" 2>/dev/null +} + +trap _int SIGINT + +pass $PREFIX/nomad$YEAR.crt > $CERTDIR/nomad.crt +pass $PREFIX/nomad$YEAR-client.crt > $CERTDIR/nomad-client.crt +pass $PREFIX/nomad$YEAR-client.key > $CERTDIR/nomad-client.key +pass $PREFIX/consul$YEAR.crt > $CERTDIR/consul.crt +pass $PREFIX/consul$YEAR-client.crt > $CERTDIR/consul-client.crt +pass $PREFIX/consul$YEAR-client.key > $CERTDIR/consul-client.key + +socat -dd tcp4-listen:4646,reuseaddr,fork openssl:localhost:14646,cert=$CERTDIR/nomad-client.crt,key=$CERTDIR/nomad-client.key,cafile=$CERTDIR/nomad.crt & +child1=$! + +socat -dd tcp4-listen:8500,reuseaddr,fork openssl:localhost:8501,cert=$CERTDIR/consul-client.crt,key=$CERTDIR/consul-client.key,cafile=$CERTDIR/consul.crt & +child2=$! + +wait "$child1" +wait "$child2" diff --git a/os/runners/bash/upgrade_nixos b/os/runners/bash/upgrade_nixos new file mode 100755 index 0000000..fd6cc62 --- /dev/null +++ b/os/runners/bash/upgrade_nixos @@ -0,0 +1,11 @@ +#!/usr/bin/env ./sshtool + +cmd nix-channel --add https://nixos.org/channels/nixos-21.11 nixos +cmd nix-channel --update +cmd nixos-rebuild boot + +if [ "$REBOOT_NODES" = "yes" ]; then + cmd reboot +else + message "Node will not reboot, use \"REBOOT_NODES=yes $CMDFILE\" to reboot nodes when they finish upgrading." +fi |