Increase security: sudo with password, no more docker group for users

1 files changed, 15 insertions, 5 deletions

diff --git a/upgrade.sh b/upgrade.sh
index 17d61ce..8ed2763 100755
--- a/upgrade.sh
+++ b/upgrade.sh
@@ -8,6 +8,8 @@ else
 	NIXHOSTLIST="$@"
 fi
 
+TMP_SCRIPT=/tmp/tmp-upgrade-$(date +%s).sh
+
 for NIXHOST in $NIXHOSTLIST; do
 	NIXHOST=${NIXHOST%.*}
 
@@ -19,10 +21,18 @@ for NIXHOST in $NIXHOSTLIST; do
 
 	echo "==== DOING $NIXHOST ===="
 
-	ssh -F ssh_config $SSH_DEST sudo nix-channel --add https://nixos.org/channels/nixos-21.11 nixos
-	ssh -F ssh_config $SSH_DEST sudo nix-channel --update
-	ssh -F ssh_config $SSH_DEST sudo nixos-rebuild boot
+	ssh -F ssh_config $SSH_DEST tee $TMP_SCRIPT > /dev/null <<EOF
+set -ex
+
+nix-channel --add https://nixos.org/channels/nixos-21.11 nixos
+nix-channel --update
+nixos-rebuild boot
+EOF
+
+	read -p "Press Enter to continue (run upgrade on $NIXHOST)..."
+	ssh -t -F ssh_config $SSH_DEST sudo sh $TMP_SCRIPT
+	ssh -F ssh_config $SSH_DEST rm -v $TMP_SCRIPT
 
-	echo "Please reboot node manually to activate upgraded system:"
-	echo "$ ssh -F ssh_config $SSH_DEST sudo reboot"
+	read -p "Press Enter to continue (reboot $NIXHOST)..."
+	ssh -t -F ssh_config $SSH_DEST sudo reboot
 done