diff options
| -rw-r--r-- | configuration.nix | 12 | ||||
| -rwxr-xr-x | deploy.sh | 24 | ||||
| -rwxr-xr-x | upgrade.sh | 20 |
3 files changed, 38 insertions, 18 deletions
diff --git a/configuration.nix b/configuration.nix index bb44c40..649e7e8 100644 --- a/configuration.nix +++ b/configuration.nix @@ -115,7 +115,6 @@ in extraGroups = [ "wheel" # Enable ‘sudo’ for the user. "video" # Having fun with links -g - "docker" # Enable management of Docker containers ]; openssh.authorizedKeys.keys = [ # Keys for accessing nodes from outside @@ -126,7 +125,7 @@ in users.users.quentin = { isNormalUser = true; - extraGroups = [ "wheel" "docker" ]; + extraGroups = [ "wheel" ]; openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDT1+H08FdUSvdPpPKdcafq4+JRHvFVjfvG5Id97LAoROmFRUb/ZOMTLdNuD7FqvW0Da5CPxIMr8ZxfrFLtpGyuG7qdI030iIRZPlKpBh37epZHaV+l9F4ZwJQMIBO9cuyLPXgsyvM/s7tDtrdK1k7JTf2EVvoirrjSzBaMhAnhi7//to8zvujDtgDZzy6aby75bAaDetlYPBq2brWehtrf9yDDG9WAMYJqp//scje/WmhbRR6eSdim1HaUcWk5+4ZPt8sQJcy8iWxQ4jtgjqTvMOe5v8ZPkxJNBine/ZKoJsv7FzKem00xEH7opzktaGukyEqH0VwOwKhmBiqsX2yN quentin@dufour.io" "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDBu+KUebaWwlugMC5fGbNhHc6IaQDAC6+1vMc4Ww7nVU1rs2nwI7L5qcWxOwNdhFaorZQZy/fJuCWdFbF61RCKGayBWPLZHGPsfqDuggYNEi1Qil1kpeCECfDQNjyMTK058ZBBhOWNMHBjlLWXUlRJDkRBBECY0vo4jRv22SvSaPUCAnkdJ9rbAp/kqb497PTIb2r1l1/ew8YdhINAlpYQFQezZVfkZdTKxt22n0QCjhupqjfh3gfNnbBX0z/iO+RvAOWRIZsjPFLC+jXl+n7cnu2cq1nvST5eHiYfXXeIgIwmeENLKqp+2Twr7PIdv22PnJkh6iR5kx7eTRxkNZdN quentin@deuxfleurs.fr" @@ -135,7 +134,7 @@ in users.users.adrien = { isNormalUser = true; - extraGroups = [ "wheel" "docker" ]; + extraGroups = [ "wheel" ]; openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDBfVX+iQSHl3V0el3/y2Rtl9Q/nrmLoTE3oXnR+16yX7g8HvzU871q89jbE/UWvNRvO4hirTcKF8yojuq8ZRCoUcQO+6/YlPrY/2G8kFhPTlUGDQ+mLT+ancZsom4mkg3I9oQjKZ9qxMD1GuU8Ydz4eXjhJ8OGFZhBpEgnrLmdA53Y5d2fCbaZN5EYD4sWEFYN7xBLxTGNwv0gygiPs967Z4/ZfHngTvqVoS9wnQThSCIoXPTWFAJCkN8dC5tPZwnbOT1bGcYUF0VTrcaD6cU6Q1ZRrtyqXxnnyxpQCAoe2hgdIm+LnDsBx9trfPauqi0dXi36X8pLmudW1f1RmKWT adrien@bacigalupi" ]; @@ -143,7 +142,7 @@ in users.users.maximilien = { isNormalUser = true; - extraGroups = [ "wheel" "docker" ]; + extraGroups = [ "wheel" ]; openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDHMMR6zNzz8NQU80wFquhUCeiXJuGphjP+zNouKbn228GyESu8sfNBwnuZq86vblR11Lz8l2rtCM73GfAKg29qmUWUHRKWvRIYWv2vaUJcCdy0bAxIzcvCvjZX0SpnIKxe9y3Rp0LGO5WLYfw0ZFaavwFZP0Z8w1Kj9/zBmL2X2avbhkaYHi/C1yXhbvESYQysmqLa48EX/TS616MBrgR9zbI9AoTQ9NOHnR14Tve/AP/khcZoBJdm4hTttMbNkEc0wonzdylTDew263SPRs/uoqnQIpUtErdPHqU10Yup8HjXjEyFJsSwcZcM5sZOw5JKckKJwmcd0yjO/x/4/Mk5" ]; @@ -151,15 +150,12 @@ in users.users.kokakiwi = { isNormalUser = true; - extraGroups = [ "wheel" "docker" ]; + extraGroups = [ "wheel" ]; openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPTsEgcOtb2bij+Ih8eg8ZqO7d3IMiWykv6deMzlSSS kokakiwi@kira" ]; }; - # Passwordless sudo - security.sudo.wheelNeedsPassword = false; - # List packages installed in system profile. To search, run: # $ nix search wget environment.systemPackages = with pkgs; [ @@ -8,6 +8,8 @@ else NIXHOSTLIST="$@" fi +TMP_PATH=/tmp/tmp-deploy-$(date +%s) + for NIXHOST in $NIXHOSTLIST; do NIXHOST=${NIXHOST%.*} @@ -21,13 +23,25 @@ for NIXHOST in $NIXHOSTLIST; do echo "Sending NixOS config files" - cat configuration.nix | ssh -F ssh_config $SSH_DEST sudo tee /etc/nixos/configuration.nix > /dev/null - cat node/$NIXHOST.nix | ssh -F ssh_config $SSH_DEST sudo tee /etc/nixos/node.nix > /dev/null - cat node/$NIXHOST.site.nix | ssh -F ssh_config $SSH_DEST sudo tee /etc/nixos/site.nix > /dev/null + ssh -F ssh_config $SSH_DEST mkdir -p $TMP_PATH + cat configuration.nix | ssh -F ssh_config $SSH_DEST tee $TMP_PATH/configuration.nix > /dev/null + cat node/$NIXHOST.nix | ssh -F ssh_config $SSH_DEST tee $TMP_PATH/node.nix > /dev/null + cat node/$NIXHOST.site.nix | ssh -F ssh_config $SSH_DEST tee $TMP_PATH/site.nix > /dev/null echo "Sending secret files" - test -f secrets/rclone.conf && (cat secrets/rclone.conf | ssh -F ssh_config $SSH_DEST sudo tee /root/rclone.conf > /dev/null) + test -f secrets/rclone.conf && (cat secrets/rclone.conf | ssh -F ssh_config $SSH_DEST tee $TMP_PATH/rclone.conf > /dev/null) echo "Rebuilding NixOS" - ssh -F ssh_config $SSH_DEST sudo nixos-rebuild switch + + ssh -F ssh_config $SSH_DEST tee $TMP_PATH/deploy.sh > /dev/null <<EOF +set -ex + +cd $TMP_PATH +mv configuration.nix node.nix site.nix /etc/nixos +test -f rclone.conf && (mv rclone.conf /root; chmod 600 /root/rclone.conf) +nixos-rebuild switch +EOF + + ssh -t -F ssh_config $SSH_DEST sudo sh $TMP_PATH/deploy.sh + ssh -F ssh_config $SSH_DEST rm -rv $TMP_PATH done @@ -8,6 +8,8 @@ else NIXHOSTLIST="$@" fi +TMP_SCRIPT=/tmp/tmp-upgrade-$(date +%s).sh + for NIXHOST in $NIXHOSTLIST; do NIXHOST=${NIXHOST%.*} @@ -19,10 +21,18 @@ for NIXHOST in $NIXHOSTLIST; do echo "==== DOING $NIXHOST ====" - ssh -F ssh_config $SSH_DEST sudo nix-channel --add https://nixos.org/channels/nixos-21.11 nixos - ssh -F ssh_config $SSH_DEST sudo nix-channel --update - ssh -F ssh_config $SSH_DEST sudo nixos-rebuild boot + ssh -F ssh_config $SSH_DEST tee $TMP_SCRIPT > /dev/null <<EOF +set -ex + +nix-channel --add https://nixos.org/channels/nixos-21.11 nixos +nix-channel --update +nixos-rebuild boot +EOF + + read -p "Press Enter to continue (run upgrade on $NIXHOST)..." + ssh -t -F ssh_config $SSH_DEST sudo sh $TMP_SCRIPT + ssh -F ssh_config $SSH_DEST rm -v $TMP_SCRIPT - echo "Please reboot node manually to activate upgraded system:" - echo "$ ssh -F ssh_config $SSH_DEST sudo reboot" + read -p "Press Enter to continue (reboot $NIXHOST)..." + ssh -t -F ssh_config $SSH_DEST sudo reboot done |