From c430d8eaf1d091ad27e842c0000b77d87d791da6 Mon Sep 17 00:00:00 2001 From: Quentin Dufour Date: Thu, 21 Apr 2022 22:57:55 +0200 Subject: Start refactor --- deploy_nixos | 12 ---- deploy_passwords | 5 -- deploy_pki | 38 ------------ deploy_wesher_key | 4 -- gen_pki | 118 -------------------------------------- gen_wesher_key | 17 ------ nix/wesher.nix | 25 -------- os/overlays/wesher.nix | 25 ++++++++ os/runners/bash/deploy_nixos | 12 ++++ os/runners/bash/deploy_passwords | 5 ++ os/runners/bash/deploy_pki | 38 ++++++++++++ os/runners/bash/deploy_wesher_key | 4 ++ os/runners/bash/gen_wesher_key | 17 ++++++ os/runners/bash/sshtool | 109 +++++++++++++++++++++++++++++++++++ os/runners/bash/tlsproxy | 47 +++++++++++++++ os/runners/bash/upgrade_nixos | 11 ++++ os/secretgen/gen_pki | 118 ++++++++++++++++++++++++++++++++++++++ os/secretgen/passwd | 30 ++++++++++ passwd | 30 ---------- sshtool | 109 ----------------------------------- tlsproxy | 47 --------------- upgrade_nixos | 11 ---- 22 files changed, 416 insertions(+), 416 deletions(-) delete mode 100755 deploy_nixos delete mode 100755 deploy_passwords delete mode 100755 deploy_pki delete mode 100755 deploy_wesher_key delete mode 100755 gen_pki delete mode 100755 gen_wesher_key delete mode 100644 nix/wesher.nix create mode 100644 os/overlays/wesher.nix create mode 100755 os/runners/bash/deploy_nixos create mode 100755 os/runners/bash/deploy_passwords create mode 100755 os/runners/bash/deploy_pki create mode 100755 os/runners/bash/deploy_wesher_key create mode 100755 os/runners/bash/gen_wesher_key create mode 100755 os/runners/bash/sshtool create mode 100755 os/runners/bash/tlsproxy create mode 100755 os/runners/bash/upgrade_nixos create mode 100755 os/secretgen/gen_pki create mode 100755 os/secretgen/passwd delete mode 100755 passwd delete mode 100755 sshtool delete mode 100755 tlsproxy delete mode 100755 upgrade_nixos diff --git a/deploy_nixos b/deploy_nixos deleted file mode 100755 index 484bead..0000000 --- a/deploy_nixos +++ /dev/null @@ -1,12 +0,0 @@ -#!/usr/bin/env ./sshtool - -copy nix/configuration.nix /etc/nixos/configuration.nix -copy nix/deuxfleurs.nix /etc/nixos/deuxfleurs.nix -copy nix/remote-unlock.nix /etc/nixos/remote-unlock.nix -copy nix/wesher.nix /etc/nixos/wesher.nix -copy nix/wesher_service.nix /etc/nixos/wesher_service.nix -copy cluster/$CLUSTER/cluster.nix /etc/nixos/cluster.nix -copy cluster/$CLUSTER/node/$NIXHOST.nix /etc/nixos/node.nix -copy cluster/$CLUSTER/node/$NIXHOST.site.nix /etc/nixos/site.nix - -cmd nixos-rebuild switch diff --git a/deploy_passwords b/deploy_passwords deleted file mode 100755 index 37c2143..0000000 --- a/deploy_passwords +++ /dev/null @@ -1,5 +0,0 @@ -#!/usr/bin/env ./sshtool - -write_pass deuxfleurs/cluster/$CLUSTER/passwords /root/deploy_tmp_passwords -cmd 'chpasswd -e < /root/deploy_tmp_passwords' -cmd rm /root/deploy_tmp_passwords diff --git a/deploy_pki b/deploy_pki deleted file mode 100755 index 167ac50..0000000 --- a/deploy_pki +++ /dev/null @@ -1,38 +0,0 @@ -#!/usr/bin/env ./sshtool - -PKI=deuxfleurs/cluster/$CLUSTER -YEAR=$(date +%Y) - -cmd mkdir -p /var/lib/nomad/pki /var/lib/consul/pki - -for file in consul-ca.crt consul$YEAR.crt consul$YEAR.key \ - consul$YEAR-client.crt consul$YEAR-client.key -do - if pass $PKI/$file >/dev/null; then - write_pass $PKI/$file /var/lib/consul/pki/$file - cmd chown consul:root /var/lib/consul/pki/$file - fi -done - -cmd systemctl restart consul -cmd sleep 10 - -for file in nomad-ca.crt nomad$YEAR.crt nomad$YEAR.key \ - consul$YEAR.crt consul$YEAR-client.crt consul$YEAR-client.key -do - if pass $PKI/$file >/dev/null; then - write_pass $PKI/$file /var/lib/nomad/pki/$file - cmd "chown \$(stat -c %u /var/lib/private/nomad) /var/lib/nomad/pki/$file" - fi -done - -cmd systemctl restart nomad - -set_env CONSUL_HTTP_ADDR=https://localhost:8501 -set_env CONSUL_CACERT=/var/lib/consul/pki/consul-ca.crt -set_env CONSUL_CLIENT_CERT=/var/lib/consul/pki/consul$YEAR-client.crt -set_env CONSUL_CLIENT_KEY=/var/lib/consul/pki/consul$YEAR-client.key - -cmd "consul kv put secrets/consul/consul-ca.crt - < /var/lib/consul/pki/consul-ca.crt" -cmd "consul kv put secrets/consul/consul-client.crt - < /var/lib/consul/pki/consul$YEAR-client.crt" -cmd "consul kv put secrets/consul/consul-client.key - < /var/lib/consul/pki/consul$YEAR-client.key" diff --git a/deploy_wesher_key b/deploy_wesher_key deleted file mode 100755 index 8f7ed77..0000000 --- a/deploy_wesher_key +++ /dev/null @@ -1,4 +0,0 @@ -#!/usr/bin/env ./sshtool - -write_pass deuxfleurs/cluster/$CLUSTER/wesher_key /var/lib/wesher/secrets -cmd systemctl restart wesher diff --git a/gen_pki b/gen_pki deleted file mode 100755 index 57da699..0000000 --- a/gen_pki +++ /dev/null @@ -1,118 +0,0 @@ -#!/usr/bin/env sh - -set -ex - -cd $(dirname $0) - -CLUSTER="$1" -if [ -z "$CLUSTER" ] || [ ! -d "cluster/$CLUSTER" ]; then - echo "Usage: $0 " - echo "The cluster name must be the name of a subdirectory of cluster/" - exit 1 -fi - -PREFIX="deuxfleurs/cluster/$CLUSTER" - -YEAR=$(date +%Y) -for APP in consul nomad; do - # 1. Create certificate authority - if ! pass $PREFIX/$APP-ca.key >/dev/null; then - echo "Generating $APP CA keys..." - openssl genrsa 4096 | pass insert -m $PREFIX/$APP-ca.key - - openssl req -x509 -new -nodes \ - -key <(pass $PREFIX/$APP-ca.key) -sha256 \ - -days 3650 -subj "/C=FR/O=Deuxfleurs/CN=$APP" \ - | pass insert -m -f $PREFIX/$APP-ca.crt - fi - - CERT="${APP}${YEAR}" - - # 2. Create and sign certificates for inter-node communication - if ! pass $PREFIX/$CERT.crt >/dev/null; then - echo "Generating $CERT agent keys..." - if ! pass $PREFIX/$CERT.key >/dev/null; then - openssl genrsa 4096 | pass insert -m $PREFIX/$CERT.key - fi - openssl req -new -sha256 -key <(pass $PREFIX/$CERT.key) \ - -subj "/C=FR/O=Deuxfleurs/CN=$APP" \ - -out /tmp/tmp-$CLUSTER-$CERT.csr - openssl req -in /tmp/tmp-$CLUSTER-$CERT.csr -noout -text - openssl x509 -req -in /tmp/tmp-$CLUSTER-$CERT.csr \ - -extensions v3_req \ - -extfile <(cat </dev/null; then - echo "Generating $CERT client keys..." - if ! pass $PREFIX/$CERT-client.key >/dev/null; then - openssl genrsa 4096 | pass insert -m $PREFIX/$CERT-client.key - fi - openssl req -new -sha256 -key <(pass $PREFIX/$CERT-client.key) \ - -subj "/C=FR/O=Deuxfleurs/CN=$APP-client" \ - -out /tmp/tmp-$CLUSTER-$CERT-client.csr - openssl req -in /tmp/tmp-$CLUSTER-$CERT-client.csr -noout -text - openssl x509 -req -in /tmp/tmp-$CLUSTER-$CERT-client.csr \ - -extensions v3_req \ - -extfile <(cat <" - echo "The cluster name must be the name of a subdirectory of cluster/" - exit 1 -fi - -K=deuxfleurs/cluster/$CLUSTER/wesher_key -if ! pass $K >/dev/null; then - pass insert -m $K </dev/null; then + write_pass $PKI/$file /var/lib/consul/pki/$file + cmd chown consul:root /var/lib/consul/pki/$file + fi +done + +cmd systemctl restart consul +cmd sleep 10 + +for file in nomad-ca.crt nomad$YEAR.crt nomad$YEAR.key \ + consul$YEAR.crt consul$YEAR-client.crt consul$YEAR-client.key +do + if pass $PKI/$file >/dev/null; then + write_pass $PKI/$file /var/lib/nomad/pki/$file + cmd "chown \$(stat -c %u /var/lib/private/nomad) /var/lib/nomad/pki/$file" + fi +done + +cmd systemctl restart nomad + +set_env CONSUL_HTTP_ADDR=https://localhost:8501 +set_env CONSUL_CACERT=/var/lib/consul/pki/consul-ca.crt +set_env CONSUL_CLIENT_CERT=/var/lib/consul/pki/consul$YEAR-client.crt +set_env CONSUL_CLIENT_KEY=/var/lib/consul/pki/consul$YEAR-client.key + +cmd "consul kv put secrets/consul/consul-ca.crt - < /var/lib/consul/pki/consul-ca.crt" +cmd "consul kv put secrets/consul/consul-client.crt - < /var/lib/consul/pki/consul$YEAR-client.crt" +cmd "consul kv put secrets/consul/consul-client.key - < /var/lib/consul/pki/consul$YEAR-client.key" diff --git a/os/runners/bash/deploy_wesher_key b/os/runners/bash/deploy_wesher_key new file mode 100755 index 0000000..8f7ed77 --- /dev/null +++ b/os/runners/bash/deploy_wesher_key @@ -0,0 +1,4 @@ +#!/usr/bin/env ./sshtool + +write_pass deuxfleurs/cluster/$CLUSTER/wesher_key /var/lib/wesher/secrets +cmd systemctl restart wesher diff --git a/os/runners/bash/gen_wesher_key b/os/runners/bash/gen_wesher_key new file mode 100755 index 0000000..c66fade --- /dev/null +++ b/os/runners/bash/gen_wesher_key @@ -0,0 +1,17 @@ +#!/usr/bin/env sh + +cd $(dirname $0) + +CLUSTER="$1" +if [ -z "$CLUSTER" ] || [ ! -d "cluster/$CLUSTER" ]; then + echo "Usage: $0 " + echo "The cluster name must be the name of a subdirectory of cluster/" + exit 1 +fi + +K=deuxfleurs/cluster/$CLUSTER/wesher_key +if ! pass $K >/dev/null; then + pass insert -m $K <" + echo "The cluster name must be the name of a subdirectory of cluster/" + exit 1 +fi +shift 1 + +if [ -z "$1" ]; then + NIXHOSTLIST=$(ls cluster/$CLUSTER/node | grep -v '\.site\.') +else + NIXHOSTLIST="$@" +fi + +if [ -z "$ROOT_PASS" ]; then + read -s -p "Enter remote sudo password: " ROOT_PASS + echo +fi + +SSH_CONFIG=cluster/$CLUSTER/ssh_config + +function header { + cat < /tmp/deploytool_askpass < /dev/null +$(base64 <$FROM) +EOG +EOF +} + +function copy_secret { + local FROM=$1 + local TO=$2 + cat < /dev/null +$(base64 <$FROM) +EOG +chown root:root $TO +chmod 0600 $TO +EOF +} + +function write_pass { + local PASSKEY=$1 + local TO=$2 + cat < /dev/null +$(pass $PASSKEY | base64) +EOG +chown root:root $TO +chmod 0600 $TO +EOF +} + +for NIXHOST in $NIXHOSTLIST; do + NIXHOST=${NIXHOST%.*} + + if [ -z "$SSH_USER" ]; then + SSH_DEST=$NIXHOST + else + SSH_DEST=$SSH_USER@$NIXHOST + fi + + echo "==== DOING $NIXHOST ====" + + (header; . $CMDFILE; footer) | ssh -F $SSH_CONFIG $SSH_DEST sh - +done diff --git a/os/runners/bash/tlsproxy b/os/runners/bash/tlsproxy new file mode 100755 index 0000000..7546b81 --- /dev/null +++ b/os/runners/bash/tlsproxy @@ -0,0 +1,47 @@ +#!/bin/sh + +set -xe + +# Enter proper cluster subdirectory + +cd $(dirname $0) + +CLUSTER="$1" +if [ ! -d "cluster/$CLUSTER" ]; then + echo "Usage: $0 " + echo "The cluster name must be the name of a subdirectory of cluster/" + exit 1 +fi + +PREFIX="deuxfleurs/cluster/$CLUSTER" + +# Do actual stuff + +YEAR=$(date +%Y) + +CERTDIR=$(mktemp -d) + +_int() { + echo "Caught SIGINT signal!" + rm -rv $CERTDIR + kill -INT "$child1" 2>/dev/null + kill -INT "$child2" 2>/dev/null +} + +trap _int SIGINT + +pass $PREFIX/nomad$YEAR.crt > $CERTDIR/nomad.crt +pass $PREFIX/nomad$YEAR-client.crt > $CERTDIR/nomad-client.crt +pass $PREFIX/nomad$YEAR-client.key > $CERTDIR/nomad-client.key +pass $PREFIX/consul$YEAR.crt > $CERTDIR/consul.crt +pass $PREFIX/consul$YEAR-client.crt > $CERTDIR/consul-client.crt +pass $PREFIX/consul$YEAR-client.key > $CERTDIR/consul-client.key + +socat -dd tcp4-listen:4646,reuseaddr,fork openssl:localhost:14646,cert=$CERTDIR/nomad-client.crt,key=$CERTDIR/nomad-client.key,cafile=$CERTDIR/nomad.crt & +child1=$! + +socat -dd tcp4-listen:8500,reuseaddr,fork openssl:localhost:8501,cert=$CERTDIR/consul-client.crt,key=$CERTDIR/consul-client.key,cafile=$CERTDIR/consul.crt & +child2=$! + +wait "$child1" +wait "$child2" diff --git a/os/runners/bash/upgrade_nixos b/os/runners/bash/upgrade_nixos new file mode 100755 index 0000000..fd6cc62 --- /dev/null +++ b/os/runners/bash/upgrade_nixos @@ -0,0 +1,11 @@ +#!/usr/bin/env ./sshtool + +cmd nix-channel --add https://nixos.org/channels/nixos-21.11 nixos +cmd nix-channel --update +cmd nixos-rebuild boot + +if [ "$REBOOT_NODES" = "yes" ]; then + cmd reboot +else + message "Node will not reboot, use \"REBOOT_NODES=yes $CMDFILE\" to reboot nodes when they finish upgrading." +fi diff --git a/os/secretgen/gen_pki b/os/secretgen/gen_pki new file mode 100755 index 0000000..57da699 --- /dev/null +++ b/os/secretgen/gen_pki @@ -0,0 +1,118 @@ +#!/usr/bin/env sh + +set -ex + +cd $(dirname $0) + +CLUSTER="$1" +if [ -z "$CLUSTER" ] || [ ! -d "cluster/$CLUSTER" ]; then + echo "Usage: $0 " + echo "The cluster name must be the name of a subdirectory of cluster/" + exit 1 +fi + +PREFIX="deuxfleurs/cluster/$CLUSTER" + +YEAR=$(date +%Y) +for APP in consul nomad; do + # 1. Create certificate authority + if ! pass $PREFIX/$APP-ca.key >/dev/null; then + echo "Generating $APP CA keys..." + openssl genrsa 4096 | pass insert -m $PREFIX/$APP-ca.key + + openssl req -x509 -new -nodes \ + -key <(pass $PREFIX/$APP-ca.key) -sha256 \ + -days 3650 -subj "/C=FR/O=Deuxfleurs/CN=$APP" \ + | pass insert -m -f $PREFIX/$APP-ca.crt + fi + + CERT="${APP}${YEAR}" + + # 2. Create and sign certificates for inter-node communication + if ! pass $PREFIX/$CERT.crt >/dev/null; then + echo "Generating $CERT agent keys..." + if ! pass $PREFIX/$CERT.key >/dev/null; then + openssl genrsa 4096 | pass insert -m $PREFIX/$CERT.key + fi + openssl req -new -sha256 -key <(pass $PREFIX/$CERT.key) \ + -subj "/C=FR/O=Deuxfleurs/CN=$APP" \ + -out /tmp/tmp-$CLUSTER-$CERT.csr + openssl req -in /tmp/tmp-$CLUSTER-$CERT.csr -noout -text + openssl x509 -req -in /tmp/tmp-$CLUSTER-$CERT.csr \ + -extensions v3_req \ + -extfile <(cat </dev/null; then + echo "Generating $CERT client keys..." + if ! pass $PREFIX/$CERT-client.key >/dev/null; then + openssl genrsa 4096 | pass insert -m $PREFIX/$CERT-client.key + fi + openssl req -new -sha256 -key <(pass $PREFIX/$CERT-client.key) \ + -subj "/C=FR/O=Deuxfleurs/CN=$APP-client" \ + -out /tmp/tmp-$CLUSTER-$CERT-client.csr + openssl req -in /tmp/tmp-$CLUSTER-$CERT-client.csr -noout -text + openssl x509 -req -in /tmp/tmp-$CLUSTER-$CERT-client.csr \ + -extensions v3_req \ + -extfile <(cat < " + echo "The cluster name must be the name of a subdirectory of cluster/" + exit 1 +} + +CLUSTER="$1" +if [ -z "$CLUSTER" ] || [ ! -d "cluster/$CLUSTER" ]; then + usage +fi + +USERNAME="$2" +if [ -z "$USERNAME" ]; then + usage +fi + +PREFIX="deuxfleurs/cluster/$CLUSTER" + +if ! EXISTING_PASSWORDS=$(pass $PREFIX/passwords | egrep -v "^$USERNAME:"); then + EXISTING_PASSWORDS="" +fi + +echo "Enter new password for user $USERNAME:" +NEW_PASSWD=$(openssl passwd -6) + +(echo $EXISTING_PASSWORDS; echo $USERNAME:$NEW_PASSWD) | pass insert -m $PREFIX/passwords diff --git a/passwd b/passwd deleted file mode 100755 index 7cc80b6..0000000 --- a/passwd +++ /dev/null @@ -1,30 +0,0 @@ -#!/usr/bin/env sh - -cd $(dirname $0) - -function usage { - echo "Usage: $0 " - echo "The cluster name must be the name of a subdirectory of cluster/" - exit 1 -} - -CLUSTER="$1" -if [ -z "$CLUSTER" ] || [ ! -d "cluster/$CLUSTER" ]; then - usage -fi - -USERNAME="$2" -if [ -z "$USERNAME" ]; then - usage -fi - -PREFIX="deuxfleurs/cluster/$CLUSTER" - -if ! EXISTING_PASSWORDS=$(pass $PREFIX/passwords | egrep -v "^$USERNAME:"); then - EXISTING_PASSWORDS="" -fi - -echo "Enter new password for user $USERNAME:" -NEW_PASSWD=$(openssl passwd -6) - -(echo $EXISTING_PASSWORDS; echo $USERNAME:$NEW_PASSWD) | pass insert -m $PREFIX/passwords diff --git a/sshtool b/sshtool deleted file mode 100755 index 58b00ef..0000000 --- a/sshtool +++ /dev/null @@ -1,109 +0,0 @@ -#!/usr/bin/env bash - -cd $(dirname $0) - -CMDFILE="$1" -shift 1 - -CLUSTER="$1" -if [ -z "$CLUSTER" ] || [ ! -d "cluster/$CLUSTER" ]; then - echo "Usage: $CMDFILE " - echo "The cluster name must be the name of a subdirectory of cluster/" - exit 1 -fi -shift 1 - -if [ -z "$1" ]; then - NIXHOSTLIST=$(ls cluster/$CLUSTER/node | grep -v '\.site\.') -else - NIXHOSTLIST="$@" -fi - -if [ -z "$ROOT_PASS" ]; then - read -s -p "Enter remote sudo password: " ROOT_PASS - echo -fi - -SSH_CONFIG=cluster/$CLUSTER/ssh_config - -function header { - cat < /tmp/deploytool_askpass < /dev/null -$(base64 <$FROM) -EOG -EOF -} - -function copy_secret { - local FROM=$1 - local TO=$2 - cat < /dev/null -$(base64 <$FROM) -EOG -chown root:root $TO -chmod 0600 $TO -EOF -} - -function write_pass { - local PASSKEY=$1 - local TO=$2 - cat < /dev/null -$(pass $PASSKEY | base64) -EOG -chown root:root $TO -chmod 0600 $TO -EOF -} - -for NIXHOST in $NIXHOSTLIST; do - NIXHOST=${NIXHOST%.*} - - if [ -z "$SSH_USER" ]; then - SSH_DEST=$NIXHOST - else - SSH_DEST=$SSH_USER@$NIXHOST - fi - - echo "==== DOING $NIXHOST ====" - - (header; . $CMDFILE; footer) | ssh -F $SSH_CONFIG $SSH_DEST sh - -done diff --git a/tlsproxy b/tlsproxy deleted file mode 100755 index 7546b81..0000000 --- a/tlsproxy +++ /dev/null @@ -1,47 +0,0 @@ -#!/bin/sh - -set -xe - -# Enter proper cluster subdirectory - -cd $(dirname $0) - -CLUSTER="$1" -if [ ! -d "cluster/$CLUSTER" ]; then - echo "Usage: $0 " - echo "The cluster name must be the name of a subdirectory of cluster/" - exit 1 -fi - -PREFIX="deuxfleurs/cluster/$CLUSTER" - -# Do actual stuff - -YEAR=$(date +%Y) - -CERTDIR=$(mktemp -d) - -_int() { - echo "Caught SIGINT signal!" - rm -rv $CERTDIR - kill -INT "$child1" 2>/dev/null - kill -INT "$child2" 2>/dev/null -} - -trap _int SIGINT - -pass $PREFIX/nomad$YEAR.crt > $CERTDIR/nomad.crt -pass $PREFIX/nomad$YEAR-client.crt > $CERTDIR/nomad-client.crt -pass $PREFIX/nomad$YEAR-client.key > $CERTDIR/nomad-client.key -pass $PREFIX/consul$YEAR.crt > $CERTDIR/consul.crt -pass $PREFIX/consul$YEAR-client.crt > $CERTDIR/consul-client.crt -pass $PREFIX/consul$YEAR-client.key > $CERTDIR/consul-client.key - -socat -dd tcp4-listen:4646,reuseaddr,fork openssl:localhost:14646,cert=$CERTDIR/nomad-client.crt,key=$CERTDIR/nomad-client.key,cafile=$CERTDIR/nomad.crt & -child1=$! - -socat -dd tcp4-listen:8500,reuseaddr,fork openssl:localhost:8501,cert=$CERTDIR/consul-client.crt,key=$CERTDIR/consul-client.key,cafile=$CERTDIR/consul.crt & -child2=$! - -wait "$child1" -wait "$child2" diff --git a/upgrade_nixos b/upgrade_nixos deleted file mode 100755 index fd6cc62..0000000 --- a/upgrade_nixos +++ /dev/null @@ -1,11 +0,0 @@ -#!/usr/bin/env ./sshtool - -cmd nix-channel --add https://nixos.org/channels/nixos-21.11 nixos -cmd nix-channel --update -cmd nixos-rebuild boot - -if [ "$REBOOT_NODES" = "yes" ]; then - cmd reboot -else - message "Node will not reboot, use \"REBOOT_NODES=yes $CMDFILE\" to reboot nodes when they finish upgrading." -fi -- cgit v1.2.3