From c430d8eaf1d091ad27e842c0000b77d87d791da6 Mon Sep 17 00:00:00 2001
From: Quentin Dufour <quentin@deuxfleurs.fr>
Date: Thu, 21 Apr 2022 22:57:55 +0200
Subject: Start refactor

---
 os/overlays/wesher.nix            |  25 ++++++++
 os/runners/bash/deploy_nixos      |  12 ++++
 os/runners/bash/deploy_passwords  |   5 ++
 os/runners/bash/deploy_pki        |  38 ++++++++++++
 os/runners/bash/deploy_wesher_key |   4 ++
 os/runners/bash/gen_wesher_key    |  17 ++++++
 os/runners/bash/sshtool           | 109 +++++++++++++++++++++++++++++++++++
 os/runners/bash/tlsproxy          |  47 +++++++++++++++
 os/runners/bash/upgrade_nixos     |  11 ++++
 os/secretgen/gen_pki              | 118 ++++++++++++++++++++++++++++++++++++++
 os/secretgen/passwd               |  30 ++++++++++
 11 files changed, 416 insertions(+)
 create mode 100644 os/overlays/wesher.nix
 create mode 100755 os/runners/bash/deploy_nixos
 create mode 100755 os/runners/bash/deploy_passwords
 create mode 100755 os/runners/bash/deploy_pki
 create mode 100755 os/runners/bash/deploy_wesher_key
 create mode 100755 os/runners/bash/gen_wesher_key
 create mode 100755 os/runners/bash/sshtool
 create mode 100755 os/runners/bash/tlsproxy
 create mode 100755 os/runners/bash/upgrade_nixos
 create mode 100755 os/secretgen/gen_pki
 create mode 100755 os/secretgen/passwd

(limited to 'os')

diff --git a/os/overlays/wesher.nix b/os/overlays/wesher.nix
new file mode 100644
index 0000000..c39a3e6
--- /dev/null
+++ b/os/overlays/wesher.nix
@@ -0,0 +1,25 @@
+self: super:
+{
+  wesher = super.buildGoModule rec {
+    pname = "wesher";
+    version = "0.2.6";
+
+    src = super.fetchFromGitHub {
+      owner = "costela";
+      repo = "wesher";
+      rev = "v${version}";
+      sha256 = "1iagmnw2yf15r0fpikk610w0lm0gcxw83lcwfjyr2jv1q2ys71hh";
+    };
+
+    vendorSha256 = "0nyg0wzn8d4rzjs8yrxxj3gha94043ll80s1ql0fml025q2f3705";
+
+    checkPhase = "true";
+
+    meta = with super.lib; {
+      description = "wireguard overlay mesh network manager";
+      homepage = "https://github.com/costela/wesher";
+      license = licenses.gpl3Plus;
+      platforms = platforms.linux;
+    };
+  };
+}
diff --git a/os/runners/bash/deploy_nixos b/os/runners/bash/deploy_nixos
new file mode 100755
index 0000000..484bead
--- /dev/null
+++ b/os/runners/bash/deploy_nixos
@@ -0,0 +1,12 @@
+#!/usr/bin/env ./sshtool
+
+copy nix/configuration.nix /etc/nixos/configuration.nix
+copy nix/deuxfleurs.nix /etc/nixos/deuxfleurs.nix
+copy nix/remote-unlock.nix /etc/nixos/remote-unlock.nix
+copy nix/wesher.nix /etc/nixos/wesher.nix
+copy nix/wesher_service.nix /etc/nixos/wesher_service.nix
+copy cluster/$CLUSTER/cluster.nix /etc/nixos/cluster.nix
+copy cluster/$CLUSTER/node/$NIXHOST.nix /etc/nixos/node.nix
+copy cluster/$CLUSTER/node/$NIXHOST.site.nix /etc/nixos/site.nix
+
+cmd nixos-rebuild switch
diff --git a/os/runners/bash/deploy_passwords b/os/runners/bash/deploy_passwords
new file mode 100755
index 0000000..37c2143
--- /dev/null
+++ b/os/runners/bash/deploy_passwords
@@ -0,0 +1,5 @@
+#!/usr/bin/env ./sshtool
+
+write_pass deuxfleurs/cluster/$CLUSTER/passwords /root/deploy_tmp_passwords
+cmd 'chpasswd -e < /root/deploy_tmp_passwords'
+cmd rm /root/deploy_tmp_passwords
diff --git a/os/runners/bash/deploy_pki b/os/runners/bash/deploy_pki
new file mode 100755
index 0000000..167ac50
--- /dev/null
+++ b/os/runners/bash/deploy_pki
@@ -0,0 +1,38 @@
+#!/usr/bin/env ./sshtool
+
+PKI=deuxfleurs/cluster/$CLUSTER
+YEAR=$(date +%Y)
+
+cmd mkdir -p /var/lib/nomad/pki /var/lib/consul/pki
+
+for file in consul-ca.crt consul$YEAR.crt consul$YEAR.key \
+	consul$YEAR-client.crt consul$YEAR-client.key
+do
+	if pass $PKI/$file >/dev/null; then
+		write_pass $PKI/$file /var/lib/consul/pki/$file
+		cmd chown consul:root /var/lib/consul/pki/$file
+	fi
+done
+
+cmd systemctl restart consul
+cmd sleep 10
+
+for file in nomad-ca.crt nomad$YEAR.crt nomad$YEAR.key \
+	consul$YEAR.crt consul$YEAR-client.crt consul$YEAR-client.key
+do
+	if pass $PKI/$file >/dev/null; then
+		write_pass $PKI/$file /var/lib/nomad/pki/$file
+		cmd "chown \$(stat -c %u /var/lib/private/nomad) /var/lib/nomad/pki/$file"
+	fi
+done
+
+cmd systemctl restart nomad
+
+set_env CONSUL_HTTP_ADDR=https://localhost:8501
+set_env CONSUL_CACERT=/var/lib/consul/pki/consul-ca.crt
+set_env CONSUL_CLIENT_CERT=/var/lib/consul/pki/consul$YEAR-client.crt
+set_env CONSUL_CLIENT_KEY=/var/lib/consul/pki/consul$YEAR-client.key
+
+cmd "consul kv put secrets/consul/consul-ca.crt - < /var/lib/consul/pki/consul-ca.crt"
+cmd "consul kv put secrets/consul/consul-client.crt - < /var/lib/consul/pki/consul$YEAR-client.crt"
+cmd "consul kv put secrets/consul/consul-client.key - < /var/lib/consul/pki/consul$YEAR-client.key"
diff --git a/os/runners/bash/deploy_wesher_key b/os/runners/bash/deploy_wesher_key
new file mode 100755
index 0000000..8f7ed77
--- /dev/null
+++ b/os/runners/bash/deploy_wesher_key
@@ -0,0 +1,4 @@
+#!/usr/bin/env ./sshtool
+
+write_pass deuxfleurs/cluster/$CLUSTER/wesher_key /var/lib/wesher/secrets
+cmd systemctl restart wesher
diff --git a/os/runners/bash/gen_wesher_key b/os/runners/bash/gen_wesher_key
new file mode 100755
index 0000000..c66fade
--- /dev/null
+++ b/os/runners/bash/gen_wesher_key
@@ -0,0 +1,17 @@
+#!/usr/bin/env sh
+
+cd $(dirname $0)
+
+CLUSTER="$1"
+if [ -z "$CLUSTER" ] || [ ! -d "cluster/$CLUSTER" ]; then
+	echo "Usage: $0 <cluster name>"
+	echo "The cluster name must be the name of a subdirectory of cluster/"
+	exit 1
+fi
+
+K=deuxfleurs/cluster/$CLUSTER/wesher_key
+if ! pass $K >/dev/null; then
+	pass insert -m $K <<EOF
+WESHER_CLUSTER_KEY=$(head -c 32 /dev/urandom | base64)
+EOF
+fi
diff --git a/os/runners/bash/sshtool b/os/runners/bash/sshtool
new file mode 100755
index 0000000..58b00ef
--- /dev/null
+++ b/os/runners/bash/sshtool
@@ -0,0 +1,109 @@
+#!/usr/bin/env bash
+
+cd $(dirname $0)
+
+CMDFILE="$1"
+shift 1
+
+CLUSTER="$1"
+if [ -z "$CLUSTER" ] || [ ! -d "cluster/$CLUSTER" ]; then
+	echo "Usage: $CMDFILE <cluster name>"
+	echo "The cluster name must be the name of a subdirectory of cluster/"
+	exit 1
+fi
+shift 1
+
+if [ -z "$1" ]; then
+	NIXHOSTLIST=$(ls cluster/$CLUSTER/node | grep -v '\.site\.')
+else
+	NIXHOSTLIST="$@"
+fi
+
+if [ -z "$ROOT_PASS" ]; then
+	read -s -p "Enter remote sudo password: " ROOT_PASS
+	echo
+fi
+
+SSH_CONFIG=cluster/$CLUSTER/ssh_config
+
+function header {
+	cat <<EOF
+export DEPLOYTOOL_ROOT_PASSWORD=$ROOT_PASS
+cat > /tmp/deploytool_askpass <<EOG
+#!/usr/bin/env sh
+echo \$DEPLOYTOOL_ROOT_PASSWORD
+EOG
+chmod +x /tmp/deploytool_askpass
+export SUDO_ASKPASS=/tmp/deploytool_askpass
+sudo -A sh - <<'EOEVERYTHING'
+EOF
+}
+
+function footer {
+	echo EOEVERYTHING
+}
+
+function message {
+	echo "echo '$@'"
+}
+
+function cmd {
+	echo "echo '- run $@'"
+	echo "$@"
+}
+
+function set_env {
+	echo "echo '- set $@'"
+	echo "export $@"
+}
+
+function copy {
+	local FROM=$1
+	local TO=$2
+	cat <<EOF
+echo '- write $TO from $FROM'
+base64 -d <<EOG | tee $TO > /dev/null
+$(base64 <$FROM)
+EOG
+EOF
+}
+
+function copy_secret {
+	local FROM=$1
+	local TO=$2
+	cat <<EOF
+echo '- write secret $TO from $FROM'
+base64 -d <<EOG | tee $TO > /dev/null
+$(base64 <$FROM)
+EOG
+chown root:root $TO
+chmod 0600 $TO
+EOF
+}
+
+function write_pass {
+	local PASSKEY=$1
+	local TO=$2
+	cat <<EOF
+echo '- write secret $TO from pass $PASSKEY'
+base64 -d <<EOG | tee $TO > /dev/null
+$(pass $PASSKEY | base64)
+EOG
+chown root:root $TO
+chmod 0600 $TO
+EOF
+}
+
+for NIXHOST in $NIXHOSTLIST; do
+	NIXHOST=${NIXHOST%.*}
+
+	if [ -z "$SSH_USER" ]; then
+		SSH_DEST=$NIXHOST
+	else
+		SSH_DEST=$SSH_USER@$NIXHOST
+	fi
+
+	echo "==== DOING $NIXHOST ===="
+
+	(header; . $CMDFILE; footer) | ssh -F $SSH_CONFIG $SSH_DEST sh -
+done
diff --git a/os/runners/bash/tlsproxy b/os/runners/bash/tlsproxy
new file mode 100755
index 0000000..7546b81
--- /dev/null
+++ b/os/runners/bash/tlsproxy
@@ -0,0 +1,47 @@
+#!/bin/sh
+
+set -xe
+
+# Enter proper cluster subdirectory
+
+cd $(dirname $0)
+
+CLUSTER="$1"
+if [ ! -d "cluster/$CLUSTER" ]; then
+	echo "Usage: $0 <cluster name>"
+	echo "The cluster name must be the name of a subdirectory of cluster/"
+	exit 1
+fi
+
+PREFIX="deuxfleurs/cluster/$CLUSTER"
+
+# Do actual stuff
+
+YEAR=$(date +%Y)
+
+CERTDIR=$(mktemp -d)
+
+_int() {
+  echo "Caught SIGINT signal!"
+  rm -rv $CERTDIR
+  kill -INT "$child1" 2>/dev/null
+  kill -INT "$child2" 2>/dev/null
+}
+
+trap _int SIGINT
+
+pass $PREFIX/nomad$YEAR.crt > $CERTDIR/nomad.crt
+pass $PREFIX/nomad$YEAR-client.crt > $CERTDIR/nomad-client.crt
+pass $PREFIX/nomad$YEAR-client.key > $CERTDIR/nomad-client.key
+pass $PREFIX/consul$YEAR.crt > $CERTDIR/consul.crt
+pass $PREFIX/consul$YEAR-client.crt > $CERTDIR/consul-client.crt
+pass $PREFIX/consul$YEAR-client.key > $CERTDIR/consul-client.key
+
+socat -dd tcp4-listen:4646,reuseaddr,fork openssl:localhost:14646,cert=$CERTDIR/nomad-client.crt,key=$CERTDIR/nomad-client.key,cafile=$CERTDIR/nomad.crt &
+child1=$!
+
+socat -dd tcp4-listen:8500,reuseaddr,fork openssl:localhost:8501,cert=$CERTDIR/consul-client.crt,key=$CERTDIR/consul-client.key,cafile=$CERTDIR/consul.crt &
+child2=$!
+
+wait "$child1"
+wait "$child2"
diff --git a/os/runners/bash/upgrade_nixos b/os/runners/bash/upgrade_nixos
new file mode 100755
index 0000000..fd6cc62
--- /dev/null
+++ b/os/runners/bash/upgrade_nixos
@@ -0,0 +1,11 @@
+#!/usr/bin/env ./sshtool
+
+cmd nix-channel --add https://nixos.org/channels/nixos-21.11 nixos
+cmd nix-channel --update
+cmd nixos-rebuild boot
+
+if [ "$REBOOT_NODES" = "yes" ]; then
+	cmd reboot
+else
+	message "Node will not reboot, use \"REBOOT_NODES=yes $CMDFILE\" to reboot nodes when they finish upgrading."
+fi
diff --git a/os/secretgen/gen_pki b/os/secretgen/gen_pki
new file mode 100755
index 0000000..57da699
--- /dev/null
+++ b/os/secretgen/gen_pki
@@ -0,0 +1,118 @@
+#!/usr/bin/env sh
+
+set -ex
+
+cd $(dirname $0)
+
+CLUSTER="$1"
+if [ -z "$CLUSTER" ] || [ ! -d "cluster/$CLUSTER" ]; then
+	echo "Usage: $0 <cluster name>"
+	echo "The cluster name must be the name of a subdirectory of cluster/"
+	exit 1
+fi
+
+PREFIX="deuxfleurs/cluster/$CLUSTER"
+
+YEAR=$(date +%Y)
+for APP in consul nomad; do
+	# 1. Create certificate authority
+	if ! pass $PREFIX/$APP-ca.key >/dev/null; then
+		echo "Generating $APP CA keys..."
+		openssl genrsa 4096 | pass insert -m $PREFIX/$APP-ca.key
+
+		openssl req -x509 -new -nodes \
+			-key <(pass $PREFIX/$APP-ca.key) -sha256 \
+			-days 3650 -subj "/C=FR/O=Deuxfleurs/CN=$APP" \
+			| pass insert -m -f $PREFIX/$APP-ca.crt
+	fi
+
+	CERT="${APP}${YEAR}"
+
+	# 2. Create and sign certificates for inter-node communication
+	if ! pass $PREFIX/$CERT.crt >/dev/null; then
+		echo "Generating $CERT agent keys..."
+		if ! pass $PREFIX/$CERT.key >/dev/null; then
+			openssl genrsa 4096 | pass insert -m $PREFIX/$CERT.key
+		fi
+		openssl req -new -sha256 -key <(pass $PREFIX/$CERT.key) \
+			-subj "/C=FR/O=Deuxfleurs/CN=$APP" \
+			-out /tmp/tmp-$CLUSTER-$CERT.csr
+		openssl req -in /tmp/tmp-$CLUSTER-$CERT.csr  -noout -text
+		openssl x509 -req -in /tmp/tmp-$CLUSTER-$CERT.csr \
+			-extensions v3_req \
+			-extfile <(cat <<EOF
+[req]
+distinguished_name = req_distinguished_name
+req_extensions = v3_req
+prompt = no
+
+[req_distinguished_name]
+C = FR
+O = Deuxfleurs
+CN = $APP
+
+[v3_req]
+keyUsage = keyEncipherment, keyCertSign, dataEncipherment
+extendedKeyUsage = serverAuth, clientAuth
+subjectAltName = @alt_names
+
+[alt_names]
+DNS.1 = server.$CLUSTER.$APP
+DNS.2 = client.$CLUSTER.$APP
+DNS.3 = localhost
+DNS.4 = 127.0.0.1
+EOF
+	) \
+			-CA <(pass $PREFIX/$APP-ca.crt) \
+			-CAkey <(pass $PREFIX/$APP-ca.key) -CAcreateserial \
+			-CAserial /tmp/tmp-$CLUSTER-$CERT.srl \
+			-days 700 \
+			| pass insert -m $PREFIX/$CERT.crt
+		rm /tmp/tmp-$CLUSTER-$CERT.{csr,srl}
+	fi
+
+	# 3. Create client-only certificate used for the CLI
+	if ! pass $PREFIX/$CERT-client.crt >/dev/null; then
+		echo "Generating $CERT client keys..."
+		if ! pass $PREFIX/$CERT-client.key >/dev/null; then
+			openssl genrsa 4096 | pass insert -m $PREFIX/$CERT-client.key
+		fi
+		openssl req -new -sha256 -key <(pass $PREFIX/$CERT-client.key) \
+			-subj "/C=FR/O=Deuxfleurs/CN=$APP-client" \
+			-out /tmp/tmp-$CLUSTER-$CERT-client.csr
+		openssl req -in /tmp/tmp-$CLUSTER-$CERT-client.csr -noout -text
+		openssl x509 -req -in /tmp/tmp-$CLUSTER-$CERT-client.csr \
+			-extensions v3_req \
+			-extfile <(cat <<EOF
+[req]
+distinguished_name = req_distinguished_name
+req_extensions = v3_req
+prompt = no
+
+[req_distinguished_name]
+C = FR
+O = Deuxfleurs
+CN = $APP-client
+
+[v3_req]
+keyUsage = keyEncipherment, keyCertSign, dataEncipherment
+extendedKeyUsage = clientAuth
+subjectAltName = @alt_names
+
+[alt_names]
+DNS.1 = client.$CLUSTER.$APP
+EOF
+	) \
+			-CA <(pass $PREFIX/$APP-ca.crt) \
+			-CAkey <(pass $PREFIX/$APP-ca.key) \
+			-CAcreateserial -days 700 \
+			-CAserial /tmp/tmp-$CLUSTER-$CERT-client.srl \
+			| pass insert -m $PREFIX/$CERT-client.crt
+		rm /tmp/tmp-$CLUSTER-$CERT-client.{csr,srl}
+	fi
+
+	#if [ ! -f $CERT-client.p12 ]; then
+	#	openssl pkcs12 -export -out $CERT-client.p12 \
+	#		-in $APP-ca.pem -in $CERT-client.crt -inkey $CERT-client.key
+	#fi
+done
diff --git a/os/secretgen/passwd b/os/secretgen/passwd
new file mode 100755
index 0000000..7cc80b6
--- /dev/null
+++ b/os/secretgen/passwd
@@ -0,0 +1,30 @@
+#!/usr/bin/env sh
+
+cd $(dirname $0)
+
+function usage {
+	echo "Usage: $0 <cluster name> <username>"
+	echo "The cluster name must be the name of a subdirectory of cluster/"
+	exit 1
+}
+
+CLUSTER="$1"
+if [ -z "$CLUSTER" ] || [ ! -d "cluster/$CLUSTER" ]; then
+	usage
+fi
+
+USERNAME="$2"
+if [ -z "$USERNAME" ]; then
+	usage
+fi
+
+PREFIX="deuxfleurs/cluster/$CLUSTER"
+
+if ! EXISTING_PASSWORDS=$(pass $PREFIX/passwords | egrep -v "^$USERNAME:"); then
+	EXISTING_PASSWORDS=""
+fi
+
+echo "Enter new password for user $USERNAME:"
+NEW_PASSWD=$(openssl passwd -6)
+
+(echo $EXISTING_PASSWORDS; echo $USERNAME:$NEW_PASSWD) | pass insert -m $PREFIX/passwords
-- 
cgit v1.2.3