aboutsummaryrefslogtreecommitdiff
path: root/deploy.sh
blob: 8dcf3a8ef04729da959fee6c2e4d1a6a807b65cc (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
#!/usr/bin/env bash

# Get cluster subdirectory name

cd $(dirname $0)

CLUSTER="$1"
if [ -z "$CLUSTER" ] || [ ! -d "cluster/$CLUSTER" ]; then
	echo "Usage: $0 <cluster name>"
	echo "The cluster name must be the name of a subdirectory of cluster/"
	exit 1
fi
shift 1

# Do actual stuff

if [ -z "$1" ]; then
	NIXHOSTLIST=$(ls cluster/$CLUSTER/node | grep -v '\.site\.')
else
	NIXHOSTLIST="$@"
fi

TMP_PATH=/tmp/tmp-deploy-$(date +%s)
SSH_CONFIG=cluster/$CLUSTER/ssh_config
YEAR=$(date +%Y)

for NIXHOST in $NIXHOSTLIST; do
	NIXHOST=${NIXHOST%.*}

	if [ -z "$SSH_USER" ]; then
		SSH_DEST=$NIXHOST
	else
		SSH_DEST=$SSH_USER@$NIXHOST
	fi

	echo "==== DOING $NIXHOST ===="

	echo "Sending NixOS config files"

	ssh -F $SSH_CONFIG $SSH_DEST mkdir -p $TMP_PATH $TMP_PATH/pki
	cat nix/configuration.nix | ssh -F $SSH_CONFIG $SSH_DEST tee $TMP_PATH/configuration.nix > /dev/null
	cat nix/deuxfleurs.nix | ssh -F $SSH_CONFIG $SSH_DEST tee $TMP_PATH/deuxfleurs.nix > /dev/null
	cat nix/remote-unlock.nix | ssh -F $SSH_CONFIG $SSH_DEST tee $TMP_PATH/remote-unlock.nix > /dev/null
	cat nix/wesher.nix | ssh -F $SSH_CONFIG $SSH_DEST tee $TMP_PATH/wesher.nix > /dev/null
	cat nix/wesher_service.nix | ssh -F $SSH_CONFIG $SSH_DEST tee $TMP_PATH/wesher_service.nix > /dev/null
	cat cluster/$CLUSTER/cluster.nix | ssh -F $SSH_CONFIG $SSH_DEST tee $TMP_PATH/cluster.nix > /dev/null
	cat cluster/$CLUSTER/node/$NIXHOST.nix | ssh -F $SSH_CONFIG $SSH_DEST tee $TMP_PATH/node.nix > /dev/null
	cat cluster/$CLUSTER/node/$NIXHOST.site.nix | ssh -F $SSH_CONFIG $SSH_DEST tee $TMP_PATH/site.nix > /dev/null

	echo "Sending secret files"
	for SECRET in pki/consul-ca.crt pki/consul$YEAR.crt pki/consul$YEAR.key \
		pki/consul$YEAR-client.crt pki/consul$YEAR-client.key \
		pki/nomad-ca.crt pki/nomad$YEAR.crt pki/nomad$YEAR.key; do
		test -f cluster/$CLUSTER/secrets/$SECRET && (cat cluster/$CLUSTER/secrets/$SECRET | ssh -F $SSH_CONFIG $SSH_DEST tee $TMP_PATH/$SECRET > /dev/null)
	done

	echo "Rebuilding NixOS"

	ssh -F $SSH_CONFIG $SSH_DEST tee $TMP_PATH/deploy.sh > /dev/null <<EOF
set -ex

cd $TMP_PATH
mv deuxfleurs.nix remote-unlock.nix wesher.nix wesher_service.nix configuration.nix cluster.nix node.nix site.nix /etc/nixos

nixos-rebuild switch

mkdir -p /var/lib/nomad/pki /var/lib/consul/pki

if [ -f pki/consul-ca.crt ]; then
	cp pki/consul* /var/lib/nomad/pki
	mv pki/consul* /var/lib/consul/pki
	chown -R consul:root /var/lib/consul/pki
fi

if [ -f pki/nomad-ca.crt ]; then
	mv pki/nomad* /var/lib/nomad/pki
fi

# Save up-to-date Consul client certificates in Consul itself
export CONSUL_HTTP_ADDR=https://localhost:8501
export CONSUL_CACERT=/var/lib/consul/pki/consul-ca.crt
export CONSUL_CLIENT_CERT=/var/lib/consul/pki/consul$YEAR-client.crt
export CONSUL_CLIENT_KEY=/var/lib/consul/pki/consul$YEAR-client.key
consul kv put secrets/consul/consul-ca.crt - < /var/lib/consul/pki/consul-ca.crt
consul kv put secrets/consul/consul-client.crt - < /var/lib/consul/pki/consul$YEAR-client.crt
consul kv put secrets/consul/consul-client.key - < /var/lib/consul/pki/consul$YEAR-client.key
EOF

	ssh -t -F $SSH_CONFIG $SSH_DEST sudo sh $TMP_PATH/deploy.sh
	ssh -F $SSH_CONFIG $SSH_DEST rm -rv '/tmp/tmp-deploy-*'
done