blob: fb9a6033bbdb22bfd417fb2e41ae1056b048b79e (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
|
#!/usr/bin/env bash
set -euo pipefail
# --- Defaults ---
HOSTNAME=$(hostname)
USB_DEVICE=""
REPO_URL="git@codeberg.org:adikro/nixos-config.git"
KEY_LOCATION=""
USE_FACTER=true
# --- Parse Arguments ---
PARSED_ARGS=$(getopt -o u:h:r:k:g --long usb:,hostname:,repo:,key:,generate-config -- "$@")
eval set -- "$PARSED_ARGS"
while true; do
case "$1" in
-u|--usb) USB_DEVICE="$2"; shift 2 ;;
-h|--hostname) HOSTNAME="$2"; shift 2 ;;
-r|--repo) REPO_URL="$2"; shift 2 ;;
-k|--key) KEY_LOCATION="$2"; shift 2 ;;
-g|--generate-config) USE_FACTER=false; shift ;;
--) shift; break ;;
*) echo "Internal error!"; exit 1 ;;
esac
done
echo "### 1. GPG Key Preparation ###"
export GPG_TTY=$(tty)
if [[ -n "$KEY_LOCATION" ]]; then
gpg --import "$KEY_LOCATION"
elif [[ -n "$USB_DEVICE" ]]; then
echo "Mounting $USB_DEVICE..."
sudo mkdir -p /mnt/usb
findmnt -rno SOURCE "$USB_DEVICE" >/dev/null || sudo mount "$USB_DEVICE" /mnt/usb
echo "Searching USB for private.asc..."
KEY_FILE=$(sudo fd -H -t f "private.asc" /mnt/usb --max-results 1)
if [[ -n "$KEY_FILE" ]]; then
KEY_DIR=$(dirname "$KEY_FILE")
echo "Found keys in $KEY_DIR. Importing..."
(
cd "$KEY_DIR"
gpg --import private.asc
[[ -f "public.asc" ]] && gpg --import public.asc
[[ -f "trust.txt" ]] && gpg --import-ownertrust trust.txt
)
else
echo "Error: private.asc not found on $USB_DEVICE"
sudo umount /mnt/usb; exit 1
fi
sudo umount /mnt/usb
else
gpg -K | grep -q "sec" || { echo "No keys found. Use --usb or --key."; exit 1; }
fi
echo "### 2. Repo Setup ###"
sudo mkdir -p /etc/nixos
sudo chown -R "$USER":users /etc/nixos
[[ ! -d "/etc/nixos/.git" ]] && git clone "$REPO_URL" /etc/nixos
cd /etc/nixos
echo "### 3. Hardware Refresh ###"
HOST_DIR="./hosts/$HOSTNAME"
mkdir -p "$HOST_DIR"
if [ "$USE_FACTER" = true ]; then
nixos-facter -o "$HOST_DIR/facter.json"
else
sudo nixos-generate-config --no-filesystems --root /
mv /etc/nixos/hardware-configuration.nix "$HOST_DIR/hardware-configuration.nix"
fi
echo "### 4. SOPS Rotation ###"
NEW_AGE=$(ssh-to-age < /etc/ssh/ssh_host_ed25519_key.pub)
if grep -q "&host_$HOSTNAME" .sops.yaml; then
sd "(&host_$HOSTNAME\s+-) age1.*" "\$1 $NEW_AGE" .sops.yaml
else
sd "(keys:\n)" "\$1 - &host_$HOSTNAME $NEW_AGE\n" .sops.yaml
sd "(age:\n(.*\n)*?\s+age:\n)" "\$1 - *host_$HOSTNAME\n" .sops.yaml
fi
sops updatekeys secrets/secrets.yaml -y
echo "### 5. System Rebuild ###"
git add .
nh os switch . -u -H "$HOSTNAME"
echo "### 6. Git Finalization ###"
[[ $(git remote) =~ "origin" ]] && git remote rename origin codeberg
git remote set-url codeberg "$REPO_URL"
git add .
git commit -m "chore($HOSTNAME): hardware refresh and sops rotation" || echo "No changes."
read -p "Push to Codeberg? (y/N): " push_confirm
[[ "$push_confirm" == [yY] ]] && git push -u codeberg main
echo "SETUP COMPLETE. Rebooting is recommended."
|
