94 lines
2.4 KiB
Python
94 lines
2.4 KiB
Python
import argparse
|
|
import json
|
|
import subprocess
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
from ..dirs import get_clan_flake_toplevel
|
|
from ..errors import ClanError
|
|
from ..nix import nix_build, nix_config, nix_eval
|
|
from ..ssh import parse_deployment_address
|
|
from .secrets import decrypt_secret, has_secret
|
|
|
|
|
|
def upload_secrets(machine: str) -> None:
|
|
clan_dir = get_clan_flake_toplevel().as_posix()
|
|
config = nix_config()
|
|
system = config["system"]
|
|
|
|
proc = subprocess.run(
|
|
nix_build(
|
|
[
|
|
f'{clan_dir}#nixosConfigurations."{machine}".config.system.clan.{system}.uploadSecrets'
|
|
]
|
|
),
|
|
stdout=subprocess.PIPE,
|
|
text=True,
|
|
check=True,
|
|
)
|
|
host = json.loads(
|
|
subprocess.run(
|
|
nix_eval(
|
|
[
|
|
f'{clan_dir}#nixosConfigurations."{machine}".config.clan.networking.deploymentAddress'
|
|
]
|
|
),
|
|
stdout=subprocess.PIPE,
|
|
text=True,
|
|
check=True,
|
|
).stdout
|
|
)
|
|
|
|
secret_upload_script = proc.stdout.strip()
|
|
secret_upload = subprocess.run(
|
|
[
|
|
secret_upload_script,
|
|
host,
|
|
],
|
|
)
|
|
|
|
if secret_upload.returncode != 0:
|
|
raise ClanError("failed to upload secrets")
|
|
else:
|
|
print("successfully uploaded secrets")
|
|
|
|
|
|
# this is called by the sops.nix clan core module
|
|
def upload_age_key_from_nix(
|
|
machine_name: str, deployment_address: str, age_key_file: str
|
|
) -> None:
|
|
secret_name = f"{machine_name}-age.key"
|
|
if not has_secret(secret_name): # skip uploading the secret, not managed by us
|
|
return
|
|
secret = decrypt_secret(secret_name)
|
|
|
|
h = parse_deployment_address(machine_name, deployment_address)
|
|
path = Path(age_key_file)
|
|
|
|
proc = h.run(
|
|
[
|
|
"bash",
|
|
"-c",
|
|
'mkdir -p "$0" && echo -n "$1" > "$2"',
|
|
str(path.parent),
|
|
secret,
|
|
age_key_file,
|
|
],
|
|
check=False,
|
|
)
|
|
if proc.returncode != 0:
|
|
print(f"failed to upload age key to {deployment_address}")
|
|
sys.exit(1)
|
|
|
|
|
|
def upload_command(args: argparse.Namespace) -> None:
|
|
upload_secrets(args.machine)
|
|
|
|
|
|
def register_upload_parser(parser: argparse.ArgumentParser) -> None:
|
|
parser.add_argument(
|
|
"machine",
|
|
help="The machine to upload secrets to",
|
|
)
|
|
parser.set_defaults(func=upload_command)
|