74 lines
1.8 KiB
Bash
Executable File
74 lines
1.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
# fail on errors
|
|
set -eo pipefail
|
|
|
|
die() {
|
|
echo >&2 "$@"
|
|
exit 1
|
|
}
|
|
|
|
# parse args
|
|
I_ARGS=()
|
|
while [[ $# -gt 0 ]]; do
|
|
case $1 in
|
|
-c|--nixos-config)
|
|
I_CONFIG="$2"
|
|
shift # past argument
|
|
shift # past value
|
|
;;
|
|
-k|--key-dir)
|
|
I_KEYDIR="$2"
|
|
shift # past argument
|
|
shift # past value
|
|
;;
|
|
*)
|
|
I_ARGS+=("$1") # save positional arg
|
|
shift # past argument
|
|
;;
|
|
esac
|
|
done
|
|
|
|
# check args
|
|
[ -z "$I_CONFIG" -o -z "$I_KEYDIR" -o ${#I_ARGS[@]} -eq 0 ] \
|
|
&& die "usage: $0 -c|--nixos-config <config> -k|--keydir <keydir> <nixos-anywhere args>"
|
|
[ ! -f "$I_KEYDIR/host.pub" ] && die "host pubkey missing!"
|
|
[ ! -f "$I_KEYDIR/host" ] && die "host privkey missing!"
|
|
[ ! -f "$I_KEYDIR/host_initrd.pub" ] && die "host pubkey (initrd) missing!"
|
|
[ ! -f "$I_KEYDIR/host_initrd" ] && die "host privkey (initrd) missing!"
|
|
[ ! -f "$I_KEYDIR/luks-pw" ] && die "luks pw missing!"
|
|
|
|
# temp work dir
|
|
temp=$(mktemp -d)
|
|
cleanup() {
|
|
rm -rf "$temp"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
# prepare host keys
|
|
echo "Preparing host keys.."
|
|
dir="$temp/persist/etc/ssh"
|
|
install -d -m755 "$dir"
|
|
cp "$I_KEYDIR/host" "$dir/ssh_host_ed25519_key"
|
|
cp "$I_KEYDIR/host.pub" "$dir/ssh_host_ed25519_key.pub"
|
|
chmod 600 "$dir/ssh_host_ed25519_key"
|
|
|
|
# prepare host keys (initrd)
|
|
echo "Preparing host keys.. (initrd)"
|
|
dir="$temp/persist/etc/secrets/initrd"
|
|
install -d -m755 "$dir"
|
|
cp "$I_KEYDIR/host" "$dir/ssh_host_ed25519_key"
|
|
cp "$I_KEYDIR/host.pub" "$dir/ssh_host_ed25519_key.pub"
|
|
chmod 600 "$dir/ssh_host_ed25519_key"
|
|
|
|
# nixos-anywhere
|
|
echo "Starting install.."
|
|
nixos-anywhere \
|
|
--disk-encryption-keys "/tmp/luks-pw" "$I_KEYDIR/luks-pw" \
|
|
--extra-files "$temp" \
|
|
--flake .#$I_CONFIG \
|
|
"${I_ARGS[@]}"
|
|
|
|
echo -e "Finished install.\n" \
|
|
"Make sure to delete the SSH host keys from here if you are done with them."
|