| 1 | #!/usr/bin/env bash |
| 2 | |
| 3 | # Bootstrap staging-hydra on nixos.lysator.liu.se (130.236.254.207). |
| 4 | # |
| 5 | # WARNING: nixos-anywhere will WIPE all disks. Only use this for a fresh |
| 6 | # install. For regular deployments use colmena: |
| 7 | # colmena apply --on staging-hydra |
| 8 | |
| 9 | set -euo pipefail |
| 10 | tmpDir=$(mktemp -d) |
| 11 | sshDir="$tmpDir/etc/ssh" |
| 12 | mkdir -p "$sshDir" |
| 13 | trap 'rm -rf "$tmpDir"' EXIT |
| 14 | |
| 15 | SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)" |
| 16 | |
| 17 | keys=( |
| 18 | ssh_host_ed25519_key |
| 19 | ssh_host_ed25519_key_pub |
| 20 | ssh_host_rsa_key |
| 21 | ssh_host_rsa_key_pub |
| 22 | ) |
| 23 | for keyname in "${keys[@]}"; do |
| 24 | if [[ $keyname == *.pub ]]; then |
| 25 | umask 0133 |
| 26 | else |
| 27 | umask 0177 |
| 28 | fi |
| 29 | sops --extract '["'"$keyname"'"]' --decrypt "$SCRIPT_DIR/../../secrets/staging-hydra-hostkeys.yaml" >"$sshDir/$keyname" |
| 30 | done |
| 31 | nix run nixpkgs#nixos-anywhere -- --extra-files "$tmpDir" -f .#staging-hydra nixos@nixos.lysator.liu.se |