SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-01-21 12:51:34 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

install-anywhere: Work in completely temporary directory

Browse source
This commit is contained in:
SebastianStork 2025-12-25 21:43:20 +01:00
parent 2182e06bb6
commit e3479f2070
Signed by: SebastianStork
SSH key fingerprint: SHA256:iEM011ogNMG1q8+U500adGu/9rpPuZ2KnFtbdLeqTiI
1 changed files with 17 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

35
flake-parts/install-anywhere.nix
View file

@ -19,7 +19,7 @@ _: {
host="$1"
destination="$2"
root="/tmp/anywhere/$host"
root="$(mktemp --directory)"
impermanence="$(nix eval ".#nixosConfigurations.$host.config.custom.persistence.enable")"
if [ "$impermanence" = true ]; then
@ -28,31 +28,30 @@ _: {
ssh_dir="$root/etc/ssh"
fi
if [ ! -f "$ssh_dir/ssh_host_ed25519_key" ]; then
echo "==> Generating new SSH host keys..."
mkdir --parents "$ssh_dir"
ssh-keygen -C "root@$host" -f "$ssh_dir/ssh_host_ed25519_key" -N "" -q
echo "==> Generating new SSH host keys..."
mkdir --parents "$ssh_dir"
ssh-keygen -C "root@$host" -f "$ssh_dir/ssh_host_ed25519_key" -N "" -q
echo "==> Replacing old age key with new age key..."
new_age_key="$(ssh-to-age -i "$ssh_dir/ssh_host_ed25519_key.pub")"
echo "$new_age_key" > "hosts/$host/keys/age.pub"
echo "==> Replacing old age key with new age key..."
new_age_key="$(ssh-to-age -i "$ssh_dir/ssh_host_ed25519_key.pub")"
echo "$new_age_key" > "hosts/$host/keys/age.pub"
echo "==> Updating SOPS secrets..."
if BW_SESSION="$(bw unlock --raw || bw login --raw)"; then
export BW_SESSION
fi
SOPS_AGE_KEY="$(bw get notes 'admin age-key')"
export SOPS_AGE_KEY
SOPS_CONFIG="$(nix build .#sops-config --print-out-paths)"
export SOPS_CONFIG
sops updatekeys --yes "hosts/$host/secrets.json"
fi
echo "==> Updating SOPS secrets..."
BW_SESSION="$(bw unlock --raw || bw login --raw)"
export BW_SESSION
SOPS_AGE_KEY="$(bw get notes 'admin age-key')"
export SOPS_AGE_KEY
SOPS_CONFIG="$(nix build .#sops-config --print-out-paths)"
export SOPS_CONFIG
sops updatekeys --yes "hosts/$host/secrets.json"
echo "==> Installing system..."
nix run github:nix-community/nixos-anywhere -- \
--extra-files "$root" \
--flake ".#$host" \
--target-host "$destination"
rm -rf "$root"
'';
};
};