This repository has no description
2.6 kB
82 lines
1{ pkgs }:
2pkgs.writers.writeDashBin "l-gen-secrets" ''
3 set -efu
4 HOSTNAME=$1
5 TMPDIR=$(${pkgs.coreutils}/bin/mktemp -d)
6 if [ "''${DRYRUN-n}" = "n" ]; then
7 trap 'rm -rf $TMPDIR' EXIT
8 else
9 echo "$TMPDIR"
10 set -x
11 fi
12 mkdir -p $TMPDIR/out
13
14 PASSWORD=$(${pkgs.pwgen}/bin/pwgen 25 1)
15 HASHED_PASSWORD=$(echo $PASSWORD | ${pkgs.hashPassword}/bin/hashPassword -s) > /dev/null
16
17 # ssh
18 ${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f $TMPDIR/ssh.id_ed25519 -P "" -C "" >/dev/null
19 ${pkgs.coreutils}/bin/mv $TMPDIR/ssh.id_ed25519 $TMPDIR/out/
20
21 # tor
22 ${pkgs.coreutils}/bin/timeout 1 ${pkgs.tor}/bin/tor --HiddenServiceDir $TMPDIR/tor --HiddenServicePort 1 --SocksPort 0 >/dev/null || :
23 ${pkgs.coreutils}/bin/mv $TMPDIR/tor/hs_ed25519_secret_key $TMPDIR/out/ssh-tor.priv
24
25 # tinc
26 ${pkgs.coreutils}/bin/mkdir -p $TMPDIR/tinc
27 ${pkgs.tinc_pre}/bin/tinc --config $TMPDIR/tinc generate-keys 4096 </dev/null
28 ${pkgs.coreutils}/bin/mv $TMPDIR/tinc/ed25519_key.priv $TMPDIR/out/retiolum.ed25519_key.priv
29 ${pkgs.coreutils}/bin/mv $TMPDIR/tinc/rsa_key.priv $TMPDIR/out/retiolum.rsa_key.priv
30
31 # wireguard
32 ${pkgs.wireguard-tools}/bin/wg genkey > $TMPDIR/out/wiregrill.key
33 ${pkgs.coreutils}/bin/cat $TMPDIR/out/wiregrill.key | ${pkgs.wireguard-tools}/bin/wg pubkey > $TMPDIR/wiregrill.pub
34
35 # system passwords
36 cat <<EOF > $TMPDIR/out/hashedPasswords.nix
37 {
38 root = "$HASHED_PASSWORD";
39 mainUser = "$HASHED_PASSWORD";
40 }
41 EOF
42
43 set +f
44 if [ "''${DRYRUN-n}" = "n" ]; then
45 cd $TMPDIR/out
46 for x in *; do
47 ${pkgs.coreutils}/bin/cat $x | ${pkgs.pass}/bin/pass insert -m hosts/$HOSTNAME/$x > /dev/null
48 done
49 echo $PASSWORD | ${pkgs.pass}/bin/pass insert -m admin/$HOSTNAME/pass > /dev/null
50 ${pkgs.coreutils}/bin/cat $TMPDIR/tor/hostname | ${pkgs.pass}/bin/pass insert -m admin/$HOSTNAME/torname > /dev/null
51 fi
52 set -f
53
54 cat <<EOF
55 { r6, w6, ... }:
56 {
57 nets = {
58 retiolum = {
59 ip4.addr = "10.243.0.changeme";
60 ip6.addr = r6 "changeme";
61 aliases = [
62 "$HOSTNAME.r"
63 ];
64 tinc.pubkey = ${"''"}
65 $(cat $TMPDIR/tinc/rsa_key.pub | sed 's/^/ /')
66 ${"''"};
67 tinc.pubkey_ed25519 = "$(cat $TMPDIR/tinc/ed25519_key.pub | ${pkgs.gnused}/bin/sed 's/.* = //')";
68 };
69 wiregrill = {
70 ip6.addr = w6 "changeme";
71 aliases = [
72 "$HOSTNAME.w"
73 ];
74 wireguard.pubkey = ${"''"}
75 $(cat $TMPDIR/wiregrill.pub)
76 ${"''"};
77 };
78 };
79 ssh.pubkey = "$(cat $TMPDIR/ssh.id_ed25519.pub)";
80 }
81 EOF
82''