summaryrefslogtreecommitdiffstats
path: root/krebs
diff options
context:
space:
mode:
Diffstat (limited to 'krebs')
-rw-r--r--krebs/3modules/build/default.nix40
1 files changed, 40 insertions, 0 deletions
diff --git a/krebs/3modules/build/default.nix b/krebs/3modules/build/default.nix
index 19f14b486..993ccb702 100644
--- a/krebs/3modules/build/default.nix
+++ b/krebs/3modules/build/default.nix
@@ -28,6 +28,46 @@ let
type = types.user;
};
+ options.krebs.build.scripts.init = lib.mkOption {
+ type = lib.types.str;
+ default =
+ let
+ inherit (config.krebs.build) host;
+ inherit (host.ssh) privkey;
+ in
+ ''
+ #! /bin/sh
+ set -efu
+
+ hostname=${host.name}
+ secrets_dir=${config.krebs.build.source.dir.secrets.path}
+ key_type=${privkey.type}
+ key_file=$secrets_dir/ssh.id_$key_type
+ key_comment=$hostname
+
+ if test -e "$key_file"; then
+ echo "Warning: privkey already exists: $key_file" >&2
+ else
+ ssh-keygen \
+ ${optionalString (privkey.bits != null)
+ "-b ${toString privkey.bits}"} \
+ -C "$key_comment" \
+ -t "$key_type" \
+ -f "$key_file" \
+ -N ""
+ rm "$key_file.pub"
+ fi
+
+ pubkey=$(ssh-keygen -y -f "$key_file")
+
+ cat<<EOF
+ # put following into config.krebs.hosts.$hostname:
+ ssh.privkey = <secrets/ssh.id_$key_type>;
+ ssh.pubkey = $(echo $pubkey | jq -R .);
+ EOF
+ '';
+ };
+
options.krebs.build.scripts.deploy = lib.mkOption {
type = lib.types.str;
default = ''