colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

sane-secrets-unlock: work around race condition during system boot

Browse Source
This commit is contained in:
Colin
2024-09-04 13:48:10 +00:00
parent 3e182b2a06
commit 364a4f1182
1 changed files with 19 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
pkgs/additional/sane-scripts/src/sane-secrets-unlock
View File

@@ -1,7 +1,6 @@
#!/usr/bin/env nix-shell
#!nix-shell -i bash -p bash -p coreutils-full -p openssh -p ssh-to-age
# unlocks the SOPS store (i.e. populate a SOPS key from the user's SSH key)
set -e
if test -f ~/.config/sops/age/keys.txt; then
exit
@@ -11,15 +10,27 @@ set -x
mkdir -p ~/.config/sops/age
# unlock the SSH key
cp ~/.ssh/id_ed25519 ~/.config/sops/age/id_ed25519
ssh-keygen -p -N "" -f ~/.config/sops/age/id_ed25519
# convert ssh -> age
ssh-to-age -private-key -i ~/.config/sops/age/id_ed25519 > ~/.config/sops/age/keys.txt
chmod 600 ~/.config/sops/age/keys.txt
tryUnlock() {
# unlock the SSH key
cp ~/.ssh/id_ed25519 ~/.config/sops/age/id_ed25519
ssh-keygen -p -N "" -f ~/.config/sops/age/id_ed25519
# convert ssh -> age
ssh-to-age -private-key -i ~/.config/sops/age/id_ed25519 > ~/.config/sops/age/keys.txt
chmod 600 ~/.config/sops/age/keys.txt
}
# there are some dependencies not properly conveyed within the services which may invoke sane-secrets-unlock.
# so show some grace if invoked e.g. before ~/.ssh/ symlinks have been created
tryUnlock \
|| (sleep 1 && tryUnlock) \
|| (sleep 1 && tryUnlock) \
|| (sleep 2 && tryUnlock) \
|| (sleep 4 && tryUnlock) \
|| (sleep 4 && tryUnlock) \
|| (sleep 4 && tryUnlock) \
# remove the unlocked SSH key
rm ~/.config/sops/age/id_ed25519
rm -f ~/.config/sops/age/id_ed25519
# present the pubkey for convenience (e.g. if this sops key is new)
echo pubkey: $(cat ~/.ssh/id_ed25519.pub | ssh-to-age)