blob: c53dfe7c413288cc1c88561ff357cf681881b6f9 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
|
#!/bin/bash
#
# Create keys for new nodes.
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as
# published by the Free Software Foundation, either version 3 of the
# License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public
# License along with this program. If not, see
# <http://www.gnu.org/licenses/>.
function hydra_newkeys {
# Generates ssh and gpg keys for new or existing nodes
# GPG keys should be manually imported in the nodes
local node
local which
if [ -z "$1" ]; then
which="new"
else
which="$1"
fi
if [ ! -z "$2" ]; then
shift
NODES="$*"
else
NODES="`hydra $HYDRA nodes`"
fi
for node in $NODES; do
node="`hydra_get_fqdn_from_nodename $node`"
sshkey="$HYDRA_FOLDER/keyring/keys/nodes/$node/ssh/id_rsa.asc"
gpgkey="$HYDRA_FOLDER/keyring/keys/nodes/$node/gpg/key.asc"
borgkey="$HYDRA_FOLDER/keyring/keys/nodes/$node/borg/key.asc"
# Ensure we have eyaml keys
hydra $HYDRA eyaml $node
if [ "$which" == "all" ]; then
hydra_genpairs ssh $node
hydra_genpairs openpgp $node
elif [ "$which" == "new" ]; then
if [ ! -e "$sshkey" ]; then
hydra_genpairs ssh $node
fi
if [ ! -e "$gpgkey" ]; then
hydra_genpairs openpgp $node
fi
if [ ! -e "$borgkey" ]; then
hydra_genpairs borg $node
fi
elif [ "$which" == "ssh" ]; then
hydra_genpairs ssh $node
elif [ "$which" == "openpgp" ]; then
hydra_genpairs openpgp $node
elif [ ! -e "$borg" ]; then
hydra_newkeys_borg $node
fi
done
}
# Borg does not support using pre-generated keys anymore (as of 2024-05-16).
#
# This code is therefore deprecated, but will stay here for a while, as maybe
# in the long term borg starts to support this again.
#
# Check also https://github.com/borgbackup/borg/issues/7047
# https://borgbackup.readthedocs.io/en/latest/faq.html#how-important-is-the-home-config-borg-directory
function hydra_newkeys_borg {
# Check for borg
#if ! which borg &> /dev/null; then
# echo "Please install borgbackup to be able to generate borg keys"
# return 1
#fi
hydra_install_package borgbackup
# Set working folder
hydra_set_tmpfile hydra.newkeys.borg -d
mkdir -p $TMPWORK/keys
# Set password
# BORG_PASSCOMMAND is supported only on recent borg
#read -s -rep "Borg key password: " password
#export BORG_PASSCOMMAND='keyringer $HYDRA decrypt nodes/$node/borg/key.passwd 2> /dev/nul'
keyringer $HYDRA pwgen nodes/$node/borg/key.passwd
password="`keyringer $HYDRA decrypt nodes/$node/borg/key.passwd 2> /dev/null`"
export BORG_PASSPHRASE="$password"
# Set borg parameters
export BORG_CONFIG_DIR="$TMPWORK"
export BORG_KEY_FILE="$TMPWORK/keys/key"
# Create key
borg init --encryption=keyfile $TMPWORK/repo
# Encrypt key
cat $BORG_KEY_FILE | keyringer $HYDRA encrypt nodes/$node/borg/key
if [ -e "$HYDRA_FOLDER/puppet/config/secrets/node/$node.yaml" ]; then
# Add Borg passphrase into secret node config
#keyringer $HYDRA decrypt nodes/$NODE/borg/key.passwd | \
#hydra $HYDRA eyaml $NODE encrypt --stdin -o block -q -l nodo::subsystem::backup::borg::password >> $HYDRA_FOLDER/puppet/config/secrets/node/$NODE.yaml
#PASSWORD="`keyringer $HYDRA decrypt nodes/$node/borg/key.passwd`"
#echo -n "$PASSWORD" | hydra $HYDRA eyaml $node encrypt --stdin -o block -q -l nodo::subsystem::backup::borg::password >> $HYDRA_FOLDER/puppet/config/secrets/node/$node.yaml
echo -n "$password" | hydra $HYDRA eyaml $node encrypt --stdin -o block -q -l nodo::subsystem::backup::borg::password >> $HYDRA_FOLDER/puppet/config/secrets/node/$node.yaml
fi
# Cleanup
if which wipe &> /dev/null; then
wipe -rf $TMPWORK
else
rm -rf $TMPWORK
fi
}
function hydra_genpairs {
BASEDIR="/tmp"
local which="$1"
local node="$2"
if [ "$which" == "openpgp" ]; then
keyringer $HYDRA genpair gpg nodes/$node/gpg/key $node
if [ -e "$HYDRA_FOLDER/puppet/config/secrets/node/$node.yaml" ]; then
# Add OpenPGP key ID into secret node config
KEYID="`keyringer $HYDRA decrypt nodes/$node/gpg/key.pub 2> /dev/null | gpg --with-colons 2> /dev/null | grep ^pub: | cut -d : -f 5`"
echo "nodo::subsystem::backup::encryptkey: '$KEYID'" >> $HYDRA_FOLDER/puppet/config/secrets/node/$node.yaml
# Add OpenPGP passphrase into secret node config
# We cannot simple pipe keyringer output into hiera-eyaml otherwiser the newline after the password will be interpreted as part of the password
#keyringer $HYDRA decrypt nodes/$node/gpg/key.passwd | \
#hydra $HYDRA eyaml $node encrypt --stdin -o block -q -l nodo::subsystem::backup::password >> $HYDRA_FOLDER/puppet/config/secrets/node/$node.yaml
PASSWORD="`keyringer $HYDRA decrypt nodes/$node/gpg/key.passwd`"
echo -n "$PASSWORD" | hydra $HYDRA eyaml $node encrypt --stdin -o block -q -l nodo::subsystem::backup::password >> $HYDRA_FOLDER/puppet/config/secrets/node/$node.yaml
fi
elif [ "$which" == "ssh" ]; then
keyringer $HYDRA genpair ssh nodes/$node/ssh/id_rsa $node
elif [ "$which" == "borg" ]; then
hydra_newkeys_borg $node
fi
hydra_set_tmpfile genpair
echo "Importing $which keys for $node" > $TMPWORK
keyringer $HYDRA git commit -F $TMPWORK
keyringer $HYDRA git push
hydra_unset_tmpfile $TMPWORK
}
# Load.
source $APP_BASE/lib/hydra/functions || exit 1
hydra_config_load
# Check for keyringer.
if ! which keyringer &> /dev/null; then
hydra_install_package keyringer
fi
hydra_newkeys $*
|
