private: add systemd-creds scripts

diff --git a/private/.gitattributes b/private/.gitattributes
index ae482782ffd51285fd3a656baef930984c6695f6..c8d0654175747c98068c4d3e937533592d5dc726 100644 (file)
--- a/private/.gitattributes
+++ b/private/.gitattributes
@@ -1,6 +1,9 @@
 credentials/oignon/** filter=git-crypt-julm diff=git-crypt-julm
 credentials/patate/** filter=git-crypt-sevy diff=git-crypt-sevy
 
+hosts/oignon/** filter=git-crypt-julm diff=git-crypt-julm
+hosts/patate/** filter=git-crypt-sevy diff=git-crypt-sevy
+
 root/oignon/** filter=git-crypt-julm diff=git-crypt-julm
 root/patate/** filter=git-crypt-sevy diff=git-crypt-sevy
 

diff --git a/private/hosts/decrypt.sh b/private/hosts/decrypt.sh
new file mode 100755 (executable)
index 0000000..eb19a50
--- /dev/null
+++ b/private/hosts/decrypt.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env sh
+set -eu
+dir=${0%/*}
+key=$1
+host=${key##*hosts/}
+host=${host%%/*}
+name=${key##*/}
+name=${name%.secret}
+sudo unshare --mount sh -xc "
+  mount --bind $dir/$host/root/credential.secret /var/lib/systemd/credential.secret &&
+  mount --bind $dir/$host/root/machine-id /etc/machine-id &&
+  systemd-creds decrypt --with-key=host --name '$name' '$key' -
+"

diff --git a/private/hosts/encrypt.sh b/private/hosts/encrypt.sh
new file mode 100755 (executable)
index 0000000..2dc1494
--- /dev/null
+++ b/private/hosts/encrypt.sh
@@ -0,0 +1,15 @@
+#!/usr/bin/env sh
+set -eux
+dir=${0%/*}
+key=$1
+host=${key#*/}
+host=${host%%/*}
+hostkey=${key#*/*/}
+mkdir -p "$dir/$host/credentials/${hostkey%/*}"
+pass "$key" |
+sudo unshare --mount sh -xc "
+  mount --bind $dir/$host/root/credential.secret /var/lib/systemd/credential.secret &&
+  mount --bind $dir/$host/root/machine-id /etc/machine-id &&
+  systemd-creds encrypt --with-key=host --name '${hostkey##*/}' - - |
+  install -m 400 -o $USER -g users /dev/stdin '$dir/$host/credentials/$hostkey.secret'
+"