]> Git — Sourcephile - sourcephile-nix.git/blob - private/hosts/encrypt.sh
losurdo: openvpn: switch to calyx while riseup is down
[sourcephile-nix.git] / private / hosts / encrypt.sh
1 #!/usr/bin/env sh
2 set -eux
3 dir=${0%/*}
4 key=$1
5 host=${key#*/}
6 host=${host%%/*}
7 hostkey=${key#*/*/}
8 mkdir -p "$dir/$host/credentials/${hostkey%/*}"
9 pass "$key" |
10 sudo unshare --mount sh -xc "
11 mount --bind $dir/$host/root/credential.secret /var/lib/systemd/credential.secret &&
12 mount --bind $dir/$host/root/machine-id /etc/machine-id &&
13 systemd-creds encrypt --with-key=host --name '${hostkey##*/}' - - |
14 install -m 400 -o $USER -g users /dev/stdin '$dir/$host/credentials/$hostkey.secret'
15 "