hosts/losurdo/decrypt.sh

   1 #!/usr/bin/env bash
   2 set -eu
   3 dir=${0%/*}
   4 cred=$1
   5 name=${cred##*/}
   6 name=${name%.cred}
   7
   8 umask 177
   9 SECRET=$(mktemp /dev/shm/credential.secret.XXXXXXX)
  10 trap 'chmod 600 $SECRET; shred --remove=unlink $SECRET' EXIT
  11 gpg --yes --output "$SECRET" --decrypt "$dir/credential.secret.gpg"
  12 chmod 400 "$SECRET"
  13
  14 sudo unshare --mount sh -xc "
  15   mount --bind '$SECRET' /var/lib/systemd/credential.secret &&
  16   mount --bind '$dir'/machine-id /etc/machine-id &&
  17   systemd-creds decrypt --with-key=host --name '$name' '$cred' -
  18 "