]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/losurdo/decrypt.sh
postfix: use RuntimeDirectory
[sourcephile-nix.git] / hosts / losurdo / decrypt.sh
1 #!/usr/bin/env bash
2 set -eu
3 dir=${0%/*}
4 cred=$1
5 name=${cred##*/}
6 name=${name%.cred}
7
8 umask 177
9 SECRET=$(mktemp /dev/shm/credential.secret.XXXXXXX)
10 trap 'chmod 600 $SECRET; shred --remove=unlink $SECRET' EXIT
11 gpg --yes --output "$SECRET" --decrypt "$dir/credential.secret.gpg"
12 chmod 400 "$SECRET"
13
14 sudo unshare --mount sh -xc "
15 mount --bind '$SECRET' /var/lib/systemd/credential.secret &&
16 mount --bind '$dir'/machine-id /etc/machine-id &&
17 systemd-creds decrypt --with-key=host --name '$name' '$cred' -
18 "