shell.nix: Add luks remote unlock script

Closes #9.
2021-01-28 19:02:19 +01:00 · 2021-01-28 19:02:19 +01:00 · 55fb2cfdda
parent e7c6406820
commit 55fb2cfdda
1 changed files with 13 additions and 0 deletions
--- a/shell.nix
+++ b/shell.nix
@ -25,6 +25,19 @@ let
      set -e
      $(nix-build --no-out-link deploy.nix -A "$1")
    '';
+
+    unlock = ''
+      set -eo pipefail
+      machine="$1"
+      hostname="$(nix-instantiate --eval --json machines -A "$1".target | ${pkgs.jq}/bin/jq -r . | cut -d@ -f2)"
+      ssh \
+          -oStrictHostKeyChecking=no \
+          -oGlobalKnownHostsFile=<(echo "[$hostname]:2222 ssh-ed25519 $(ssh-keygen -l -f <(ssh-keygen -y -f<(pass "nixos/machines/$machine/initrd-ssh-host-key")) | cut -d' ' -f2)") \
+          -4 \
+          -p 2222 \
+          "root@$hostname" \
+          "cat > /crypt-ramfs/passphrase" < <(pass "devices/$machine/luks")
+    '';
  };
 in
 pkgs.mkShell {