bootstrap

#!/usr/bin/env bash
set -xeuo pipefail

SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"

# shellcheck disable=SC1090
source "$SCRIPT_DIR/env.sh"
: "${host:?}"
: "${ssh_user:=root}"

EXTRA_FILES_DIR=$(mktemp -d)
trap 'rm -rf -- "$EXTRA_FILES_DIR"' EXIT

SSH_DIR="$EXTRA_FILES_DIR/etc/ssh"
SECRETS_DIR="$EXTRA_FILES_DIR/var/lib/secrets"

mkdir -p "$SSH_DIR"
mkdir -p "$SECRETS_DIR"

umask 0177
sops --extract '["initrd_ssh_key"]' --decrypt "$SCRIPT_DIR/secrets.yaml" > "$SECRETS_DIR/initrd_ssh_key"
umask 0022

for keyname in ssh_host_rsa_key ssh_host_rsa_key.pub ssh_host_ed25519_key ssh_host_ed25519_key.pub; do
  if [[ $keyname == *.pub ]]; then
    umask 0133
  else
    umask 0177
  fi
  sops --extract '["'$keyname'"]' --decrypt "$SCRIPT_DIR/secrets.yaml" > "$SSH_DIR/$keyname"
done

umask 0022

nixos-anywhere \
  --extra-files "$EXTRA_FILES_DIR" \
  --disk-encryption-keys /tmp/secret.key <(sops --extract '["zfs-key"]' --decrypt "$SCRIPT_DIR/secrets.yaml") \
  --flake ".#bld1" \
  "${ssh_user}@${host}"