167 lines
4.5 KiB
Nix
167 lines
4.5 KiB
Nix
# unpackPhase
|
|
# patchPhase
|
|
# configurePhase
|
|
# buildPhase
|
|
# checkPhase
|
|
# installPhase
|
|
# fixupPhase
|
|
# installCheckPhase
|
|
# distPhase
|
|
{
|
|
lib,
|
|
stdenv,
|
|
writeShellScript,
|
|
k8s,
|
|
openssh,
|
|
...
|
|
}:
|
|
let
|
|
deploy_script_body = (
|
|
''
|
|
set -euo pipefail
|
|
IFS=$'\n\t'
|
|
DIR="$( cd "$( dirname "''${BASH_SOURCE[0]}" )" && pwd )"
|
|
''
|
|
+ (lib.concatMapStringsSep "\n" deploy_machine [
|
|
"nc0"
|
|
"nc1"
|
|
"nc2"
|
|
])
|
|
);
|
|
deploy_script = (writeShellScript "deploy-script" deploy_script_body);
|
|
deploy_file = (
|
|
{
|
|
dest_dir,
|
|
file,
|
|
name ? (builtins.baseNameOf file),
|
|
owner,
|
|
group,
|
|
mode,
|
|
}:
|
|
''
|
|
##
|
|
## deploy ${name} to ${dest_dir}
|
|
##
|
|
${openssh}/bin/ssh mrmanager doas rm -f ${dest_dir}/${name} ~/${name}
|
|
${openssh}/bin/scp ${file} mrmanager:~/${name}
|
|
${openssh}/bin/ssh mrmanager doas install -o ${toString owner} -g ${toString group} -m ${mode} ~/${name} ${dest_dir}/${name}
|
|
${openssh}/bin/ssh mrmanager doas rm -f ~/${name}
|
|
|
|
|
|
''
|
|
);
|
|
deploy_machine = (
|
|
vm_name:
|
|
(
|
|
''
|
|
##
|
|
## Create directories on ${vm_name}
|
|
##
|
|
${openssh}/bin/ssh mrmanager doas install -d -o 11235 -g 11235 -m 0755 /vm/${vm_name}/persist/keys
|
|
${openssh}/bin/ssh mrmanager doas install -d -o 10016 -g 10016 -m 0755 /vm/${vm_name}/persist/keys/etcd
|
|
${openssh}/bin/ssh mrmanager doas install -d -o 10024 -g 10024 -m 0755 /vm/${vm_name}/persist/keys/kube
|
|
|
|
|
|
''
|
|
+ (lib.concatMapStringsSep "\n" deploy_file [
|
|
{
|
|
dest_dir = "/vm/${vm_name}/persist/keys/etcd";
|
|
file = "${k8s.keys.kube-api-server}/kube-api-server.crt";
|
|
owner = 10016;
|
|
group = 10016;
|
|
mode = "0640";
|
|
}
|
|
{
|
|
dest_dir = "/vm/${vm_name}/persist/keys/etcd";
|
|
file = "${k8s.keys.kube-api-server}/kube-api-server.key";
|
|
owner = 10016;
|
|
group = 10016;
|
|
mode = "0600";
|
|
}
|
|
{
|
|
dest_dir = "/vm/${vm_name}/persist/keys/etcd";
|
|
file = "${k8s.ca}/ca.crt";
|
|
owner = 10016;
|
|
group = 10016;
|
|
mode = "0640";
|
|
}
|
|
# {
|
|
# dest_dir = "/vm/${vm_name}/persist/keys/kube";
|
|
# file = "${self.kubernetes}/kubernetes.pem";
|
|
# owner = 10024;
|
|
# group = 10024;
|
|
# mode = "0640";
|
|
# }
|
|
# {
|
|
# dest_dir = "/vm/${vm_name}/persist/keys/kube";
|
|
# file = "${self.kubernetes}/kubernetes-key.pem";
|
|
# owner = 10024;
|
|
# group = 10024;
|
|
# mode = "0640";
|
|
# }
|
|
# {
|
|
# dest_dir = "/vm/${vm_name}/persist/keys/kube";
|
|
# file = "${self.ca}/ca.pem";
|
|
# owner = 10024;
|
|
# group = 10024;
|
|
# mode = "0600";
|
|
# }
|
|
# {
|
|
# dest_dir = "/vm/${vm_name}/persist/keys/kube";
|
|
# file = (writeText "encryption-config.yaml" (lib.generators.toYAML { } kube_encryption_config));
|
|
# name = "encryption-config.yaml";
|
|
# owner = 10024;
|
|
# group = 10024;
|
|
# mode = "0600";
|
|
# }
|
|
# {
|
|
# dest_dir = "/vm/${vm_name}/persist/keys/kube";
|
|
# file = "${self.service_account}/service-account.pem";
|
|
# owner = 10024;
|
|
# group = 10024;
|
|
# mode = "0600";
|
|
# }
|
|
# {
|
|
# dest_dir = "/vm/${vm_name}/persist/keys/kube";
|
|
# file = "${self.service_account}/service-account-key.pem";
|
|
# owner = 10024;
|
|
# group = 10024;
|
|
# mode = "0600";
|
|
# }
|
|
# {
|
|
# dest_dir = "/vm/${vm_name}/persist/keys/kube";
|
|
# file = "${self.requestheader-client-ca}/requestheader-client-ca.pem";
|
|
# owner = 10024;
|
|
# group = 10024;
|
|
# mode = "0600";
|
|
# }
|
|
# {
|
|
# dest_dir = "/vm/${vm_name}/persist/keys/kube";
|
|
# file = "${self.controller-proxy}/${vm_name_to_hostname vm_name}-proxy.pem";
|
|
# owner = 10024;
|
|
# group = 10024;
|
|
# mode = "0600";
|
|
# }
|
|
# {
|
|
# dest_dir = "/vm/${vm_name}/persist/keys/kube";
|
|
# file = "${self.controller-proxy}/${vm_name_to_hostname vm_name}-proxy-key.pem";
|
|
# owner = 10024;
|
|
# group = 10024;
|
|
# mode = "0600";
|
|
# }
|
|
])
|
|
)
|
|
);
|
|
in
|
|
stdenv.mkDerivation (finalAttrs: {
|
|
name = "deploy-script";
|
|
nativeBuildInputs = [ ];
|
|
buildInputs = [ ];
|
|
|
|
unpackPhase = "true";
|
|
|
|
installPhase = ''
|
|
cp ${deploy_script} "$out"
|
|
'';
|
|
})
|