Archived
beatzaplentyandClaude Sonnet 5
a2b557c034
scripts/backup-admin-key.sh, rotate-admin-key.sh, and sync-host-keys.sh each independently resolved sops/age's default key-file path, derived an age pubkey from an identity file, and (two of them) ran `sops updatekeys` the same way -- now shared via scripts/lib/sops-age.sh. Also extracted the "type X to confirm" prompt duplicated across create-proxmox-resource.sh and sync-host-keys.sh into scripts/lib/confirm.sh. Pure extraction, no behavior change -- each call site produces identical commands/output to before. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
53 lines
2.4 KiB
Bash
53 lines
2.4 KiB
Bash
#!/usr/bin/env bash
|
|
# Shared sops/age helpers for scripts/backup-admin-key.sh,
|
|
# scripts/rotate-admin-key.sh, and scripts/sync-host-keys.sh -- all three
|
|
# derive an age public key from a private identity file the same way, two
|
|
# of them resolve the same sops/age default key-file path, and two of them
|
|
# run `sops updatekeys` the same way. Kept in one place so they can't drift
|
|
# apart. Source alongside env.sh:
|
|
# source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/sops-age.sh"
|
|
#
|
|
# Uses NIX_OPTS (an array of extra `nix-shell` options -- see env.sh's
|
|
# nix_extra_opts) if the caller has already set it, same convention as
|
|
# lib/ssh-host-keys.sh. Falls back to no extra options if the caller never
|
|
# sourced env.sh.
|
|
if ! declare -p NIX_OPTS >/dev/null 2>&1; then
|
|
declare -a NIX_OPTS=()
|
|
fi
|
|
|
|
# sops/age's own default identity-file resolution order, minus $SOPS_AGE_KEY
|
|
# itself (an inline identity, not a path -- callers that accept it check it
|
|
# separately, before falling back to this).
|
|
: "${DEFAULT_SOPS_AGE_KEY_FILE:=${SOPS_AGE_KEY_FILE:-${XDG_CONFIG_HOME:-$HOME/.config}/sops/age/keys.txt}}"
|
|
|
|
# age_pubkey_from_identity_file <identity-file>
|
|
# Prints the age public key for a private identity file (age-keygen -y).
|
|
age_pubkey_from_identity_file() {
|
|
local identity_file="$1"
|
|
nix-shell "${NIX_OPTS[@]}" -p age --run "age-keygen -y '${identity_file}'"
|
|
}
|
|
|
|
# sops_yaml_admin_pubkey <sops-yaml-path>
|
|
# Prints .sops.yaml's current &admin age public key, or empty (not an error
|
|
# under set -e) if no such anchor line exists -- callers that need to treat
|
|
# "missing" as fatal check for an empty result themselves.
|
|
sops_yaml_admin_pubkey() {
|
|
local sops_yaml="$1"
|
|
grep -E '^ - &admin age1' "$sops_yaml" 2>/dev/null | awk '{print $NF}' || true
|
|
}
|
|
|
|
# sops_updatekeys <secrets-file> [key-file]
|
|
# Re-encrypts <secrets-file> for .sops.yaml's current recipient set. If
|
|
# <key-file> is given, decrypts with that identity (SOPS_AGE_KEY_FILE)
|
|
# instead of whatever's ambient -- needed when the ambient default key
|
|
# doesn't match yet (e.g. mid-rotation, decrypting with the outgoing key).
|
|
sops_updatekeys() {
|
|
local secrets_file="$1" key_file="${2:-}"
|
|
if [[ -n "$key_file" ]]; then
|
|
SOPS_AGE_KEY_FILE="$key_file" nix-shell "${NIX_OPTS[@]}" -p sops --run \
|
|
"sops updatekeys --yes '${secrets_file}'"
|
|
else
|
|
nix-shell "${NIX_OPTS[@]}" -p sops --run "sops updatekeys --yes '${secrets_file}'"
|
|
fi
|
|
}
|