77 lines
1.9 KiB
JavaScript
77 lines
1.9 KiB
JavaScript
import { dirname, resolve, relative } from "path";
|
|
import { parseDocument, stringify } from "yaml";
|
|
|
|
const [, script, name, host] = process.argv;
|
|
|
|
const sopsFilePath = resolve(dirname(script), "../.sops.yaml");
|
|
const sopsFile = await Bun.file(sopsFilePath).text();
|
|
const sopsConfig = parseDocument(sopsFile);
|
|
|
|
//
|
|
// STEP 1: Get the remote key, convert to age key
|
|
//
|
|
|
|
const remoteKeyProc = Bun.spawn(`ssh-keyscan -qt ed25519 ${host}`.split(" "), {
|
|
stderr: null,
|
|
});
|
|
|
|
const sshToAgeProc = Bun.spawn(["ssh-to-age"], {
|
|
stdin: await new Response(remoteKeyProc.stdout).arrayBuffer(),
|
|
});
|
|
|
|
const ageKey = (await new Response(sshToAgeProc.stdout).text()).trim();
|
|
|
|
//
|
|
// STEP 2: Add to keys
|
|
//
|
|
const keysNode = sopsConfig.get("keys");
|
|
let keys = keysNode.items;
|
|
|
|
// remove keynode if it exists
|
|
keys = keys.filter((i) => i.anchor !== `m_${name}`);
|
|
|
|
// create the new key node
|
|
const newNode = sopsConfig.createNode(ageKey);
|
|
newNode.anchor = `m_${name}`;
|
|
|
|
keys = [...keys, newNode];
|
|
|
|
keysNode.items = keys;
|
|
sopsConfig.set("keys", keysNode);
|
|
|
|
//
|
|
// STEP 3: Add machine to creation_rules
|
|
//
|
|
const pathRegex = `secrets/${name}/[^/]+\\.(yaml|json|env|ini)$`;
|
|
const opsAnchors = keys
|
|
.filter((i) => i.anchor.startsWith("op_"))
|
|
.map((i) => sopsConfig.createAlias(i));
|
|
|
|
//console.log({opsAnchors})
|
|
|
|
const creationRuleTemplate = {
|
|
path_regex: pathRegex,
|
|
key_groups: [
|
|
{
|
|
age: [...opsAnchors, sopsConfig.createAlias(newNode)],
|
|
},
|
|
],
|
|
};
|
|
|
|
// Remove old creation_rules entry
|
|
const creationRules = sopsConfig
|
|
.get("creation_rules")
|
|
.items.filter((i) => i.get("path_regex") !== pathRegex);
|
|
|
|
const creationRulesNode = sopsConfig.createNode(creationRules);
|
|
creationRulesNode.add(creationRuleTemplate);
|
|
sopsConfig.set("creation_rules", creationRulesNode);
|
|
|
|
await Bun.write(sopsFilePath, sopsConfig.toString());
|
|
|
|
console.log(
|
|
`Finished. Added ${name} with key ${ageKey} to ${relative(
|
|
dirname(script),
|
|
sopsFilePath
|
|
)}.`
|
|
);
|