1#!/usr/bin/env bash
 2
 3# Authorize a supplied dedicated Nix builder public key on Nagoya.
 4# Run after installing /etc/nix/keys/nagoya-builder.pub.
 5
 6set -euo pipefail
 7
 8KEY_FILE="${KEY_FILE:-/etc/nix/keys/nagoya-builder.pub}"
 9NAGOYA_HOST="${NAGOYA_HOST:-nagoya.vpn}"
10SSH_KEY="${SSH_KEY:-$HOME/.ssh/id_homelab_sk}"
11
12if [[ ! -r "$KEY_FILE" ]]; then
13	echo "Builder public key not readable: $KEY_FILE" >&2
14	exit 1
15fi
16
17public_key=$(<"$KEY_FILE")
18authorized_key="restrict,command=\"/nix/var/nix/profiles/default/bin/nix-daemon --stdio\" $public_key"
19
20printf '%s\n' "$authorized_key" |
21	ssh -i "$SSH_KEY" -o IdentitiesOnly=yes "vincent@$NAGOYA_HOST" \
22		'umask 077; mkdir -p ~/.ssh; touch ~/.ssh/authorized_keys; key=$(cat); grep -qxF "$key" ~/.ssh/authorized_keys || printf "%s\n" "$key" >> ~/.ssh/authorized_keys'