blob: 8ee143d7d3fe252b196e0d9c231c342af0963116 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
|
#!/bin/sh
set -e
[ -n "$DEBUG" ] && set -x
OS_DIR=${OS_DIR:-$HOME/os}
OS_MANIFEST=$OS_DIR/manifest
target=/tmp/os/
restore=
list=
while getopts r:lh opt; do
case "$opt" in
r)
restore=1
target="$OPTARG"
;;
l) list=1 ;;
h | ?)
printf "usage: %s [options]\n" "$(basename "$0")"
printf "\n"
printf " -l list files that would be saved\n"
printf " -r TARGET restore to TARGET (default: %s)\n" "${target}"
printf "\n"
exit 2
;;
esac
done
shift $((OPTIND - 1))
tmp_prefix=os-secret-
# cleanup
trap '{ rm -f "/tmp/${tmp_prefix}"*; }' EXIT
handle_secret() {
# NOTE: we can't print anything to stdout here, only the final encrypted file
# to be included in the os archive
case "$1" in
encrypt)
# read the first line from input and use it as path
IFS=$(printf '\r') read -r filepath
archive=/tmp/"$tmp_prefix"$(printf "%s" "$filepath" | md5sum | cut -d' ' -f1)
# create tar archive from input, descends into directory
(
printf "%s\n" "$filepath"
cat -
) |
doas sh -c "(
tar -cz -f $archive -T - 2>/dev/null;
chown 1000:1000 $archive;
)"
# encrypt the tarfile and amend some information that makes
# reconstructing easier
(
sops --config /dev/null --encrypt "$archive" 2>/dev/null |
jq -r '.sops.data_extension |= "tar.gz"'
) >"${archive}.enc"
printf "%s\n" "${archive}.enc"
;;
decrypt)
while IFS=$(printf '\r') read -r line; do
# if $(jq -r '.sops.data_extension' "$line") == "tar.gz"
sops --config /dev/null exec-file "$line" "tar xzf - -C $target < {}"
done
;;
esac
}
handle_rules() {
while IFS=$(printf '\r') read -r line; do
if printf "%s" "$line" | grep -qe '#secret$'; then
printf "%s\n" "$line" | sed -e 's/\s#secret//' | handle_secret encrypt
else
# shellcheck disable=SC2086
find "$(printf "%s\n" $line)" -print 2>/dev/null || true
fi
done
}
_rsync() {
extra=
[ -n "$list" ] && extra="--dry-run"
rsync -v -hhh $extra \
--archive \
--links \
"$@"
}
if [ -n "$restore" ]; then
printf "os-conf: restoring %s to %s\n" "${OS_DIR}" "${target}" >&2
mkdir -p "${target}" || true
_rsync \
--exclude '/manifest' \
--exclude '/README.md' \
--exclude 'colors.todo' \
--exclude 'os-secret*.enc' \
"${OS_DIR}/" "${target}"
find "${OS_DIR}" -type f -name 'os-secret*.enc' -print |
handle_secret decrypt
else
printf "os-conf: saving to %s\n" "${OS_DIR}" >&2
uniq "$OS_MANIFEST" |
grep -v '^$' |
grep -v '^#' |
handle_rules |
_rsync --files-from=- "/" "${OS_DIR}/"
fi
|
