public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[GCE] Put temp files for fetch-ssh-keys service in /run

Browse Source
This commit is contained in:
Russell O'Connor 2015-03-23 21:45:40 +00:00
parent 1badfabc4d
commit 4744e3541a
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
nixos/modules/virtualisation/google-compute-image.nix
View File

@ -137,7 +137,8 @@ in
after = [ "network-online.target" "ip-up.target" ]; after = [ "network-online.target" "ip-up.target" ];
wants = [ "network-online.target" "ip-up.target" ]; wants = [ "network-online.target" "ip-up.target" ];
script = let wget = "${pkgs.wget}/bin/wget --retry-connrefused -t 15 --waitretry=10 --header='Metadata-Flavor: Google'"; in script = let wget = "${pkgs.wget}/bin/wget --retry-connrefused -t 15 --waitretry=10 --header='Metadata-Flavor: Google'";
mktemp = "mktemp --tmpdir=/run"; in
'' ''
# When dealing with cryptographic keys, we want to keep things private. # When dealing with cryptographic keys, we want to keep things private.
umask 077 umask 077
@ -145,10 +146,10 @@ in
if ! [ -e /root/.ssh/authorized_keys ]; then if ! [ -e /root/.ssh/authorized_keys ]; then
echo "obtaining SSH key..." echo "obtaining SSH key..."
mkdir -m 0700 -p /root/.ssh mkdir -m 0700 -p /root/.ssh
AUTH_KEYS=$(mktemp) && { AUTH_KEYS=$(${mktemp}) && {
${wget} -O $AUTH_KEYS http://metadata.google.internal/0.1/meta-data/authorized-keys ${wget} -O $AUTH_KEYS http://metadata.google.internal/0.1/meta-data/authorized-keys
if [ $? -eq 0 -a -e $AUTH_KEYS ]; then if [ $? -eq 0 -a -e $AUTH_KEYS ]; then
KEY_PUB=$(mktemp) && { KEY_PUB=$(${mktemp}) && {
cat $AUTH_KEYS | cut -d: -f2- > $KEY_PUB cat $AUTH_KEYS | cut -d: -f2- > $KEY_PUB
if ! grep -q -f $KEY_PUB /root/.ssh/authorized_keys; then if ! grep -q -f $KEY_PUB /root/.ssh/authorized_keys; then
cat $KEY_PUB >> /root/.ssh/authorized_keys cat $KEY_PUB >> /root/.ssh/authorized_keys
@ -165,7 +166,7 @@ in
countKeys=0 countKeys=0
${flip concatMapStrings config.services.openssh.hostKeys (k : ${flip concatMapStrings config.services.openssh.hostKeys (k :
let kName = baseNameOf k.path; in '' let kName = baseNameOf k.path; in ''
PRIV_KEY=$(mktemp) && { PRIV_KEY=$(${mktemp}) && {
echo "trying to obtain SSH private host key ${kName}" echo "trying to obtain SSH private host key ${kName}"
${wget} -O $PRIV_KEY http://metadata.google.internal/0.1/meta-data/attributes/${kName} && : ${wget} -O $PRIV_KEY http://metadata.google.internal/0.1/meta-data/attributes/${kName} && :
if [ $? -eq 0 -a -e $PRIV_KEY ]; then if [ $? -eq 0 -a -e $PRIV_KEY ]; then