rekey.scm (2105B)
1 #!/run/current-system/profile/bin/guile --no-auto-compile 2 !# 3 4 (define-module (epistemia secrets rekey) 5 #:use-module (ice-9 format) 6 #:use-module (ice-9 match)) 7 8 (define age-id "/data/ssh/id_ed25519") 9 (define age-pub "/data/ssh/id_ed25519.pub") 10 11 ;; use ssh-keyscan to get these, or ~/.ssh/known_hosts 12 (define saklas "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINmdSO3VpL2Y18LV74dikABLEN2hE/abSlyoaiNn5kiR") 13 (define demiurge "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINVWXCI58LlxCHZ5tbXOH709jsjvjBs/TUFeKvpplECp") 14 (define hastur "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDRBXSHca8R2M37jzVj87neBZ9TqZ+R0A0yaZCIFiNaA") 15 16 (define mappings 17 `(("email_13f0" . ,saklas) 18 ("email_vinbiz" . ,saklas) 19 ("email_vineetk" . ,saklas) 20 ("wg1_saklas" . ,saklas) 21 ("saklas_smtpd_dkim" . ,saklas) 22 ("saklas_smtpd_passwd" . ,saklas) 23 ("saklas_smtpd_virtuals" . ,saklas) 24 ("wg0_demiurge" . ,demiurge) 25 ("wg1_demiurge" . ,demiurge) 26 ("wg0_hastur" . ,hastur) 27 ("wg1_hastur" . ,hastur) 28 ("wg2_hastur" . ,hastur) 29 ("wpa_supplicant" . ,hastur))) 30 31 (define (run fmt . args) 32 (zero? (system (apply format #f fmt args)))) 33 34 (for-each 35 (match-lambda 36 ((base . key) 37 (let ((enc (string-append base ".age")) 38 (tmp (string-append base ".age.tmp"))) 39 (cond 40 ;; rekey existing encrypted file 41 ((file-exists? enc) 42 (format #t "rekeying ~a...~%" enc) 43 (if (run "age -d -i ~a ~a | age -e -R ~a -r '~a' -o ~a" 44 age-id enc age-pub key tmp) 45 (rename-file tmp enc) 46 (format (current-error-port) "failed to rekey ~a~%" base))) 47 48 ;; otherwise encrypt fresh plaintext 49 ((file-exists? base) 50 (format #t "encrypting ~a...~%" base) 51 (if (run "age -e -R ~a -r '~a' -o ~a ~a" 52 age-pub key enc base) 53 (delete-file base) 54 (format (current-error-port) "failed to encrypt ~a~%" base))) 55 56 (else 57 (format (current-error-port) "file not found: ~a~%" base)))))) 58 mappings)