install.fairie/home/.chezmoiscripts/universal/run_before_02-decrypt-age-key.sh.tmpl

110 lines
5 KiB
Cheetah
Raw Normal View History

#!/usr/bin/env bash
# @file Chezmoi-Age Secret Decryption
# @brief Ensures `age` is installed and then decrypts the `home/key.txt.age` file so that Chezmoi can utilize encrypted files
# @description
# This script begins by ensuring `age` is installed, the defualt program Chezmoi utilizes for handling encryption.
# The script then allows you to generate the decrypted `~/.config/age/chezmoi.txt` file by prompting you for the password
# to `home/key.txt.age` which is the encrypted encryption key file for using Chezmoi to add encrypted files to your Install
# Doctor fork. If no password is passed to the decryption password prompt, then all of the `encrypted_` files in the fork
# are deleted so that Chezmoi does not try to decrypt files without a decryption key file.
#
# ## Headless Installs
#
# If you do not want the script to prompt you for a password, then you can pass in an environment variable with
# `HEADLESS_INSTALL=true`. This variable ensures that nothing requiring input from the user blocks the provisioning process.
# If you want to automate a headless install that requires access to `encrypted_` files and encrypted variables, then
# you can save the decrypted Age key to `~/.config/age/chezmoi.txt` prior to running `bash <(curl -sSL https://install.doctor/start)`.
#
2023-06-04 21:34:11 -07:00
# Alternatively, you can pass in your Age decryption passphrase in using the `AGE_PASSWORD` environment variable.
# Install Doctor will use this variable along with expect to headlessly automate the password prompt during the
# decryption process.
#
# ## GPG
#
# It is also possible to configure Chezmoi to utilize GPG instead of Age. This might be beneficial if you want to
# use a smart card / YubiKey for hardware-backed encryption. Otherwise, Age is a great encryption tool.
#
# ## Notes
#
# _It is possible that hardware-based smart-card-like GPG encryption might not work properly with Chezmoi yet.
# Learned this by attempting to use a YubiKey GPG setup using [this guide](https://github.com/drduh/YubiKey-Guide) and trying to get it to work with Chezmoi._
Update .local/share/chezmoi/home/.chezmoiscripts/darwin/run_onchange_after_set-wallpaper.tmpl, .local/share/chezmoi/home/.chezmoiscripts/universal/run_once_before_1-decrypt-age-key.tmpl, .local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_10_install-aqua-packages.sh.tmpl, .local/share/chezmoi/home/.chezmoiscripts/ubuntu/run_onchange_before_10_install-ubuntu-dependencies.tmpl, .local/share/chezmoi/home/.chezmoiscripts/opensuse/run_onchange_before_11-install-opensuse-software.tmpl, .local/share/chezmoi/home/.chezmoiscripts/freebsd/run_onchange_before_11-install-freebsd-packages.tmpl, .local/share/chezmoi/home/.chezmoiscripts/fedora/run_onchange_before_10-install-fedora-dependencies.tmpl, .local/share/chezmoi/home/.chezmoiscripts/debian/run_onchange_before_10-install-debian-dependencies.tmpl, .local/share/chezmoi/home/.chezmoiscripts/darwin/run_onchange_before_10_install-darwin-dependencies.tmpl, .local/share/chezmoi/home/.chezmoiscripts/centos/run_onchange_before_10-install-centos-dependencies.tmpl, .local/share/chezmoi/home/.chezmoiscripts/archlinux/run_onchange_before_10_install-archlinux-dependencies.tmpl, .local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_50-crontab.tmpl, .local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_99_bootstrap-zsh-plugins.tmpl, .local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_80-bash-completions.tmpl, .local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_before_5-install-homebrew.tmpl, .local/share/chezmoi/home/.chezmoiscripts/windows/run_onchange_before_11-install-windows-packages.tmpl
2022-12-01 22:36:57 -08:00
2023-01-24 20:36:59 -08:00
{{ includeTemplate "universal/logg-before" }}
{{ includeTemplate "universal/profile-before" }}
Update .local/share/chezmoi/home/.chezmoiscripts/darwin/run_onchange_after_set-wallpaper.tmpl, .local/share/chezmoi/home/.chezmoiscripts/universal/run_once_before_1-decrypt-age-key.tmpl, .local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_10_install-aqua-packages.sh.tmpl, .local/share/chezmoi/home/.chezmoiscripts/ubuntu/run_onchange_before_10_install-ubuntu-dependencies.tmpl, .local/share/chezmoi/home/.chezmoiscripts/opensuse/run_onchange_before_11-install-opensuse-software.tmpl, .local/share/chezmoi/home/.chezmoiscripts/freebsd/run_onchange_before_11-install-freebsd-packages.tmpl, .local/share/chezmoi/home/.chezmoiscripts/fedora/run_onchange_before_10-install-fedora-dependencies.tmpl, .local/share/chezmoi/home/.chezmoiscripts/debian/run_onchange_before_10-install-debian-dependencies.tmpl, .local/share/chezmoi/home/.chezmoiscripts/darwin/run_onchange_before_10_install-darwin-dependencies.tmpl, .local/share/chezmoi/home/.chezmoiscripts/centos/run_onchange_before_10-install-centos-dependencies.tmpl, .local/share/chezmoi/home/.chezmoiscripts/archlinux/run_onchange_before_10_install-archlinux-dependencies.tmpl, .local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_50-crontab.tmpl, .local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_99_bootstrap-zsh-plugins.tmpl, .local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_80-bash-completions.tmpl, .local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_before_5-install-homebrew.tmpl, .local/share/chezmoi/home/.chezmoiscripts/windows/run_onchange_before_11-install-windows-packages.tmpl
2022-12-01 22:36:57 -08:00
2023-06-04 21:34:11 -07:00
### Handle decryption failure
decryptionFailure() {
2023-11-04 18:46:18 -07:00
logg info 'Proceeding without decrypting age encryption key stored at ~/.local/share/chezmoi/home/key.txt.age'
2023-06-04 21:34:11 -07:00
logg info 'To have Chezmoi handle your encryption (so you can store your private files publicly) take a look at https://shorturl.at/jkpzG'
logg info 'Removing all files that begin with encrypted_ because decryption failed'
find "${XDG_DATA_HOME:-$HOME/.local/share}/chezmoi" -type f -name "encrypted_*" | while read ENCRYPTED_FILE; do
2023-06-04 21:34:11 -07:00
logg info "Removing $ENCRYPTED_FILE"
rm -f "$ENCRYPTED_FILE"
done
}
### Install Age via Homebrew if not present
installAge() {
2023-06-13 18:41:36 -07:00
if ! command -v age > /dev/null; then
2023-11-04 18:46:18 -07:00
logg info 'Running brew install age'
brew install --quiet age
fi
2023-06-04 21:34:11 -07:00
}
Update 22 files - /home/.chezmoiscripts/_universal/run_onchange_before_11-install-docker.tmpl - /home/.chezmoiscripts/_universal/run_onchange_before_05-install-homebrew.tmpl - /home/.chezmoiscripts/_universal/run_onchange_before_10-remove-bloatware.tmpl - /home/.chezmoiscripts/_universal/run_onchange_before_08-install-zx.tmpl - /home/.chezmoiscripts/_universal/run_onchange_before_09-ensure-node-version.tmpl - /home/.chezmoiscripts/universal/run_before_01-decrypt-age-key.tmpl - /home/.chezmoiscripts/universal/run_onchange_before_11-install-docker.tmpl - /home/.chezmoiscripts/universal/run_onchange_before_05-install-homebrew.tmpl - /home/.chezmoiscripts/universal/run_onchange_before_10-remove-bloatware.tmpl - /home/.chezmoiscripts/universal/run_onchange_before_08-install-zx.tmpl - /home/.chezmoiscripts/universal/run_onchange_before_09-ensure-node-version.tmpl - /home/.chezmoiscripts/centos/run_onchange_before_10-install-centos-dependencies.tmpl - /home/.chezmoiscripts/centos/run_onchange_before_05-upgrade.tmpl - /home/.chezmoiscripts/fedora/run_onchange_before_10-install-fedora-dependencies.tmpl - /home/.chezmoitemplates/universal/common-dependencies - /home/.chezmoitemplates/universal/profile-inline - /home/.chezmoitemplates/ubuntu/common-dependencies - /home/.chezmoitemplates/opensuse/common-dependencies - /home/.chezmoitemplates/freebsd/common-dependencies - /home/.chezmoitemplates/fedora/common-dependencies - /home/.chezmoitemplates/debian/common-dependencies - /home/.chezmoitemplates/archlinux/common-dependencies
2023-01-30 21:43:15 -08:00
2023-06-04 21:34:11 -07:00
### Install Expect via Homebrew if not present
installExpect() {
2023-06-13 18:41:36 -07:00
if ! command -v expect > /dev/null; then
2023-11-04 18:46:18 -07:00
logg info 'Running brew install expect'
brew install --quiet expect
2023-06-04 21:34:11 -07:00
fi
}
### Decrypt private key if it is not already present
decryptKey() {
if command -v age > /dev/null; then
if [ ! -f "${XDG_CONFIG_HOME}/age/chezmoi.txt" ]; then
mkdir -p "${XDG_CONFIG_HOME}/age"
2023-06-04 21:34:11 -07:00
if [ -z "$AGE_PASSWORD" ]; then
2023-11-04 18:46:18 -07:00
logg star 'PRESS ENTER if you have not set up your encryption token yet'
2023-06-04 21:34:11 -07:00
age --decrypt --output "${XDG_CONFIG_HOME}/age/chezmoi.txt" "{{ .chezmoi.sourceDir }}/key.txt.age" || EXIT_CODE=$?
if [ -n "$EXIT_CODE" ]; then
decryptionFailure
else
logg success 'The encryption key was successfully decrypted'
fi
else
installExpect
expect -c "set timeout -1
2023-11-29 20:23:58 -08:00
spawn age --decrypt --output "${XDG_CONFIG_HOME}/age/chezmoi.txt" "${XDG_DATA_HOME:-$HOME/.local/share}/home/key.txt.age"
2023-06-04 21:34:11 -07:00
expect \"Enter passphrase:\"
send \"${AGE_PASSWORD}\r\"
expect eof" > /dev/null || EXIT_CODE=$?
if [ -n "$EXIT_CODE" ]; then
2023-11-04 18:46:18 -07:00
logg info 'There was an issue decrypting the key.txt.age file with the provided AGE_PASSWORD'
2023-06-04 21:34:11 -07:00
decryptionFailure
else
2023-11-04 18:46:18 -07:00
logg info 'The encryption key was successfully decrypted using expect and the provided AGE_PASSWORD'
2023-06-04 21:34:11 -07:00
fi
fi
Update 22 files - /home/.chezmoiscripts/_universal/run_onchange_before_11-install-docker.tmpl - /home/.chezmoiscripts/_universal/run_onchange_before_05-install-homebrew.tmpl - /home/.chezmoiscripts/_universal/run_onchange_before_10-remove-bloatware.tmpl - /home/.chezmoiscripts/_universal/run_onchange_before_08-install-zx.tmpl - /home/.chezmoiscripts/_universal/run_onchange_before_09-ensure-node-version.tmpl - /home/.chezmoiscripts/universal/run_before_01-decrypt-age-key.tmpl - /home/.chezmoiscripts/universal/run_onchange_before_11-install-docker.tmpl - /home/.chezmoiscripts/universal/run_onchange_before_05-install-homebrew.tmpl - /home/.chezmoiscripts/universal/run_onchange_before_10-remove-bloatware.tmpl - /home/.chezmoiscripts/universal/run_onchange_before_08-install-zx.tmpl - /home/.chezmoiscripts/universal/run_onchange_before_09-ensure-node-version.tmpl - /home/.chezmoiscripts/centos/run_onchange_before_10-install-centos-dependencies.tmpl - /home/.chezmoiscripts/centos/run_onchange_before_05-upgrade.tmpl - /home/.chezmoiscripts/fedora/run_onchange_before_10-install-fedora-dependencies.tmpl - /home/.chezmoitemplates/universal/common-dependencies - /home/.chezmoitemplates/universal/profile-inline - /home/.chezmoitemplates/ubuntu/common-dependencies - /home/.chezmoitemplates/opensuse/common-dependencies - /home/.chezmoitemplates/freebsd/common-dependencies - /home/.chezmoitemplates/fedora/common-dependencies - /home/.chezmoitemplates/debian/common-dependencies - /home/.chezmoitemplates/archlinux/common-dependencies
2023-01-30 21:43:15 -08:00
fi
Update .local/share/chezmoi/home/.chezmoiscripts/darwin/run_onchange_after_set-wallpaper.tmpl, .local/share/chezmoi/home/.chezmoiscripts/universal/run_once_before_1-decrypt-age-key.tmpl, .local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_10_install-aqua-packages.sh.tmpl, .local/share/chezmoi/home/.chezmoiscripts/ubuntu/run_onchange_before_10_install-ubuntu-dependencies.tmpl, .local/share/chezmoi/home/.chezmoiscripts/opensuse/run_onchange_before_11-install-opensuse-software.tmpl, .local/share/chezmoi/home/.chezmoiscripts/freebsd/run_onchange_before_11-install-freebsd-packages.tmpl, .local/share/chezmoi/home/.chezmoiscripts/fedora/run_onchange_before_10-install-fedora-dependencies.tmpl, .local/share/chezmoi/home/.chezmoiscripts/debian/run_onchange_before_10-install-debian-dependencies.tmpl, .local/share/chezmoi/home/.chezmoiscripts/darwin/run_onchange_before_10_install-darwin-dependencies.tmpl, .local/share/chezmoi/home/.chezmoiscripts/centos/run_onchange_before_10-install-centos-dependencies.tmpl, .local/share/chezmoi/home/.chezmoiscripts/archlinux/run_onchange_before_10_install-archlinux-dependencies.tmpl, .local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_50-crontab.tmpl, .local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_99_bootstrap-zsh-plugins.tmpl, .local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_80-bash-completions.tmpl, .local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_before_5-install-homebrew.tmpl, .local/share/chezmoi/home/.chezmoiscripts/windows/run_onchange_before_11-install-windows-packages.tmpl
2022-12-01 22:36:57 -08:00
fi
2023-06-04 21:34:11 -07:00
}
### Only run decryption process if HEADLESS_INSTALL variable is not set
if [ -z "$HEADLESS_INSTALL" ]; then
installAge
decryptKey
elif [ -n "$HEADLESS_INSTALL" ] && [ -n "$AGE_PASSWORD" ]; then
installAge
decryptKey
else
2023-11-04 18:46:18 -07:00
logg info 'Skipping Age key decryption process - HEADLESS_INSTALL and AGE_PASSWORD should be passed in as env variables to automate the process'
fi
### Ensure proper permissions on private key
if [ -f "${XDG_CONFIG_HOME}/age/chezmoi.txt" ]; then
logg info 'Ensuring proper permissions on Chezmoi / age decryption key'
logg info 'Chezmoi / age decryption key is stored in '"${XDG_CONFIG_HOME}/age/chezmoi.txt"
chmod 600 "${XDG_CONFIG_HOME}/age/chezmoi.txt"
Update .local/share/chezmoi/home/.chezmoiscripts/darwin/run_onchange_after_set-wallpaper.tmpl, .local/share/chezmoi/home/.chezmoiscripts/universal/run_once_before_1-decrypt-age-key.tmpl, .local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_10_install-aqua-packages.sh.tmpl, .local/share/chezmoi/home/.chezmoiscripts/ubuntu/run_onchange_before_10_install-ubuntu-dependencies.tmpl, .local/share/chezmoi/home/.chezmoiscripts/opensuse/run_onchange_before_11-install-opensuse-software.tmpl, .local/share/chezmoi/home/.chezmoiscripts/freebsd/run_onchange_before_11-install-freebsd-packages.tmpl, .local/share/chezmoi/home/.chezmoiscripts/fedora/run_onchange_before_10-install-fedora-dependencies.tmpl, .local/share/chezmoi/home/.chezmoiscripts/debian/run_onchange_before_10-install-debian-dependencies.tmpl, .local/share/chezmoi/home/.chezmoiscripts/darwin/run_onchange_before_10_install-darwin-dependencies.tmpl, .local/share/chezmoi/home/.chezmoiscripts/centos/run_onchange_before_10-install-centos-dependencies.tmpl, .local/share/chezmoi/home/.chezmoiscripts/archlinux/run_onchange_before_10_install-archlinux-dependencies.tmpl, .local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_50-crontab.tmpl, .local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_99_bootstrap-zsh-plugins.tmpl, .local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_80-bash-completions.tmpl, .local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_before_5-install-homebrew.tmpl, .local/share/chezmoi/home/.chezmoiscripts/windows/run_onchange_before_11-install-windows-packages.tmpl
2022-12-01 22:36:57 -08:00
fi