Added documentation to /docs and other misc. fixes

2023-08-08 03:06:49 -04:00

6 KiB

Raw Blame History

title	description	sidebar_label	slug	githubLocation	scriptLocation	repoLocation
Chezmoi-Age Secret Decryption	Ensures `age` is installed and then decrypts the `home/key.txt.age` file so that Chezmoi can utilize encrypted files	02 Chezmoi-Age Secret Decryption	/scripts/before/run_before_02-decrypt-age-key.sh.tmpl	https://github.com/megabyte-labs/install.doctor/blob/master/home/.chezmoiscripts/universal/run_before_02-decrypt-age-key.sh.tmpl	https://github.com/megabyte-labs/install.doctor/raw/master/home/.chezmoiscripts/universal/run_before_02-decrypt-age-key.sh.tmpl	home/.chezmoiscripts/universal/run_before_02-decrypt-age-key.sh.tmpl

Chezmoi-Age Secret Decryption

Ensures age is installed and then decrypts the home/key.txt.age file so that Chezmoi can utilize encrypted files

Overview

This script begins by ensuring age is installed, the defualt program Chezmoi utilizes for handling encryption. The script then allows you to generate the decrypted ~/.config/age/chezmoi.txt file by prompting you for the password to home/key.txt.age which is the encrypted encryption key file for using Chezmoi to add encrypted files to your Install Doctor fork. If no password is passed to the decryption password prompt, then all of the encrypted_ files in the fork are deleted so that Chezmoi does not try to decrypt files without a decryption key file.

Headless Installs

If you do not want the script to prompt you for a password, then you can pass in an environment variable with HEADLESS_INSTALL=true. This variable ensures that nothing requiring input from the user blocks the provisioning process. If you want to automate a headless install that requires access to encrypted_ files and encrypted variables, then you can save the decrypted Age key to ~/.config/age/chezmoi.txt prior to running bash <(curl -sSL https://install.doctor/start).

GPG

It is also possible to configure Chezmoi to utilize GPG instead of Age. This might be beneficial if you want to use a smart card / YubiKey for hardware-backed encryption. Otherwise, Age is a great encryption tool.

Notes

It is possible that hardware-based smart-card-like GPG encryption might not work properly with Chezmoi yet. Learned this by attempting to use a YubiKey GPG setup using this guide and trying to get it to work with Chezmoi.

Source Code

#!/usr/bin/env bash
# @file Chezmoi-Age Secret Decryption
# @brief Ensures `age` is installed and then decrypts the `home/key.txt.age` file so that Chezmoi can utilize encrypted files
# @description
#     This script begins by ensuring `age` is installed, the defualt program Chezmoi utilizes for handling encryption.
#     The script then allows you to generate the decrypted `~/.config/age/chezmoi.txt` file by prompting you for the password
#     to `home/key.txt.age` which is the encrypted encryption key file for using Chezmoi to add encrypted files to your Install
#     Doctor fork. If no password is passed to the decryption password prompt, then all of the `encrypted_` files in the fork
#     are deleted so that Chezmoi does not try to decrypt files without a decryption key file.
#
#     ## Headless Installs
#
#     If you do not want the script to prompt you for a password, then you can pass in an environment variable with
#     `HEADLESS_INSTALL=true`. This variable ensures that nothing requiring input from the user blocks the provisioning process.
#     If you want to automate a headless install that requires access to `encrypted_` files and encrypted variables, then
#     you can save the decrypted Age key to `~/.config/age/chezmoi.txt` prior to running `bash <(curl -sSL https://install.doctor/start)`.
#
#     ## GPG
#
#     It is also possible to configure Chezmoi to utilize GPG instead of Age. This might be beneficial if you want to
#     use a smart card / YubiKey for hardware-backed encryption. Otherwise, Age is a great encryption tool.
#
#     ## Notes
#
#     _It is possible that hardware-based smart-card-like GPG encryption might not work properly with Chezmoi yet.
#     Learned this by attempting to use a YubiKey GPG setup using [this guide](https://github.com/drduh/YubiKey-Guide) and trying to get it to work with Chezmoi._

{{ includeTemplate "universal/logg-before" }}
{{ includeTemplate "universal/profile-before" }}

### Only run decryption process if HEADLESS_INSTALL variable is not set
if [ -z "$HEADLESS_INSTALL" ]; then
  ### Install Age via Homebrew if not present
  if ! command -v age > /dev/null; then
    if command -v brew > /dev/null; then
      logg info 'Running `brew install age`'
      brew install age
    else
      logg warn '`age` is not installed which is utilized in the decryption process'
    fi
  fi

  ### Decrypt private key if it is not already present
  if command -v age > /dev/null; then
    if [ ! -f "${XDG_CONFIG_HOME}/age/chezmoi.txt" ]; then
      mkdir -p "${XDG_CONFIG_HOME}/age"
      logg star '`PRESS ENTER` if you have not set up your encryption token yet'
      age --decrypt --output "${XDG_CONFIG_HOME}/age/chezmoi.txt" "{{ .chezmoi.sourceDir }}/key.txt.age" || EXIT_CODE=$?
      if [ -n "$EXIT_CODE" ]; then
        logg info 'Proceeding without decrypting age encryption key stored at `~/.local/share/chezmoi/home/key.txt.age`'
        logg info 'To have Chezmoi handle your encryption (so you can store your private files publicly) take a look at https://shorturl.at/jkpzG'
        logg info 'Removing all files that begin with encrypted_ because decryption failed'
        find "$HOME/.local/share/chezmoi" -type f -name "encrypted_*" | while read ENCRYPTED_FILE; do
          logg info "Removing $ENCRYPTED_FILE"
          rm -f "$ENCRYPTED_FILE"
        done
      fi
    fi
  fi
fi

### Ensure proper permissions on private key
if [ -f "${XDG_CONFIG_HOME}/age/chezmoi.txt" ]; then
  logg info 'Ensuring proper permissions on Chezmoi / age decryption key'
  logg info 'Chezmoi / age decryption key is stored in '"${XDG_CONFIG_HOME}/age/chezmoi.txt"
  chmod 600 "${XDG_CONFIG_HOME}/age/chezmoi.txt"
fi

6 KiB Raw Blame History