blob: 33a1e3e1afc9d9910f849b52159274c80b58b6be (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
|
{ pkgs, ... }:
let
nomad-prod = pkgs.writeShellScriptBin "nomad-prod" ''
set -e
if [ $# -ne 1 ]; then
echo "Usage: nomad-ui CELL_ID"
exit 1
fi
CELL_ID=$1
echo ">> Login to chi1 vault using Okta"
export VAULT_ADDR="https://chi1-vault.simulprod.com:8200"
export VAULT_TOKEN=$(${pkgs.vault}/bin/vault login -field=token -method=oidc username=$USER)
echo ">> Accessing cell $CELL_ID"
export NOMAD_ADDR="https://$CELL_ID-nomad.simulprod.com"
export NOMAD_TOKEN=$(${pkgs.vault}/bin/vault read -field secret_id ''${CELL_ID}_nomad/creds/management)
${pkgs.nomad}/bin/nomad ui --authenticate
'';
in
{
imports = [
./gh.nix
./k8s.nix
];
home.packages = with pkgs; [
awscli2
boundary # for secure remote access
hashi
sapi
nomad-prod
tfswitch
vault
];
programs.fish = {
shellAbbrs =
let
environments = [
{
name = "chi1";
alias = "chi1";
jumpHost = "chi1-jumpcontainer-es";
}
{
name = "ash1";
alias = "ash1";
jumpHost = "chi1-jumpcontainer-es";
}
{
name = "sitetest3";
alias = "st3";
jumpHost = "st3-jumpcontainer-es";
}
{
name = "sitetest2-snc2";
alias = "st2-snc2";
jumpHost = "st2-snc2-jumpcontainer-es";
}
];
# Generate all environment-specific aliases
envAliases = builtins.listToAttrs (
builtins.concatMap (env: [
{
name = "ssh-sign-${env.alias}";
value = "${pkgs.hashi}/bin/hashi -e ${env.name} sign --output-path=/Users/fcuny/.ssh/cert-${env.alias} --key=(${pkgs._1password-cli}/bin/op read 'op://employee/default rbx ssh key/public key'|psub) key";
}
{
name = "hashi-${env.alias}";
value = "${pkgs.hashi}/bin/hashi -e ${env.name} show v";
}
{
name = "ssh-${env.alias}";
value = "ssh -o StrictHostKeyChecking=no -J ${env.jumpHost} -o 'CertificateFile=~/.ssh/cert-${env.alias}'";
}
]) environments
);
# Add any additional non-environment specific aliases
additionalAliases = {
"sjump-st1-snc2" = "${pkgs.sapi}/bin/sapi jump sitetest1-snc2";
"sjump-st1-snc3" = "${pkgs.sapi}/bin/sapi jump sitetest3-snc2";
"sjump-st2-snc2" = "${pkgs.sapi}/bin/sapi jump sitetest2-snc2";
"sjump-st3" = "${pkgs.sapi}/bin/sapi jump sitetest3";
"sjump" = "${pkgs.sapi}/bin/sapi jump";
"ssh-edge" =
"ssh -o StrictHostKeyChecking=no -o IdentitiesOnly=yes -J chi1-jumpcontainer-es -i (${pkgs._1password-cli}/bin/op read 'op://Infra-Compute-Edge-rks/ice_ssh-private-key/ice_rsa'|psub)";
};
in
envAliases // additionalAliases;
};
# the configuration for sapi is generated when we run `sapi jump`, there's no need to manage it with nix.
programs.ssh.includes = [ "config_sapi" ];
}
|
