diff --git a/metznet/aws.scm b/metznet/aws.scm new file mode 100644 index 0000000..1b04457 --- /dev/null +++ b/metznet/aws.scm @@ -0,0 +1,91 @@ +(define-module (metznet aws) + + #:use-module (gnu services) + #:use-module (guix gexp) + #:use-module (guix modules) + #:use-module (gnu services shepherd) + #:use-module (gnu packages certs) + #:use-module (guix build download) + + #:export (aws-service-type)) + +(define guile-json + (module-ref (resolve-interface '(gnu packages guile)) + 'guile-json-4)) + +(define guile-zlib + (module-ref (resolve-interface '(gnu packages guile)) + 'guile-zlib)) + +(define gnutls + (module-ref (resolve-interface '(gnu packages tls)) + 'gnutls)) + +(define aws-pubkey-prog + (program-file "aws-pubkey" + (with-imported-modules (source-module-closure '((ice-9 receive) + (guix build + utils) + (guix build + download) + (web uri) + (ice-9 + binary-ports) + (web client))) + + (with-extensions (list guile-json + gnutls + guile-zlib) + #~(begin + (use-modules (ice-9 + receive) + (guix + build + download) + (web + uri) + (web + client) + (ice-9 + binary-ports)) + (call-with-output-file "/etc/ssh/authorized_keys.d/aws" + (lambda (port) + (begin + (format (current-error-port) + "opened-file\n") + (put-bytevector + port + (receive (header + body) + (let ((uri + "http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key")) + (http-get + uri + #:port (open-connection-for-uri + (string->uri + uri) + #:timeout + 5) + #:decode-body? + #f)) + body)))))))))) + +;; this should really be an extension of the openssh service +(define (aws-pubkey-service config) + (list (shepherd-service (documentation "") + (provision '(aws-pubkey)) + (requirement '(networking user-processes)) + (one-shot? #t) + (respawn? #t) + (start #~(make-forkexec-constructor (list #$aws-pubkey-prog)))))) + +(define-public aws-service-type + (service-type (name 'aws) + (description "AWS public key service") + (extensions (list (service-extension profile-service-type + (lambda (val) + val)) + (service-extension + shepherd-root-service-type + aws-pubkey-service))) + (default-value (list le-certs nss-certs)))) diff --git a/metznet/system/base-system.scm b/metznet/system/base-system.scm index 26397b4..ea34604 100644 --- a/metznet/system/base-system.scm +++ b/metznet/system/base-system.scm @@ -165,23 +165,7 @@ (define-configuration/no-serialization metznet-system-configuration (certs (file-like le-certs) "certificate package") - (vpn-ta-key (file-like (computed-file - "ta.key" - (with-imported-modules ' - ((guix build - utils)) - #~(begin - (use-modules - (guix - build - utils)) - (invoke #$ - (file-append - openvpn - "/sbin/openvpn") - "--genkey" - "secret" - #$output))))) + (vpn-ta-key (file-like (local-file (or (getenv "VPN_TA") "pki/ta.key"))) "ta.key for openvpn") (vpn-ca (file-like (local-file (or (getenv "VPN_CA")