62 lines
2.7 KiB
Bash
Executable File
62 lines
2.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Renews the gateway's T3 sessions, which last 30 days and cannot be refreshed. For each host it
|
|
# makes a one-time pairing credential on that host and hands it straight to `wristcode host add`
|
|
# on the gateway, so the credential is never printed. Run it from a machine that can SSH to every
|
|
# host by name. The watch warns a week before a session expires.
|
|
#
|
|
# scripts/renew-hosts.sh renew every host in hosts.conf
|
|
# scripts/renew-hosts.sh "Mac mini" renew one host by label
|
|
set -euo pipefail
|
|
|
|
# The host list and gateway settings live in hosts.conf beside this script, which git ignores.
|
|
# Copy hosts.conf.example to start one.
|
|
CONFIG="${RENEW_HOSTS_CONFIG:-$(dirname "$0")/hosts.conf}"
|
|
[ -f "$CONFIG" ] || { echo "No $CONFIG. Copy hosts.conf.example and fill it in." >&2; exit 1; }
|
|
# shellcheck source=hosts.conf.example
|
|
source "$CONFIG"
|
|
GATEWAY_RUNTIME="${GATEWAY_RUNTIME:-podman}"
|
|
GATEWAY_CONTAINER="${GATEWAY_CONTAINER:-wristcode-gateway}"
|
|
|
|
# Prints a pairing credential. Runs on the T3 host. The CLI is not on PATH in non-login shells,
|
|
# so it looks where T3 Code installs it.
|
|
MINT='
|
|
set -e
|
|
export T3CODE_HOME="${T3CODE_HOME:-$HOME/.t3}"
|
|
for candidate in "$(command -v t3 || true)" "$HOME/.t3/bin/t3" "$HOME/.local/bin/t3" $(ls -d "$HOME"/.t3/runtime/versions/*/t3 2>/dev/null | sort -V -r); do
|
|
if [ -n "$candidate" ] && [ -x "$candidate" ]; then t3="$candidate"; break; fi
|
|
done
|
|
[ -n "${t3:-}" ] || { echo "no t3 CLI found" >&2; exit 1; }
|
|
"$t3" auth pairing create --scope orchestration:read --scope orchestration:operate \
|
|
--label "WristCode gateway" --ttl 10m --json |
|
|
sed -n "s/.*\"credential\": *\"\\([^\"]*\\)\".*/\\1/p"
|
|
'
|
|
|
|
renew() {
|
|
local label="$1" ssh_host="$2" url alternates alternate credential alt_args=""
|
|
read -r url alternates <<<"$3"
|
|
for alternate in $alternates; do alt_args+=" --alt-url '$alternate'"; done
|
|
if [ "$ssh_host" = "local" ]; then
|
|
credential="$(bash -c "$MINT")"
|
|
else
|
|
credential="$(ssh -o BatchMode=yes "$ssh_host" "bash -s" <<<"$MINT")"
|
|
fi
|
|
if [ -z "$credential" ]; then
|
|
echo "$label: could not make a pairing credential" >&2
|
|
return 1
|
|
fi
|
|
# The credential travels on stdin, not on a command line other processes could read.
|
|
ssh -o BatchMode=yes "$GATEWAY_SSH" \
|
|
"read -r credential && $GATEWAY_RUNTIME exec $GATEWAY_CONTAINER wristcode host add '$url' \"\$credential\" --label '$label'$alt_args" \
|
|
<<<"$credential"
|
|
}
|
|
|
|
failed=0
|
|
for entry in "${HOSTS[@]}"; do
|
|
IFS='|' read -r label ssh_host url <<<"$entry"
|
|
if [ $# -gt 0 ] && [ "$1" != "$label" ]; then continue; fi
|
|
renew "$label" "$ssh_host" "$url" || failed=1
|
|
done
|
|
|
|
ssh -o BatchMode=yes "$GATEWAY_SSH" "$GATEWAY_RUNTIME exec $GATEWAY_CONTAINER wristcode host list" | cut -f1,4
|
|
exit "$failed"
|