78 lines
2.9 KiB
Cheetah
78 lines
2.9 KiB
Cheetah
#!/usr/bin/env bash
|
|
# run_once_setup-ssh-keys.sh.tmpl
|
|
# Pulls SSH PRIVATE keys from Bitwarden and writes them to ~/.ssh/.
|
|
#
|
|
# Public keys (.pub files) are committed directly to the repo in dot_ssh/
|
|
# and are applied automatically by chezmoi — no Bitwarden needed for those.
|
|
#
|
|
# Requires: bw (Bitwarden CLI) to be logged in and unlocked.
|
|
# To unlock Bitwarden before running chezmoi:
|
|
# export BW_SESSION=$(bw unlock --raw)
|
|
# chezmoi apply
|
|
|
|
set -euo pipefail
|
|
|
|
echo "==> Setting up SSH keys from Bitwarden..."
|
|
|
|
SSH_DIR="$HOME/.ssh"
|
|
mkdir -p "$SSH_DIR"
|
|
chmod 700 "$SSH_DIR"
|
|
|
|
write_key() {
|
|
local name="$1"
|
|
local bw_item_name="$2"
|
|
local key_path="$SSH_DIR/$name"
|
|
|
|
if [ -f "$key_path" ]; then
|
|
echo " Key already exists: $name (skipping)"
|
|
return
|
|
fi
|
|
|
|
echo " Fetching key: $bw_item_name -> $name"
|
|
# bw get notes "Item Name" returns the secure note content
|
|
bw get notes "$bw_item_name" 2>/dev/null > "$key_path" || {
|
|
echo " WARNING: Could not fetch '$bw_item_name' from Bitwarden. Skipping."
|
|
rm -f "$key_path"
|
|
return
|
|
}
|
|
|
|
if [ ! -s "$key_path" ]; then
|
|
echo " WARNING: Key content was empty for '$bw_item_name'. Removing."
|
|
rm -f "$key_path"
|
|
return
|
|
fi
|
|
|
|
chmod 600 "$key_path"
|
|
echo " Wrote: $key_path"
|
|
}
|
|
|
|
# --- Add your SSH keys below ---
|
|
# Format: write_key "filename_in_~/.ssh" "Bitwarden secure note name"
|
|
#
|
|
# Example:
|
|
# write_key "stevan@freeborn.cloud" "SSH Key - stevan@freeborn.cloud"
|
|
# write_key "ftp_stevanfreeborn_com" "SSH Key - ftp_stevanfreeborn_com"
|
|
# write_key "tangled" "SSH Key - tangled"
|
|
# write_key "tinker" "SSH Key - tinker"
|
|
# write_key "gitea.freeborn.cloud" "SSH Key - gitea.freeborn.cloud"
|
|
|
|
write_key "bit_bastion.key" "SSH Key - bit_bastion.key"
|
|
write_key "stevan@freeborn.cloud" "SSH Key - stevan@freeborn.cloud"
|
|
write_key "ftp_stevanfreeborn_com" "SSH Key - ftp_stevanfreeborn_com"
|
|
write_key "tangled" "SSH Key - tangled"
|
|
write_key "zenbook_tinker" "SSH Key - zenbook_tinker"
|
|
write_key "gitea.freeborn.cloud" "SSH Key - gitea.freeborn.cloud"
|
|
write_key "id_ed25519" "SSH Key - id_ed25519"
|
|
write_key "macbookair" "SSH Key - macbookair"
|
|
write_key "macbookpro" "SSH Key - macbookpro"
|
|
write_key "truenas" "SSH Key - truenas"
|
|
write_key "blog.stevanfreeborn.com_github_actions" "SSH Key - blog.stevanfreeborn.com_github_actions"
|
|
write_key "commands_github_actions" "SSH Key - commands_github_actions"
|
|
write_key "onspring_qa_playwright_reports_render" "SSH Key - onspring_qa_playwright_reports_render"
|
|
write_key "onx_graph_github_actions" "SSH Key - onx_graph_github_actions"
|
|
write_key "restapiplayground.stevanfreeborn.com_github_actions" "SSH Key - restapiplayground.stevanfreeborn.com_github_actions"
|
|
write_key "steves_bot_github_actions" "SSH Key - steves_bot_github_actions"
|
|
|
|
echo "==> SSH key setup complete!"
|
|
echo " NOTE: Store your SSH private keys as Bitwarden Secure Notes with the names listed above."
|