Adjust Makefile according to changes in previous commits

TODO: Make encryption of any file easier. Decryption is taken care of for all files with .age extension

Makefile

@@ -22,9 +22,8 @@ init:
 	@echo "### Init..."
 	@./require ${DOT_ENV_FILE} alpine_source
 	@./require ${DOT_ENV_FILE} tailspin_bin
-	@./require ${DOT_ENV_FILE} age_bin
 	@echo "### Init done"
-	-@make vault/decrypt
+	@make vault/decrypt
 
 build: repository
 	@echo "### Assembling..."
@@ -41,17 +40,16 @@ build: repository
 	@./src/esh -o ${DIST_DIR}/hotspot.conf src/hotspot.conf ${DOT_ENV_PAIRS}
 	@./src/esh -o ${DIST_DIR}/wg0.conf src/wg0.conf ${DOT_ENV_PAIRS}
 	@cp secrets/*.psk ${DIST_DIR}
-	@cp src/authorized_keys ${DIST_DIR}
+	@cp secrets/authorized_keys ${DIST_DIR}
 	@cp src/config.toml ${DIST_DIR}
 	@cp src/logpattern.conf ${DIST_DIR}
 	@cp src/main.conf ${DIST_DIR}
 	@cp src/rsyslog.conf ${DIST_DIR}
 	@cp src/usercfg.txt ${DIST_DIR}
 	@cp src/watchdog.sh ${DIST_DIR}
-	@cp src/repository-builder/packager.rsa.pub ${DIST_DIR}
+	@cp secrets/packager.rsa.pub ${DIST_DIR}
 	@cp src/repository-builder/${REQUIREMENTS_FILE} ${DIST_DIR}
 	@echo "### Assembling done"
-	@make vault/encrypt
 
 card: clean build
 	@echo "### Copying to sdcard..."
@@ -96,8 +94,8 @@ repository: repository-builder
 		-e BUILDER_KEY_BASENAME=${BUILDER_KEY_BASENAME} \
 		-e BUILDER_UID=${BUILDER_UID} \
 		-e BUILDER_GID=${BUILDER_GID} \
-		-v $(PWD)/src/repository-builder/packager.rsa:/root/.abuild/packager.rsa \
+		-v $(PWD)/secrets/packager.rsa:/root/.abuild/packager.rsa \
-		-v $(PWD)/src/repository-builder/packager.rsa.pub:/root/.abuild/packager.rsa.pub \
+		-v $(PWD)/secrets/packager.rsa.pub:/root/.abuild/packager.rsa.pub \
 		-v $(PWD)/src/repository-builder/abuild.conf:/root/.abuild/abuild.conf \
 		-v ${CACHE_DIR}/aport:/mirror \
 		${BUILDER_DOCKER_IMAGE} build-repository \

require

@@ -1,41 +1,59 @@
 #!/bin/sh
 set -e
 
-# First argument is preprocessed .env file supposed to be in tmp.build.XXXXXXXXXX directory
+# If number of arguments not equal to two
-# Let's load it up
+if [ $# -ne 2 ] ; then
-. $1
+  echo "invalid argument"
+  exit 1
+fi
+
+DOT_ENV_FILE="$1"
+FUNCTION_TO_CALL="$2"
 
 alpine_source() {
-  find ${CACHE_DIR} -type f -name ${RELEASE_BASENAME}.tar.gz | grep -q ${RELEASE_BASENAME} || \
+  find "$CACHE_DIR" -name "$RELEASE_BASENAME.tar.gz" -type f | grep -q . || \
-  curl -sSL ${ALPINE_MIRROR}/${RELEASE_VERSION}/releases/${ALPINE_ARCH}/${RELEASE_BASENAME}.tar.gz -o ${CACHE_DIR}/${RELEASE_BASENAME}.tar.gz
+  wget "$ALPINE_MIRROR/$RELEASE_VERSION/releases/$ALPINE_ARCH/$RELEASE_BASENAME.tar.gz" -O "$CACHE_DIR/$RELEASE_BASENAME.tar.gz"
 
-  mkdir -p ${CACHE_DIR}/${RELEASE_BASENAME}
+  mkdir -p "$CACHE_DIR/$RELEASE_BASENAME"
 
-  find ${CACHE_DIR}/${RELEASE_BASENAME} -type d -empty -exec tar xfz ${CACHE_DIR}/${RELEASE_BASENAME}.tar.gz -C ${CACHE_DIR}/${RELEASE_BASENAME} \;
+  find "$CACHE_DIR" -name "$RELEASE_BASENAME" -type d -empty -exec \
+  tar --directory "$CACHE_DIR/$RELEASE_BASENAME" --extract --gzip --same-permissions --strip 1 --file="$CACHE_DIR/$RELEASE_BASENAME.tar.gz" \;
 }
 
 tailspin_bin() {
-  find ${CACHE_DIR} -type f -name tailspin.tar.gz | grep -q tailspin || \
+  find "$CACHE_DIR" -name tailspin.tar.gz -type f | grep -q . || \
-  curl -sSL https://github.com/bensadeh/tailspin/releases/download/4.0.0/tailspin-x86_64-unknown-linux-musl.tar.gz -o ${CACHE_DIR}/tailspin.tar.gz
+  wget https://github.com/bensadeh/tailspin/releases/download/4.0.0/tailspin-x86_64-unknown-linux-musl.tar.gz -O "$CACHE_DIR/tailspin.tar.gz"
 
-  mkdir -p ${CACHE_DIR}/tailspin
+  mkdir -p "$CACHE_DIR/tailspin"
 
-  find ${CACHE_DIR}/tailspin -type d -empty -exec tar xfz ${CACHE_DIR}/tailspin.tar.gz -C ${CACHE_DIR}/tailspin \;
+  find "$CACHE_DIR/tailspin" -type d -empty -exec tar xz -f "$CACHE_DIR/tailspin.tar.gz" -C "$CACHE_DIR/tailspin" \;
 }
 
-age_bin() {
+# Private function names start with underscore
-  find ${CACHE_DIR} -type d -name age-src | grep -q age-src || \
+_init() {
-  git clone https://github.com/wj/age.git ${CACHE_DIR}/age-src
+  . "$DOT_ENV_FILE"
-
-  mkdir -p ${CACHE_DIR}/age
-
-  find ${CACHE_DIR}/age -type d -empty -exec docker run --rm -v ${CACHE_DIR}/age:/usr/local/bin -e GOBIN=/usr/local/bin/ -v ${CACHE_DIR}/age-src:/usr/src/age -w /usr/src/age golang:1.22-alpine go install ./cmd/age \;
-}
 
+  mkdir -p "$CACHE_DIR/aport"
+  mkdir -p "$CACHE_DIR/extras"
   mkdir -p secrets
-mkdir -p ${CACHE_DIR}/aport
+}
-mkdir -p ${CACHE_DIR}/extras
 
-# Second argument is supposed to be name of the functions decalred above
+# Second argument is supposed to be name of one of the functions declared above
-# Let's call it
+# functions starting with underscore are ignored (considered private)
-$2
+FUNCTIONS=$(cat "$0" | awk '/\(\) {/ {print $1}' | rev | cut -c3- | rev | grep "^[^_]")
+FOUND_FN=0
+for FN in $FUNCTIONS; do
+  if [ "$FN" = "$FUNCTION_TO_CALL" ]; then
+    FOUND_FN=1
+  fi
+done
+
+if [ $FOUND_FN -eq 1 ]; then
+  _init
+
+  echo "Calling $FUNCTION_TO_CALL"
+  $FUNCTION_TO_CALL
+else
+  echo "invalid argument"
+  exit 1
+fi

src/hotspot.conf

@@ -2,7 +2,7 @@
 DisableHT=true
 
 [Security]
-Passphrase=<% cat src/wifi-password.txt %>
+Passphrase=<% cat secrets/wifi-password.txt %>
 
 [IPv4]
 Address=<%= $wlan0_address %>

src/repository-builder/repository.Dockerfile

@@ -1,4 +1,3 @@
-# syntax = docker/dockerfile:1
 ARG ALPINE_DOCKER_IMAGE
 FROM $ALPINE_DOCKER_IMAGE
 

src/wg0.conf

@@ -1,12 +1,12 @@
 [Interface]
 ListenPort = <%= $wg_port %>
-PrivateKey = <%= $(cat src/wireguard.private.key) %>
+PrivateKey = <%= $(cat secrets/wireguard.private.key) %>
 Address = <%= $wg0_address %>
 DNS = <%= $wg0_gateway %>
 MTU = 1280
 
 [Peer]
-PublicKey = <%= $(cat src/wireguard.public.key) %>
+PublicKey = <%= $(cat secrets/wireguard.public.key) %>
 Endpoint = <%= $wg_server %>:<%= $wg_port %>
 AllowedIPs = 0.0.0.0/0
 PersistentKeepalive = 25

vault

@@ -1,38 +1,38 @@
 #!/bin/sh
 set -e
 
-FILES_IN_VAULT='./src/wifi-password.txt
+FILES_IN_VAULT=$(find . -name *.age)
-./src/repository-builder/packager.rsa
-./src/repository-builder/packager.rsa.pub
-./src/wireguard.private.key
-./src/wireguard.public.key
-./src/authorized_keys'
 
 age_encrypt() {
-  local input="$1"
+  if [ $# -ne 1 ] ; then
-  local output="$1.tmp"
+    echo "invalid argument"
-  local AGE_PASSPHRASE=`cat ./.vault_password_file`
+    exit 1
+  fi
 
-  ./cache/age/age --encrypt --passphrase --armor --output $output $input && rm $input && mv $output $input
+  AGE_PASSPHRASE=$(cat ./.vault_password_file) age --encrypt --passphrase --armor --output "$2" "$1"
 }
 
 age_decrypt() {
-  local input="$1"
+  if [ $# -ne 1 ] ; then
-  local output="$1.tmp"
+    echo "invalid argument"
-  local AGE_PASSPHRASE=`cat ./.vault_password_file`
+    exit 1
+  fi
 
-  ./cache/age/age --decrypt --output $output $input && rm $input && mv $output $input
+  BASENAME=$(basename $1 .age)
+
+  AGE_PASSPHRASE=$(cat ./.vault_password_file) age --decrypt --output "secrets/$BASENAME" "$1"
 }
 
+
 encrypt() {
   for FILE in $FILES_IN_VAULT; do
-    age_encrypt $FILE
+    age_encrypt "$FILE"
   done
 }
 
 decrypt() {
   for FILE in $FILES_IN_VAULT; do
-    age_decrypt $FILE
+    age_decrypt "$FILE"
   done
 }