66 lines
2.7 KiB
Bash
Executable File
66 lines
2.7 KiB
Bash
Executable File
#!/usr/bin/env nix
|
|
#!nix shell
|
|
#!nix nixpkgs#git
|
|
#!nix nixpkgs#bfg-repo-cleaner
|
|
#!nix nixpkgs#bash --command bash
|
|
|
|
REPO_NAME=schallerclan
|
|
BRANCH_TO_PUBLISH=main
|
|
REMOTE_URL=gitea@git.clan.lol:dafitt/schallerclan.git
|
|
|
|
export INFO="\e[1;34m INFO\e[0m"
|
|
export SUCCESS="\e[1;32m SUCCESS\e[0m"
|
|
export ERROR="\e[1;31m ERROR\e[0m"
|
|
shopt -s expand_aliases
|
|
alias echo="echo -e"
|
|
|
|
if [ "$(basename $(git rev-parse --show-toplevel))" != "$REPO_NAME" ]; then
|
|
echo "$ERROR This script is meant to be run from the $REPO_NAME repository root!"
|
|
exit 1
|
|
fi
|
|
|
|
if [ -d /tmp/$REPO_NAME ]; then
|
|
echo "$INFO Cleaning up old /tmp/$REPO_NAME..."
|
|
rm -rf /tmp/$REPO_NAME
|
|
fi
|
|
|
|
echo "$INFO Cloning repository to /tmp..."
|
|
git clone --single-branch --branch $BRANCH_TO_PUBLISH -- . /tmp/$REPO_NAME
|
|
cd /tmp/$REPO_NAME
|
|
git remote remove origin
|
|
|
|
echo "$INFO Cleaning up workspace..."
|
|
git reset --hard # unstage all changes
|
|
git clean -df # remove unstaged files
|
|
|
|
echo "$INFO bfg: Removing files {*.age,*.zone,*publi.sh,clients.nix,persons.nix,groups.nix}..."
|
|
bfg --no-blob-protection --delete-files "{*.age,*.zone,*publi.sh,clients.nix,persons.nix,groups.nix}" /tmp/$REPO_NAME/.git
|
|
|
|
echo "$INFO bfg: Removing folders {sops,vars}..."
|
|
bfg --no-blob-protection --delete-folders "{sops,vars}" /tmp/$REPO_NAME/.git
|
|
|
|
echo "$INFO bfg: Searching and replacing sensitive text..."
|
|
cat <<EOF >replace-text.txt
|
|
regex:[a-z0-9]{64}+==>***REMOVED_PUBKEY***
|
|
regex:([a-f0-9:]+:+)+[a-f0-9]+==>***REMOVED_IPv6***
|
|
regex:\\\$[[:alnum:]\\\$\/\.]{59,}==>***REMOVED_HASH***
|
|
regex:([a-zA-Z0-9+\/]{43,}=)==>***REMOVED_WIREGUARD-KEY***
|
|
regex:([A-Z0-9]{7}-){7}[A-Z0-9]{7}==>***REMOVED_SYNCTHING-ID***
|
|
regex:(ssh-dss AAAAB3NzaC1kc3|ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNT|sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb2|ssh-ed25519 AAAAC3NzaC1lZDI1NTE5|sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29t|ssh-rsa AAAAB3NzaC1yc2)[0-9A-Za-z+\/]+[=]{0,3}==>***REMOVED_SSH-PUBLICKEY***
|
|
regex:((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.?\b){4}==>***REMOVED_IPv4***
|
|
regex:tail[[:alnum:]]{6}.ts.net==>***REMOVED_TAILSCALE_DOMAIN***
|
|
EOF
|
|
bfg --no-blob-protection \
|
|
--filter-content-excluding "{dns.nix,poweroff.nix,sleep.nix,quadlets.nix,tailscale.nix,users.nix,wakeonlan.nix,.template.nix,whoami.nix,flake.nix,flake.lock,README.md}" \
|
|
--replace-text replace-text.txt /tmp/$REPO_NAME/.git
|
|
|
|
echo "$INFO Wrapping up..."
|
|
git reset --hard # unstage all changes
|
|
git clean -df # remove unstaged files
|
|
git reflog expire --expire=now --all && git gc --prune=now --aggressive
|
|
|
|
echo "$INFO Force-pushing repository to '$REMOTE_URL'..."
|
|
git push --force --set-upstream $REMOTE_URL $BRANCH_TO_PUBLISH
|
|
|
|
echo "$SUCCESS !"
|