Initial commit: VaultMesh Skills collection
Collection of operational skills for VaultMesh infrastructure including: - backup-sovereign: Backup and recovery operations - btc-anchor: Bitcoin anchoring - cloudflare-tunnel-manager: Cloudflare tunnel management - container-registry: Container registry operations - disaster-recovery: Disaster recovery procedures - dns-sovereign: DNS management - eth-anchor: Ethereum anchoring - gitea-bootstrap: Gitea setup and configuration - hetzner-bootstrap: Hetzner server provisioning - merkle-forest: Merkle tree operations - node-hardening: Node security hardening - operator-bootstrap: Operator initialization - proof-verifier: Cryptographic proof verification - rfc3161-anchor: RFC3161 timestamping - secrets-vault: Secrets management 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
Vault Sovereign
82
operator-bootstrap/scripts/rollback/undo_gitops.sh
Executable file
82
operator-bootstrap/scripts/rollback/undo_gitops.sh
Executable file
@@ -0,0 +1,82 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
# === METADATA ===
|
||||
SCRIPT_NAME="$(basename "$0")"
|
||||
|
||||
# === CONFIGURATION ===
|
||||
: "${GITOPS_ROOT:=$HOME/infrastructure}"
|
||||
|
||||
# === FUNCTIONS ===
|
||||
log_info() { echo "[INFO] $(date -Iseconds) $*"; }
|
||||
log_warn() { echo "[WARN] $(date -Iseconds) $*" >&2; }
|
||||
|
||||
main() {
|
||||
log_info "Starting $SCRIPT_NAME - ROLLBACK GitOps..."
|
||||
|
||||
# Expand ~
|
||||
GITOPS_ROOT="${GITOPS_ROOT/#\~/$HOME}"
|
||||
|
||||
echo ""
|
||||
echo "============================================"
|
||||
echo " GITOPS ROLLBACK"
|
||||
echo " Root: $GITOPS_ROOT"
|
||||
echo "============================================"
|
||||
echo ""
|
||||
|
||||
# Check what exists
|
||||
local repos_found=0
|
||||
for repo in config secrets manifests; do
|
||||
if [[ -d "$GITOPS_ROOT/${repo}.git" ]]; then
|
||||
echo " Found: ${repo}.git"
|
||||
((repos_found++))
|
||||
fi
|
||||
done
|
||||
|
||||
if [[ $repos_found -eq 0 ]]; then
|
||||
log_info "No GitOps repositories found - nothing to rollback"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "This will ARCHIVE (not delete) the repositories to:"
|
||||
echo " $GITOPS_ROOT/archived-$(date +%Y%m%d%H%M%S)/"
|
||||
echo ""
|
||||
|
||||
read -p "Type 'CONFIRM' to proceed: " confirm
|
||||
|
||||
if [[ "$confirm" != "CONFIRM" ]]; then
|
||||
log_info "Aborted - no changes made"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Create archive directory
|
||||
local archive_dir="$GITOPS_ROOT/archived-$(date +%Y%m%d%H%M%S)"
|
||||
mkdir -p "$archive_dir"
|
||||
|
||||
# Move repositories to archive
|
||||
for repo in config secrets manifests; do
|
||||
if [[ -d "$GITOPS_ROOT/${repo}.git" ]]; then
|
||||
mv "$GITOPS_ROOT/${repo}.git" "$archive_dir/"
|
||||
log_info "Archived: ${repo}.git -> $archive_dir/"
|
||||
fi
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo "============================================"
|
||||
echo " GITOPS ROLLBACK COMPLETE"
|
||||
echo "============================================"
|
||||
echo ""
|
||||
echo "Repositories archived to: $archive_dir"
|
||||
echo ""
|
||||
echo "To permanently delete:"
|
||||
echo " rm -rf $archive_dir"
|
||||
echo ""
|
||||
echo "To restore:"
|
||||
echo " mv $archive_dir/*.git $GITOPS_ROOT/"
|
||||
echo ""
|
||||
|
||||
log_info "Completed $SCRIPT_NAME"
|
||||
}
|
||||
|
||||
[[ "${BASH_SOURCE[0]}" == "$0" ]] && main "$@"
|
||||
76
operator-bootstrap/scripts/rollback/undo_identity.sh
Executable file
76
operator-bootstrap/scripts/rollback/undo_identity.sh
Executable file
@@ -0,0 +1,76 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
# === METADATA ===
|
||||
SCRIPT_NAME="$(basename "$0")"
|
||||
|
||||
# === CONFIGURATION ===
|
||||
: "${NODE_NAME:=node-a}"
|
||||
: "${OPERATOR_EMAIL:=}"
|
||||
|
||||
# === FUNCTIONS ===
|
||||
log_info() { echo "[INFO] $(date -Iseconds) $*"; }
|
||||
log_warn() { echo "[WARN] $(date -Iseconds) $*" >&2; }
|
||||
log_error() { echo "[ERROR] $(date -Iseconds) $*" >&2; }
|
||||
|
||||
main() {
|
||||
log_info "Starting $SCRIPT_NAME - ROLLBACK identity..."
|
||||
|
||||
echo ""
|
||||
echo "============================================"
|
||||
echo " IDENTITY ROLLBACK"
|
||||
echo " WARNING: This will remove GPG and SSH keys!"
|
||||
echo "============================================"
|
||||
echo ""
|
||||
echo "This will:"
|
||||
echo " - Remove SSH keys: ~/.ssh/id_*_${NODE_NAME}*"
|
||||
echo " - Restore SSH config from backup"
|
||||
if [[ -n "$OPERATOR_EMAIL" ]]; then
|
||||
echo " - Prompt for GPG key removal (manual step)"
|
||||
fi
|
||||
echo ""
|
||||
|
||||
read -p "Type 'CONFIRM' to proceed: " confirm
|
||||
|
||||
if [[ "$confirm" != "CONFIRM" ]]; then
|
||||
log_info "Aborted - no changes made"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Remove SSH keys
|
||||
log_info "Removing SSH keys..."
|
||||
rm -f "$HOME/.ssh/id_ed25519_${NODE_NAME}"
|
||||
rm -f "$HOME/.ssh/id_ed25519_${NODE_NAME}.pub"
|
||||
rm -f "$HOME/.ssh/id_rsa_${NODE_NAME}"
|
||||
rm -f "$HOME/.ssh/id_rsa_${NODE_NAME}.pub"
|
||||
log_info "SSH keys removed"
|
||||
|
||||
# Restore SSH config backup
|
||||
local latest_backup
|
||||
latest_backup=$(ls -t "$HOME/.ssh/config.bak."* 2>/dev/null | head -1 || true)
|
||||
if [[ -n "$latest_backup" ]]; then
|
||||
cp "$latest_backup" "$HOME/.ssh/config"
|
||||
log_info "SSH config restored from $latest_backup"
|
||||
else
|
||||
log_warn "No SSH config backup found"
|
||||
fi
|
||||
|
||||
# GPG key removal guidance
|
||||
if [[ -n "$OPERATOR_EMAIL" ]]; then
|
||||
echo ""
|
||||
echo "============================================"
|
||||
echo " GPG KEY REMOVAL (MANUAL STEP)"
|
||||
echo "============================================"
|
||||
echo ""
|
||||
echo "To remove the GPG key, run these commands:"
|
||||
echo ""
|
||||
echo " gpg --delete-secret-keys $OPERATOR_EMAIL"
|
||||
echo " gpg --delete-keys $OPERATOR_EMAIL"
|
||||
echo ""
|
||||
log_warn "GPG key requires manual removal for safety"
|
||||
fi
|
||||
|
||||
log_info "Completed $SCRIPT_NAME"
|
||||
}
|
||||
|
||||
[[ "${BASH_SOURCE[0]}" == "$0" ]] && main "$@"
|
||||
63
operator-bootstrap/scripts/rollback/undo_ssh_config.sh
Executable file
63
operator-bootstrap/scripts/rollback/undo_ssh_config.sh
Executable file
@@ -0,0 +1,63 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
# === METADATA ===
|
||||
SCRIPT_NAME="$(basename "$0")"
|
||||
|
||||
# === CONFIGURATION ===
|
||||
: "${NODE_NAME:=node-a}"
|
||||
|
||||
# === FUNCTIONS ===
|
||||
log_info() { echo "[INFO] $(date -Iseconds) $*"; }
|
||||
log_warn() { echo "[WARN] $(date -Iseconds) $*" >&2; }
|
||||
|
||||
main() {
|
||||
log_info "Starting $SCRIPT_NAME - ROLLBACK SSH config..."
|
||||
|
||||
local config="$HOME/.ssh/config"
|
||||
|
||||
echo ""
|
||||
echo "============================================"
|
||||
echo " SSH CONFIG ROLLBACK"
|
||||
echo "============================================"
|
||||
echo ""
|
||||
|
||||
# List available backups
|
||||
echo "Available backups:"
|
||||
ls -la "$HOME/.ssh/config.bak."* 2>/dev/null || echo " (none found)"
|
||||
echo ""
|
||||
|
||||
local latest_backup
|
||||
latest_backup=$(ls -t "$HOME/.ssh/config.bak."* 2>/dev/null | head -1 || true)
|
||||
|
||||
if [[ -z "$latest_backup" ]]; then
|
||||
log_warn "No backup files found"
|
||||
echo ""
|
||||
echo "Alternative: Manually remove the $NODE_NAME entry from ~/.ssh/config"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "Latest backup: $latest_backup"
|
||||
echo ""
|
||||
read -p "Restore from this backup? (y/N): " confirm
|
||||
|
||||
if [[ "$confirm" != "y" && "$confirm" != "Y" ]]; then
|
||||
log_info "Aborted - no changes made"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Create a backup of current config before restoring
|
||||
if [[ -f "$config" ]]; then
|
||||
cp "$config" "$config.pre-rollback.$(date +%Y%m%d%H%M%S)"
|
||||
log_info "Current config backed up"
|
||||
fi
|
||||
|
||||
# Restore from backup
|
||||
cp "$latest_backup" "$config"
|
||||
chmod 600 "$config"
|
||||
log_info "SSH config restored from $latest_backup"
|
||||
|
||||
log_info "Completed $SCRIPT_NAME"
|
||||
}
|
||||
|
||||
[[ "${BASH_SOURCE[0]}" == "$0" ]] && main "$@"
|
||||
81
operator-bootstrap/scripts/rollback/undo_tunnel.sh
Executable file
81
operator-bootstrap/scripts/rollback/undo_tunnel.sh
Executable file
@@ -0,0 +1,81 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
# === METADATA ===
|
||||
SCRIPT_NAME="$(basename "$0")"
|
||||
|
||||
# === CONFIGURATION ===
|
||||
: "${NODE_NAME:=node-a}"
|
||||
: "${TUNNEL_NAME:=$NODE_NAME-tunnel}"
|
||||
|
||||
# === FUNCTIONS ===
|
||||
log_info() { echo "[INFO] $(date -Iseconds) $*"; }
|
||||
log_warn() { echo "[WARN] $(date -Iseconds) $*" >&2; }
|
||||
log_error() { echo "[ERROR] $(date -Iseconds) $*" >&2; }
|
||||
|
||||
main() {
|
||||
log_info "Starting $SCRIPT_NAME - ROLLBACK tunnel..."
|
||||
|
||||
echo ""
|
||||
echo "============================================"
|
||||
echo " TUNNEL ROLLBACK"
|
||||
echo " Tunnel: $TUNNEL_NAME"
|
||||
echo "============================================"
|
||||
echo ""
|
||||
echo "This will:"
|
||||
echo " - Stop and disable the systemd service"
|
||||
echo " - Delete the tunnel from Cloudflare"
|
||||
echo " - Remove local credential and config files"
|
||||
echo " - Remove tunnel ID from pass (if stored)"
|
||||
echo ""
|
||||
|
||||
read -p "Type 'CONFIRM' to proceed: " confirm
|
||||
|
||||
if [[ "$confirm" != "CONFIRM" ]]; then
|
||||
log_info "Aborted - no changes made"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Stop and disable service
|
||||
log_info "Stopping systemd service..."
|
||||
systemctl --user stop "cloudflared-$TUNNEL_NAME" 2>/dev/null || true
|
||||
systemctl --user disable "cloudflared-$TUNNEL_NAME" 2>/dev/null || true
|
||||
rm -f "$HOME/.config/systemd/user/cloudflared-$TUNNEL_NAME.service" 2>/dev/null || true
|
||||
systemctl --user daemon-reload 2>/dev/null || true
|
||||
log_info "Service stopped and disabled"
|
||||
|
||||
# Delete tunnel from Cloudflare
|
||||
log_info "Deleting tunnel from Cloudflare..."
|
||||
if cloudflared tunnel delete "$TUNNEL_NAME" 2>/dev/null; then
|
||||
log_info "Tunnel deleted from Cloudflare"
|
||||
else
|
||||
log_warn "Could not delete tunnel - may need manual cleanup"
|
||||
log_warn "Check: https://dash.cloudflare.com -> Zero Trust -> Tunnels"
|
||||
fi
|
||||
|
||||
# Remove local files
|
||||
log_info "Removing local files..."
|
||||
rm -f "$HOME/.cloudflared/$TUNNEL_NAME.json"
|
||||
rm -f "$HOME/.cloudflared/config-$TUNNEL_NAME.yml"
|
||||
log_info "Local files removed"
|
||||
|
||||
# Remove from pass
|
||||
if command -v pass &>/dev/null && [[ -d "$HOME/.password-store" ]]; then
|
||||
log_info "Removing tunnel ID from pass..."
|
||||
pass rm -f "infrastructure/cloudflare/tunnel-id" 2>/dev/null || true
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "============================================"
|
||||
echo " TUNNEL ROLLBACK COMPLETE"
|
||||
echo "============================================"
|
||||
echo ""
|
||||
echo "Note: DNS records may still exist in Cloudflare."
|
||||
echo "Remove them manually if needed:"
|
||||
echo " https://dash.cloudflare.com -> DNS"
|
||||
echo ""
|
||||
|
||||
log_info "Completed $SCRIPT_NAME"
|
||||
}
|
||||
|
||||
[[ "${BASH_SOURCE[0]}" == "$0" ]] && main "$@"
|
||||
Reference in New Issue
Block a user