fireproof/nixos
1
0
Fork 0
mirror of https://github.com/nickolaj-jepsen/nixos.git synced 2026-01-22 08:06:50 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

refactor: split base and system module

Browse source
This commit is contained in:
Nickolaj Jepsen 2025-12-12 04:17:02 +01:00
parent d50bbb3d12
commit 742a55e5a0
17 changed files with 34 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

106
modules/system/ssh.nix Normal file
View file

@ -0,0 +1,106 @@
{
config,
pkgs,
username,
hostname,
lib,
...
}: let
# Load all public keys from ../../secrets/hosts/*/id_ed25519.pub
allHosts = lib.attrNames (lib.filterAttrs (_: type: type == "directory") (builtins.readDir ../../secrets/hosts));
publicKeys = map (x: builtins.readFile (../../secrets/hosts + ("/" + x) + "/id_ed25519.pub")) allHosts;
workEnabled = config.fireproof.work.enable;
in {
age.secrets.ssh-key = {
rekeyFile = ../../secrets/hosts + ("/" + hostname) + /id_ed25519.age;
path = "/home/" + username + "/.ssh/id_ed25519";
mode = "0600";
owner = username;
};
age.secrets.ssh-key-ao = lib.mkIf workEnabled {
rekeyFile = ../../secrets/ssh-key-ao.age;
mode = "0600";
owner = username;
};
fireproof.home-manager = {
home.file.".ssh/id_ed25519.pub".source = ../../secrets/hosts + ("/" + hostname) + "/id_ed25519.pub";
programs.ssh = {
enable = true;
forwardAgent = true;
serverAliveInterval = 60;
serverAliveCountMax = 10;
matchBlocks = {
"*" = {
identityFile = "${config.age.secrets.ssh-key.path}";
};
homelab = {
hostname = "x.nickolaj.com";
user = "nickolaj";
};
} // lib.optionalAttrs workEnabled {
# Work hostnames definded in ./networking.nix
"bastion.ao" = {
user = "nij";
identityFile = "${config.age.secrets.ssh-key-ao.path}";
};
"clickhouse.ao" = {
user = "ubuntu";
hostname = "51.158.205.48";
identityFile = "${config.age.secrets.ssh-key-ao.path}";
};
"flex.ao" = {
user = "nij";
hostname = "192.168.2.5";
proxyJump = "bastion.ao";
identityFile = "${config.age.secrets.ssh-key-ao.path}";
};
"scw.ao" = {
user = "nij";
hostname = "51.15.81.1";
proxyJump = lib.mkDefault "dev.ao";
identityFile = "${config.age.secrets.ssh-key-ao.path}";
};
"dev.ao" = {
user = "nij";
hostname = "192.168.2.28";
proxyJump = lib.mkDefault "bastion.ao";
identityFile = "${config.age.secrets.ssh-key-ao.path}";
};
"staging.ao" = {
user = "staging";
hostname = "172.16.2.102";
proxyJump = lib.mkDefault "bastion.ao";
identityFile = "${config.age.secrets.ssh-key-ao.path}";
};
};
};
};
programs.ssh.startAgent = true;
services.gnome.gcr-ssh-agent.enable = false;
services.openssh = {
enable = true;
settings.PasswordAuthentication = false;
settings.KbdInteractiveAuthentication = false;
};
systemd.user.services."add-ssh-keys" = lib.mkIf workEnabled {
description = "Add SSH keys to ssh-agent";
after = ["network.target" "ssh-agent.service"];
requires = ["ssh-agent.service"];
wantedBy = ["default.target"];
serviceConfig = {
Type = "oneshot";
ExecStartPre = ''
${pkgs.coreutils}/bin/sleep 5
'';
ExecStart = ''
${pkgs.openssh}/bin/ssh-add -q ${config.age.secrets.ssh-key-ao.path}
'';
};
};
users.users.${username}.openssh.authorizedKeys.keys = publicKeys;
}