alex/nixos-configs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sombrero: Add agenix module and use it for pinwheel ssh key

Browse Source
This commit is contained in:
Alexander Heldt
2023-10-24 21:18:47 +02:00
parent 4d078f206f
commit c4cb29014d
16 changed files with 88 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
hosts/sombrero/configuration.nix
View File

@@ -61,10 +61,12 @@
isNormalUser = true;
hashedPassword = "$6$3mkwaUWd8NA6XuEb$x80tETKGz6FEG.kej3v5Vh6hRNoC6bikhXogTP.zZwYtISA46JaN3RMK3ckbqt8Aj52d3krSLOfBaAR1qzuJ2/";
extraGroups = [ "wheel" ];
openssh.authorizedKeys.keys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQD8g63nIaOg67kwwEd5cGXvzaTL1PefLwonKkDy1P2cJjngcH/cBmgzXUZWxWqgBIENZ3mj0EJtoD556tprRRFj9COdAEI9bxn2NkoqPCu8f7SttQTeVA63ZbAR7AHPMMngBxRiQy6SIo6mQteXha1z99+g0YHETct/qhmm2AbtakF+NSb0bIqrFYnOl7iSW4cotGjibAyX74b4dBe9A2sIYwmBs4IMjLlHmcrmqLqPIAGWY1EgNV/HIN06whbkSjpoxaFAZpxoVskk/syjzD/RRSLnFhXbljZeRkUp1nFsELNGgugQo3fx1oxigfgzo09QSRDuB6eb2Ol1XnnNU0vcJPio9PmIR9aOiinVx/i/N0QvQtedoxNgLR4bayJrOxL7wYvWGW50TCLEIZ+OnPp6HW5mGHaOWjeKymjBCXpQumTcv3TBZpsHvQ5vbTU2otbbof/1ScEzfS9XBxWPH89dua1aPBcHk58jGbNz7jRLBPNSmDgvuIMAeavrDbHu5p22XnHOPz9f2aCkX2M6ll17mN1dMc8v6/i9/gV7bmSj+DAwQEjxtYd1eQFGw9VvmDfTdzpBhLmnNAIdbHJo3WMsY0AZCvov0mEu7qJA8hrmm4ITb9pO0ZhfYfF1bZVbYfKAdF3hWPn5vxQFXKUogSXjU8lIn6Bu+Vw40IteDy2aKQ== alex.bennu@sombrero"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILFMl66CW8XtBGP9ie5Xd6MyQ1c+mRa8TwSiXctq+byS alex.pinwheel-sombrero"
];
openssh.authorizedKeys = {
keys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQD8g63nIaOg67kwwEd5cGXvzaTL1PefLwonKkDy1P2cJjngcH/cBmgzXUZWxWqgBIENZ3mj0EJtoD556tprRRFj9COdAEI9bxn2NkoqPCu8f7SttQTeVA63ZbAR7AHPMMngBxRiQy6SIo6mQteXha1z99+g0YHETct/qhmm2AbtakF+NSb0bIqrFYnOl7iSW4cotGjibAyX74b4dBe9A2sIYwmBs4IMjLlHmcrmqLqPIAGWY1EgNV/HIN06whbkSjpoxaFAZpxoVskk/syjzD/RRSLnFhXbljZeRkUp1nFsELNGgugQo3fx1oxigfgzo09QSRDuB6eb2Ol1XnnNU0vcJPio9PmIR9aOiinVx/i/N0QvQtedoxNgLR4bayJrOxL7wYvWGW50TCLEIZ+OnPp6HW5mGHaOWjeKymjBCXpQumTcv3TBZpsHvQ5vbTU2otbbof/1ScEzfS9XBxWPH89dua1aPBcHk58jGbNz7jRLBPNSmDgvuIMAeavrDbHu5p22XnHOPz9f2aCkX2M6ll17mN1dMc8v6/i9/gV7bmSj+DAwQEjxtYd1eQFGw9VvmDfTdzpBhLmnNAIdbHJo3WMsY0AZCvov0mEu7qJA8hrmm4ITb9pO0ZhfYfF1bZVbYfKAdF3hWPn5vxQFXKUogSXjU8lIn6Bu+Vw40IteDy2aKQ== alex.bennu@sombrero"
];
};
};
};

13
hosts/sombrero/modules/age/default.nix Normal file
View File

@@ -0,0 +1,13 @@
{ inputs, config, ... }:
let
system = config.config-manager.system;
in
{
age = {
identityPaths = [ "/etc/ssh/sombrero" ];
};
environment.systemPackages = [
inputs.agenix.packages."${system}".default
];
}

56
hosts/sombrero/modules/ssh/default.nix
View File

@@ -1,6 +1,8 @@
{ lib, config, ... }:
{ pkgs, lib, config, ... }:
let
enabled = config.mod.ssh.enable;
authorizedKeysPath = "/home/alex/.ssh/authorized-keys";
in
{
options = {
@@ -10,10 +12,41 @@ in
};
config = lib.mkIf enabled {
home-manager.users.alex = {
programs.ssh = {
enable = true;
matchBlocks = {
"github.com" = {
hostname = "github.com";
identityFile = "/home/alex/.ssh/alex.sombrero-github.com";
};
};
};
};
environment.etc."ssh/authorized_keys_command" = {
mode = "0755";
text = ''
#!${pkgs.bash}/bin/bash
for file in ${authorizedKeysPath}/*; do
${pkgs.coreutils}/bin/cat "$file"
done
'';
};
services = {
openssh = {
enable = true;
ports = [ 1122 ];
hostKeys = [{
path = "/etc/ssh/sombrero";
type = "ed25519";
}];
authorizedKeysCommand = "/etc/ssh/authorized_keys_command";
authorizedKeysCommandUser = "root";
};
};
@@ -22,5 +55,26 @@ in
allowedTCPPorts = [ 1122 ];
};
};
age.secrets = {
"alex.pinwheel-sombrero.pub" = {
file = ../../../../secrets/pinwheel/alex.pinwheel-sombrero.pub.age;
path = "${authorizedKeysPath}/alex.pinwheel-sombrero.pub";
};
"alex.sombrero-github.com" = {
file = ../../../../secrets/sombrero/alex.sombrero-github.com.age;
path = "/home/alex/.ssh/alex.sombrero-github.com";
owner = "alex";
group = "users";
};
"alex.sombrero-github.com.pub" = {
file = ../../../../secrets/sombrero/alex.sombrero-github.com.pub.age;
path = "/home/alex/.ssh/alex.sombrero-github.com.pub";
owner = "alex";
group = "users";
};
};
};
}