nixos-config/modules/init-ssh.nix

106 lines
2.9 KiB
Nix
Raw Normal View History

2019-10-24 02:20:38 +02:00
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.configuration.init-ssh;
2021-11-01 09:20:42 +01:00
in
{
2019-10-24 02:20:38 +02:00
2024-03-03 10:52:46 +01:00
# todo : this is kinda deprecated. It should be replaced some day with something more simple, and put in a module.
2019-10-24 02:20:38 +02:00
options.configuration.init-ssh = {
enable = mkOption {
default = "disable";
type = with types; enum [ "disable" "prepare" "enabled" ];
};
2021-04-25 09:51:23 +02:00
kernelModules = mkOption {
type = with types; listOf str;
2021-04-27 07:03:20 +02:00
description =
2021-04-25 09:51:23 +02:00
"lspci -v will tell you which kernel module is used for the ethernet interface";
};
2019-10-24 02:20:38 +02:00
port = mkOption {
2022-01-15 09:32:59 +01:00
default = 2222;
2019-10-24 02:20:38 +02:00
type = with types; int;
};
authorizedKeys = mkOption {
type = with types; listOf str;
2019-12-20 05:54:26 +01:00
default = config.users.users.root.openssh.authorizedKeys.keys
++ (map (keyFile: lib.fileContents keyFile)
2021-11-01 09:20:42 +01:00
config.users.users.root.openssh.authorizedKeys.keyFiles);
2019-10-24 02:20:38 +02:00
};
2021-04-24 14:23:51 +02:00
hostKey = mkOption {
2022-01-18 20:21:03 +01:00
default = "/etc/secrets/initrd/ssh_host_ed25519_key";
2021-04-24 14:23:51 +02:00
type = with types; path;
2019-10-24 02:20:38 +02:00
description = ''
2021-04-24 14:23:51 +02:00
To generate keys, use ssh-keygen(1):
# ssh-keygen -t rsa -N "" -f /etc/secrets/initrd/ssh_host_rsa_key
# ssh-keygen -t ed25519 -N "" -f /etc/secrets/initrd/ssh_host_ed25519_key
2019-10-24 02:20:38 +02:00
'';
};
};
config = mkMerge [
(mkIf (cfg.enable != "disable") {
services.tor = {
enable = true;
client.enable = true;
2021-11-01 09:20:42 +01:00
relay.onionServices.bootup.map = [{ port = 22; }];
2019-10-24 02:20:38 +02:00
};
})
(mkIf (cfg.enable == "enabled") {
# tor setup
2019-12-20 05:54:26 +01:00
boot.initrd.secrets = {
2019-10-24 02:20:38 +02:00
"/etc/tor/onion/bootup" = /var/lib/tor/onion/bootup;
};
boot.initrd.extraUtilsCommands = ''
copy_bin_and_libs ${pkgs.tor}/bin/tor
'';
2021-11-01 09:20:42 +01:00
boot.initrd.network.postCommands =
let
torRc = (pkgs.writeText "tor.rc" ''
DataDirectory /etc/tor
SOCKSPort 127.0.0.1:9050 IsolateDestAddr
SOCKSPort 127.0.0.1:9063
HiddenServiceDir /etc/tor/onion/bootup
HiddenServicePort ${toString cfg.port} 127.0.0.1:${toString cfg.port}
'');
in
''
echo "tor: preparing onion folder"
# have to do this otherwise tor does not want to start
chmod -R 700 /etc/tor
echo "make sure localhost is up"
ip a a 127.0.0.1/8 dev lo
# ifconfig lo up
ip link set lo up
echo "tor: starting tor"
tor -f ${torRc} --verify-config
tor -f ${torRc} &
'';
2019-12-20 05:54:26 +01:00
# ssh setup
# todo add the ssh host fingerprint to your trusted stuff
# todo set ssh host key here
boot.initrd.network.enable = true;
boot.initrd.network.ssh = {
enable = true;
authorizedKeys = cfg.authorizedKeys;
port = cfg.port;
2021-04-24 14:23:51 +02:00
hostKeys = [ cfg.hostKey ];
2019-12-20 05:54:26 +01:00
};
boot.initrd.availableKernelModules = cfg.kernelModules;
2019-10-24 02:20:38 +02:00
})
];
}