open ssh on chungus for password unlocking

components/nixos/default.nix

@@ -1,6 +1,9 @@
 { config, lib, ... }:
 {
-  imports = [ ./upgrade-diff.nix ];
+  imports = [
+    ./upgrade-diff.nix
+    ./tor-ssh.nix
+  ];
 
   options.components.nixos.enable = lib.mkOption {
     type = lib.types.bool;

components/nixos/tor-ssh.nix

@@ -0,0 +1,60 @@
+{ config, lib, pkgs, ... }:
+with lib;
+with types;
+
+{
+  options.components.nixos.boot = {
+
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+    };
+
+    kernelModules = mkOption {
+      type = listOf str;
+      default = [ ];
+      description =
+        "lspci -v will tell you which kernel module is used for the ethernet interface";
+    };
+
+    ssh = {
+
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = config.components.nixos.boot.enable;
+      };
+
+
+    };
+  };
+
+  config = mkMerge [
+
+    # ssh part
+    # --------
+    (mkIf (config.components.nixos.boot.ssh.enable) {
+
+      # boot
+      boot.initrd.systemd.enable = true;
+      boot.initrd.systemd.contents."/etc/hostname".text = "unlock.${config.networking.hostName}";
+
+      # network
+      boot.initrd.systemd.network.enable = true;
+      boot.initrd.availableKernelModules = config.components.nixos.boot.kernelModules;
+
+      # ssh
+      boot.initrd.network.enable = true;
+      boot.initrd.network.ssh = {
+        enable = true;
+        #authorizedKeys =     config.users.users.root.openssh.authorizedKeys.keys ;
+        #authorizedKeyFiles = config.users.users.root.openssh.authorizedKeys.keyFiles;
+        port = 2222;
+        hostKeys = map ({ path, ... }: path) config.services.openssh.hostKeys;
+      };
+
+
+    })
+
+  ];
+}
+

machines/chungus/configuration.nix

@@ -55,10 +55,13 @@
   components.network.wifi.enable = false;
   components.terminal.enable = true;
 
+  components.nixos.boot.enable = true;
+  components.nixos.boot.kernelModules = [ "e1000e" ];
+
   components.monitor.enable = true;
+  components.monitor.opentelemetry.receiver.endpoint = "0.0.0.0:4317";
   networking.firewall.interfaces.wg0.allowedTCPPorts = [ 4317 ];
   networking.firewall.interfaces.wg0.allowedUDPPorts = [ 4317 ];
-  components.monitor.opentelemetry.receiver.endpoint = "0.0.0.0:4317";
 
   services.printing.enable = false;
 
@@ -68,7 +71,7 @@
   #};
   virtualisation.podman.extraPackages = [ pkgs.zfs ]; # make sure /var/lib/containers/storage is a zfs dataset
 
-  sops.defaultSopsFile = ../../secrets/chungus.yaml;
+  #sops.defaultSopsFile = ../../secrets/chungus.yaml;
 
   networking.hostName = "chungus";