wip ssh component refactoring

components/nixos/boot/default.nix

@@ -0,0 +1,15 @@
+{ lib, config, ... }:
+{
+
+  imports = [
+    ./ssh.nix
+  ];
+
+  options.components.nixos.boot.enable = lib.mkOption {
+    type = lib.types.bool;
+    default = false;
+  };
+
+  config = lib.mkIf (config.components.nixos.boot.enable) { };
+
+}

components/nixos/boot/ssh.nix

@@ -0,0 +1,49 @@
+{ config, lib, pkgs, factsGenerator, clanLib, ... }:
+with lib;
+with types;
+
+{
+  options.components.nixos.boot.ssh = {
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = config.components.nixos.boot.enable;
+    };
+    kernelModules = mkOption {
+      type = listOf str;
+      default = [ ];
+      description =
+        "lspci -v will tell you which kernel module is used for the ethernet interface";
+    };
+  };
+
+  config = mkIf (config.components.nixos.boot.ssh.enable) {
+
+    # root password
+    clan.core.facts.services.rootPassword = factsGenerator.password { name = "root"; };
+    #users.users.root.hashedPasswordFile = config.clan.core.facts.services.rootPassword.secret."password.root.pam".path; # fixme not working for some reason
+    #users.users.root.initalPassword = "admin";
+
+    # ssh host key
+    clan.core.facts.services."boot.ssh" = factsGenerator.ssh { name = "boot"; };
+
+    # boot
+    boot.initrd.systemd.enable = true;
+    boot.initrd.systemd.contents."/etc/hostname".text = "unlock.${config.networking.hostName}";
+
+    # network
+    boot.initrd.systemd.network.enable = true;
+    boot.initrd.availableKernelModules = config.components.nixos.boot.ssh.kernelModules;
+
+    # ssh
+    boot.initrd.network.enable = true;
+    boot.initrd.network.ssh = {
+      enable = true;
+      authorizedKeys = config.users.users.root.openssh.authorizedKeys.keys;
+      port = 2222;
+      hostKeys = [ config.clan.core.facts.services."boot.ssh".secret."ssh.boot.id_ed25519".path ];
+    };
+
+  };
+
+}
+

components/nixos/boot/tor-ssh.nix

@@ -0,0 +1,100 @@
+{ config, lib, pkgs, factsGenerator, clanLib, ... }:
+with lib;
+with types;
+
+{
+  options.components.nixos.boot = {
+
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+    };
+
+    tor.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = config.components.nixos.boot.ssh.enable;
+    };
+  };
+
+  config = mkMerge [
+
+    # todo : not working at the moment, because onion hostnames are secrets
+    (
+      let
+        onionIds = clanLib.readFactFromAllMachines "tor.initrd.hostname";
+        generateOnionUnlockScript = machine: onionId: pkgs.writers.writeDashBin "unlock-boot-${machine}-via-tor" ''
+          ${pkgs.tor}/bin/torify ${pkgs.openssh}/bin/ssh root@${onionId} -p 2222
+        '';
+      in
+      {
+        # add known hosts
+        services.openssh.knownHosts =
+          mapAttrs
+            (_machine: onionId: {
+              hostNames = [ "[${onionId}]:2222" ];
+            })
+            onionIds;
+
+        # create unlook tor boot script
+        environment.systemPackages =
+          mapAttrsToList generateOnionUnlockScript onionIds;
+      }
+    )
+
+    # tor part
+    # --------
+    (mkIf (config.components.nixos.boot.tor.enable) {
+
+      #services.tor = {
+      #  enable = true;
+      #  client.enable = true;
+      #  relay.onionServices.bootup.map = [{ port = 2222; }];
+      #};
+
+      # tor setup
+      clan.core.facts.services.initrd_tor = factsGenerator.tor { name = ""; };
+
+      boot.initrd.secrets = {
+        "/etc/tor/onion/bootup/tor.priv" = config.clan.core.facts.services.initrd_tor.secret."tor.initrd.priv".path;
+        "/etc/tor/onion/bootup/hostname" = config.clan.core.facts.services.initrd_tor.secret."tor.initrd.hostname".path;
+      };
+
+      #boot.initrd.extraUtilsCommands = ''
+      #  copy_bin_and_libs ${pkgs.tor}/bin/tor
+      #'';
+
+      # fixme: this thing is not working for some reason.
+      boot.initrd.systemd.packages = [ pkgs.tor pkgs.iproute2 pkgs.coreutils ];
+      boot.initrd.systemd.services.tor = {
+        path = [ pkgs.tor pkgs.iproute2 pkgs.coreutils ];
+        # todo: set wanted by
+        script =
+          let
+            torRc = pkgs.writeText "tor.rc" ''
+              DataDirectory /etc/tor
+              SOCKSPort 127.0.0.1:9050 IsolateDestAddr
+              SOCKSPort 127.0.0.1:9063
+              HiddenServiceDir /etc/tor/onion/bootup
+              HiddenServicePort 2222 127.0.0.1:2222
+            '';
+          in
+          ''
+            echo "tor: preparing onion folder"
+            # have to do this otherwise tor does not want to start
+            chmod -R 700 /etc/tor
+
+            echo "make sure localhost is up"
+            ip a a 127.0.0.1/8 dev lo
+            ip link set lo up
+
+            echo "tor: starting tor"
+            tor -f ${torRc} --verify-config
+            tor -f ${torRc}
+          '';
+      };
+    })
+
+
+  ];
+}
+