wip ssh component refactoring

This commit is contained in:
Ingolf Wagner 2024-08-07 15:51:41 +02:00
parent 28b42e3306
commit cd1d0c7e74
No known key found for this signature in database
GPG key ID: 76BF5F1928B9618B
11 changed files with 70 additions and 44 deletions

View file

@ -0,0 +1,15 @@
{ lib, config, ... }:
{
imports = [
./ssh.nix
];
options.components.nixos.boot.enable = lib.mkOption {
type = lib.types.bool;
default = false;
};
config = lib.mkIf (config.components.nixos.boot.enable) { };
}

View file

@ -0,0 +1,49 @@
{ config, lib, pkgs, factsGenerator, clanLib, ... }:
with lib;
with types;
{
options.components.nixos.boot.ssh = {
enable = lib.mkOption {
type = lib.types.bool;
default = config.components.nixos.boot.enable;
};
kernelModules = mkOption {
type = listOf str;
default = [ ];
description =
"lspci -v will tell you which kernel module is used for the ethernet interface";
};
};
config = mkIf (config.components.nixos.boot.ssh.enable) {
# root password
clan.core.facts.services.rootPassword = factsGenerator.password { name = "root"; };
#users.users.root.hashedPasswordFile = config.clan.core.facts.services.rootPassword.secret."password.root.pam".path; # fixme not working for some reason
#users.users.root.initalPassword = "admin";
# ssh host key
clan.core.facts.services."boot.ssh" = factsGenerator.ssh { name = "boot"; };
# boot
boot.initrd.systemd.enable = true;
boot.initrd.systemd.contents."/etc/hostname".text = "unlock.${config.networking.hostName}";
# network
boot.initrd.systemd.network.enable = true;
boot.initrd.availableKernelModules = config.components.nixos.boot.ssh.kernelModules;
# ssh
boot.initrd.network.enable = true;
boot.initrd.network.ssh = {
enable = true;
authorizedKeys = config.users.users.root.openssh.authorizedKeys.keys;
port = 2222;
hostKeys = [ config.clan.core.facts.services."boot.ssh".secret."ssh.boot.id_ed25519".path ];
};
};
}

View file

@ -10,18 +10,6 @@ with types;
default = false;
};
kernelModules = mkOption {
type = listOf str;
default = [ ];
description =
"lspci -v will tell you which kernel module is used for the ethernet interface";
};
ssh.enable = lib.mkOption {
type = lib.types.bool;
default = config.components.nixos.boot.enable;
};
tor.enable = lib.mkOption {
type = lib.types.bool;
default = config.components.nixos.boot.ssh.enable;
@ -107,31 +95,6 @@ with types;
})
# ssh part
# --------
(mkIf (config.components.nixos.boot.ssh.enable) {
# boot
boot.initrd.systemd.enable = true;
boot.initrd.systemd.contents."/etc/hostname".text = "unlock.${config.networking.hostName}";
# network
boot.initrd.systemd.network.enable = true;
boot.initrd.availableKernelModules = config.components.nixos.boot.kernelModules;
# ssh
boot.initrd.network.enable = true;
boot.initrd.network.ssh = {
enable = true;
#authorizedKeys = config.users.users.root.openssh.authorizedKeys.keys ;
#authorizedKeyFiles = config.users.users.root.openssh.authorizedKeys.keyFiles;
port = 2222;
hostKeys = map ({ path, ... }: path) config.services.openssh.hostKeys;
};
})
];
}

View file

@ -2,7 +2,7 @@
{
imports = [
./upgrade-diff.nix
./tor-ssh.nix
./boot
];
options.components.nixos.enable = lib.mkOption {

View file

@ -477,6 +477,7 @@
probe = clanSetup {
name = "probe";
#host = "167.235.205.150";
host = "95.217.18.54";
modules = [
homeManagerModules
@ -484,6 +485,7 @@
srvos.nixosModules.hardware-hetzner-cloud
srvos.nixosModules.server
srvos.nixosModules.mixins-terminfo
inputs.clan-core.clanModules.sshd
{
home-manager.users.mainUser = import ./homes/palo;
home-manager.users.root = import ./homes/root;

View file

@ -59,8 +59,7 @@
components.terminal.enable = true;
components.nixos.boot.enable = true;
components.nixos.boot.kernelModules = [ "e1000e" ];
components.nixos.boot.tor.enable = false;
components.nixos.boot.ssh.kernelModules = [ "e1000e" ];
components.monitor.enable = true;
components.monitor.opentelemetry.receiver.endpoint = "0.0.0.0:4317";

View file

@ -54,7 +54,6 @@
components.network.sshd.sshguard.enable = false;
components.nixos.boot.enable = true;
components.nixos.boot.tor.enable = false;
components.monitor.enable = true;
networking.firewall.interfaces.wg0.allowedTCPPorts = [ 4317 ];

View file

@ -11,7 +11,6 @@
components.network.enable = true;
components.nixos.boot.enable = true;
components.nixos.boot.tor.enable = false;
networking.hostName = "probe";
users.users.root.openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJkqVvuJSvRMO5pG2CHNNBxjB7HlJudK4TQs3BhbOWOD" ];

View file

@ -1 +0,0 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILrcy2I9RXvWzWkNOvdNAhjq92A3gD/ICVlAHFiuQxF3 nixbld@cream

View file

@ -1,7 +1,7 @@
{ config, factsGenerator, clanLib, ... }:
{
imports = [
./disko-config-encrypted.nix
./disko-config-simple.nix
./hardware-configuration.nix
./hetzner.nix # to more me to components
];

View file

@ -29,6 +29,7 @@
content = {
type = "luks";
name = "root";
settings.allowDiscards = true;
content = {
type = "filesystem";
format = "ext4";