wip ssh component refactoring
This commit is contained in:
parent
28b42e3306
commit
cd1d0c7e74
11 changed files with 70 additions and 44 deletions
15
components/nixos/boot/default.nix
Normal file
15
components/nixos/boot/default.nix
Normal file
|
@ -0,0 +1,15 @@
|
|||
{ lib, config, ... }:
|
||||
{
|
||||
|
||||
imports = [
|
||||
./ssh.nix
|
||||
];
|
||||
|
||||
options.components.nixos.boot.enable = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
};
|
||||
|
||||
config = lib.mkIf (config.components.nixos.boot.enable) { };
|
||||
|
||||
}
|
49
components/nixos/boot/ssh.nix
Normal file
49
components/nixos/boot/ssh.nix
Normal file
|
@ -0,0 +1,49 @@
|
|||
{ config, lib, pkgs, factsGenerator, clanLib, ... }:
|
||||
with lib;
|
||||
with types;
|
||||
|
||||
{
|
||||
options.components.nixos.boot.ssh = {
|
||||
enable = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = config.components.nixos.boot.enable;
|
||||
};
|
||||
kernelModules = mkOption {
|
||||
type = listOf str;
|
||||
default = [ ];
|
||||
description =
|
||||
"lspci -v will tell you which kernel module is used for the ethernet interface";
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf (config.components.nixos.boot.ssh.enable) {
|
||||
|
||||
# root password
|
||||
clan.core.facts.services.rootPassword = factsGenerator.password { name = "root"; };
|
||||
#users.users.root.hashedPasswordFile = config.clan.core.facts.services.rootPassword.secret."password.root.pam".path; # fixme not working for some reason
|
||||
#users.users.root.initalPassword = "admin";
|
||||
|
||||
# ssh host key
|
||||
clan.core.facts.services."boot.ssh" = factsGenerator.ssh { name = "boot"; };
|
||||
|
||||
# boot
|
||||
boot.initrd.systemd.enable = true;
|
||||
boot.initrd.systemd.contents."/etc/hostname".text = "unlock.${config.networking.hostName}";
|
||||
|
||||
# network
|
||||
boot.initrd.systemd.network.enable = true;
|
||||
boot.initrd.availableKernelModules = config.components.nixos.boot.ssh.kernelModules;
|
||||
|
||||
# ssh
|
||||
boot.initrd.network.enable = true;
|
||||
boot.initrd.network.ssh = {
|
||||
enable = true;
|
||||
authorizedKeys = config.users.users.root.openssh.authorizedKeys.keys;
|
||||
port = 2222;
|
||||
hostKeys = [ config.clan.core.facts.services."boot.ssh".secret."ssh.boot.id_ed25519".path ];
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
}
|
||||
|
|
@ -10,18 +10,6 @@ with types;
|
|||
default = false;
|
||||
};
|
||||
|
||||
kernelModules = mkOption {
|
||||
type = listOf str;
|
||||
default = [ ];
|
||||
description =
|
||||
"lspci -v will tell you which kernel module is used for the ethernet interface";
|
||||
};
|
||||
|
||||
ssh.enable = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = config.components.nixos.boot.enable;
|
||||
};
|
||||
|
||||
tor.enable = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = config.components.nixos.boot.ssh.enable;
|
||||
|
@ -107,31 +95,6 @@ with types;
|
|||
})
|
||||
|
||||
|
||||
# ssh part
|
||||
# --------
|
||||
(mkIf (config.components.nixos.boot.ssh.enable) {
|
||||
|
||||
# boot
|
||||
boot.initrd.systemd.enable = true;
|
||||
boot.initrd.systemd.contents."/etc/hostname".text = "unlock.${config.networking.hostName}";
|
||||
|
||||
# network
|
||||
boot.initrd.systemd.network.enable = true;
|
||||
boot.initrd.availableKernelModules = config.components.nixos.boot.kernelModules;
|
||||
|
||||
# ssh
|
||||
boot.initrd.network.enable = true;
|
||||
boot.initrd.network.ssh = {
|
||||
enable = true;
|
||||
#authorizedKeys = config.users.users.root.openssh.authorizedKeys.keys ;
|
||||
#authorizedKeyFiles = config.users.users.root.openssh.authorizedKeys.keyFiles;
|
||||
port = 2222;
|
||||
hostKeys = map ({ path, ... }: path) config.services.openssh.hostKeys;
|
||||
};
|
||||
|
||||
|
||||
})
|
||||
|
||||
];
|
||||
}
|
||||
|
|
@ -2,7 +2,7 @@
|
|||
{
|
||||
imports = [
|
||||
./upgrade-diff.nix
|
||||
./tor-ssh.nix
|
||||
./boot
|
||||
];
|
||||
|
||||
options.components.nixos.enable = lib.mkOption {
|
||||
|
|
|
@ -477,6 +477,7 @@
|
|||
|
||||
probe = clanSetup {
|
||||
name = "probe";
|
||||
#host = "167.235.205.150";
|
||||
host = "95.217.18.54";
|
||||
modules = [
|
||||
homeManagerModules
|
||||
|
@ -484,6 +485,7 @@
|
|||
srvos.nixosModules.hardware-hetzner-cloud
|
||||
srvos.nixosModules.server
|
||||
srvos.nixosModules.mixins-terminfo
|
||||
inputs.clan-core.clanModules.sshd
|
||||
{
|
||||
home-manager.users.mainUser = import ./homes/palo;
|
||||
home-manager.users.root = import ./homes/root;
|
||||
|
|
|
@ -59,8 +59,7 @@
|
|||
components.terminal.enable = true;
|
||||
|
||||
components.nixos.boot.enable = true;
|
||||
components.nixos.boot.kernelModules = [ "e1000e" ];
|
||||
components.nixos.boot.tor.enable = false;
|
||||
components.nixos.boot.ssh.kernelModules = [ "e1000e" ];
|
||||
|
||||
components.monitor.enable = true;
|
||||
components.monitor.opentelemetry.receiver.endpoint = "0.0.0.0:4317";
|
||||
|
|
|
@ -54,7 +54,6 @@
|
|||
components.network.sshd.sshguard.enable = false;
|
||||
|
||||
components.nixos.boot.enable = true;
|
||||
components.nixos.boot.tor.enable = false;
|
||||
|
||||
components.monitor.enable = true;
|
||||
networking.firewall.interfaces.wg0.allowedTCPPorts = [ 4317 ];
|
||||
|
|
|
@ -11,7 +11,6 @@
|
|||
components.network.enable = true;
|
||||
|
||||
components.nixos.boot.enable = true;
|
||||
components.nixos.boot.tor.enable = false;
|
||||
|
||||
networking.hostName = "probe";
|
||||
users.users.root.openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJkqVvuJSvRMO5pG2CHNNBxjB7HlJudK4TQs3BhbOWOD" ];
|
||||
|
|
|
@ -1 +0,0 @@
|
|||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILrcy2I9RXvWzWkNOvdNAhjq92A3gD/ICVlAHFiuQxF3 nixbld@cream
|
|
@ -1,7 +1,7 @@
|
|||
{ config, factsGenerator, clanLib, ... }:
|
||||
{
|
||||
imports = [
|
||||
./disko-config-encrypted.nix
|
||||
./disko-config-simple.nix
|
||||
./hardware-configuration.nix
|
||||
./hetzner.nix # to more me to components
|
||||
];
|
||||
|
|
|
@ -29,6 +29,7 @@
|
|||
content = {
|
||||
type = "luks";
|
||||
name = "root";
|
||||
settings.allowDiscards = true;
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "ext4";
|
||||
|
|
Loading…
Reference in a new issue