palo
/
nixos-config
1
0
Fork 0
Code Issues 1 Pull Requests Projects Releases Wiki Activity

wip on init-ssh

feature/hass
Ingolf Wagner 2021-04-24 14:23:51 +02:00
parent 90cd3df0c8
commit e9a180ab77
Signed by: palo
GPG Key ID: 76BF5F1928B9618B
3 changed files with 10 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
configs/workhorse/configuration.nix
View File

@ -59,8 +59,7 @@
configuration.init-ssh = {
enable = "enabled";
kernelModules = [ "r8169" ];
#hostECDSAKey = <secrets/init-ssh/host_ecdsa_key>;
hostECDSAKey = <secrets/init-ssh/ssh_host_ed25519_key>;
hostKey = "/etc/ssh/ssh_host_ed25519_key";
};
# nix-shell -p speedtest_cli --run speedtest

3
system/all/sshd-known-hosts-public.nix
View File

@ -41,7 +41,8 @@ with lib;
# space-left
gitlabSpaceLeft = {
hostNames = [ "git.space-left.org" ];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAapztj8I3xy6Ea8A1q7Mo5C6zdgsK1bguAXcKUDCRBO";
publicKey =
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAapztj8I3xy6Ea8A1q7Mo5C6zdgsK1bguAXcKUDCRBO";
};
# c-base
"bnd-cbase" = {

14
system/server/initssh.nix
View File

@ -28,12 +28,13 @@ in {
++ (map (keyFile: lib.fileContents keyFile)
config.users.users.root.openssh.authorizedKeys.keyFiles);
};
hostECDSAKey = mkOption {
default = null;
type = with types; nullOr path;
hostKey = mkOption {
default = "/etc/ssh/ssh_host_ed25519_key";
type = with types; path;
description = ''
you only need one host key
nix-shell -p dropbear --run "dropbearkey -t ecdsa -f ./host_ecdsa_key"
To generate keys, use ssh-keygen(1):
# ssh-keygen -t rsa -N "" -f /etc/secrets/initrd/ssh_host_rsa_key
# ssh-keygen -t ed25519 -N "" -f /etc/secrets/initrd/ssh_host_ed25519_key
'';
};
@ -91,10 +92,9 @@ in {
enable = true;
authorizedKeys = cfg.authorizedKeys;
port = cfg.port;
hostKeys = [ cfg.hostKey ];
};
boot.initrd.availableKernelModules = cfg.kernelModules;
#boot.initrd.network.ssh.hostECDSAKey = cfg.hostECDSAKey;
boot.initrd.network.ssh.hostKeys = [ cfg.hostECDSAKey ];
})
];
}