diff --git a/configs/workhorse/configuration.nix b/configs/workhorse/configuration.nix index 7bb94fc..e85db26 100644 --- a/configs/workhorse/configuration.nix +++ b/configs/workhorse/configuration.nix @@ -59,8 +59,7 @@ configuration.init-ssh = { enable = "enabled"; kernelModules = [ "r8169" ]; - #hostECDSAKey = ; - hostECDSAKey = ; + hostKey = "/etc/ssh/ssh_host_ed25519_key"; }; # nix-shell -p speedtest_cli --run speedtest diff --git a/system/all/sshd-known-hosts-public.nix b/system/all/sshd-known-hosts-public.nix index 97af33f..c9861b5 100644 --- a/system/all/sshd-known-hosts-public.nix +++ b/system/all/sshd-known-hosts-public.nix @@ -41,7 +41,8 @@ with lib; # space-left gitlabSpaceLeft = { hostNames = [ "git.space-left.org" ]; - publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAapztj8I3xy6Ea8A1q7Mo5C6zdgsK1bguAXcKUDCRBO"; + publicKey = + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAapztj8I3xy6Ea8A1q7Mo5C6zdgsK1bguAXcKUDCRBO"; }; # c-base "bnd-cbase" = { diff --git a/system/server/initssh.nix b/system/server/initssh.nix index d0fe5ba..5b4dbf5 100644 --- a/system/server/initssh.nix +++ b/system/server/initssh.nix @@ -28,12 +28,13 @@ in { ++ (map (keyFile: lib.fileContents keyFile) config.users.users.root.openssh.authorizedKeys.keyFiles); }; - hostECDSAKey = mkOption { - default = null; - type = with types; nullOr path; + hostKey = mkOption { + default = "/etc/ssh/ssh_host_ed25519_key"; + type = with types; path; description = '' - you only need one host key - nix-shell -p dropbear --run "dropbearkey -t ecdsa -f ./host_ecdsa_key" + To generate keys, use ssh-keygen(1): + # ssh-keygen -t rsa -N "" -f /etc/secrets/initrd/ssh_host_rsa_key + # ssh-keygen -t ed25519 -N "" -f /etc/secrets/initrd/ssh_host_ed25519_key ''; }; @@ -91,10 +92,9 @@ in { enable = true; authorizedKeys = cfg.authorizedKeys; port = cfg.port; + hostKeys = [ cfg.hostKey ]; }; boot.initrd.availableKernelModules = cfg.kernelModules; - #boot.initrd.network.ssh.hostECDSAKey = cfg.hostECDSAKey; - boot.initrd.network.ssh.hostKeys = [ cfg.hostECDSAKey ]; }) ]; }