palo/nixos-config
palo/nixos-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

wip on init-ssh

Browse source
This commit is contained in:
Ingolf Wagner 2021-04-24 14:23:51 +02:00
parent 90cd3df0c8
commit e9a180ab77
No known key found for this signature in database
GPG key ID: 76BF5F1928B9618B
3 changed files with 10 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
configs/workhorse/configuration.nix
View file

@ -59,8 +59,7 @@
configuration.init-ssh = { configuration.init-ssh = {
enable = "enabled"; enable = "enabled";
kernelModules = [ "r8169" ]; kernelModules = [ "r8169" ];
#hostECDSAKey = <secrets/init-ssh/host_ecdsa_key>; hostKey = "/etc/ssh/ssh_host_ed25519_key";
hostECDSAKey = <secrets/init-ssh/ssh_host_ed25519_key>;
}; };
# nix-shell -p speedtest_cli --run speedtest # nix-shell -p speedtest_cli --run speedtest

3
system/all/sshd-known-hosts-public.nix
View file

@ -41,7 +41,8 @@ with lib;
# space-left # space-left
gitlabSpaceLeft = { gitlabSpaceLeft = {
hostNames = [ "git.space-left.org" ]; hostNames = [ "git.space-left.org" ];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAapztj8I3xy6Ea8A1q7Mo5C6zdgsK1bguAXcKUDCRBO"; publicKey =
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAapztj8I3xy6Ea8A1q7Mo5C6zdgsK1bguAXcKUDCRBO";
}; };
# c-base # c-base
"bnd-cbase" = { "bnd-cbase" = {

14
system/server/initssh.nix
View file

@ -28,12 +28,13 @@ in {
++ (map (keyFile: lib.fileContents keyFile) ++ (map (keyFile: lib.fileContents keyFile)
config.users.users.root.openssh.authorizedKeys.keyFiles); config.users.users.root.openssh.authorizedKeys.keyFiles);
}; };
hostECDSAKey = mkOption { hostKey = mkOption {
default = null; default = "/etc/ssh/ssh_host_ed25519_key";
type = with types; nullOr path; type = with types; path;
description = '' description = ''
you only need one host key To generate keys, use ssh-keygen(1):
nix-shell -p dropbear --run "dropbearkey -t ecdsa -f ./host_ecdsa_key" # ssh-keygen -t rsa -N "" -f /etc/secrets/initrd/ssh_host_rsa_key
# ssh-keygen -t ed25519 -N "" -f /etc/secrets/initrd/ssh_host_ed25519_key
''; '';
}; };
@ -91,10 +92,9 @@ in {
enable = true; enable = true;
authorizedKeys = cfg.authorizedKeys; authorizedKeys = cfg.authorizedKeys;
port = cfg.port; port = cfg.port;
hostKeys = [ cfg.hostKey ];
}; };
boot.initrd.availableKernelModules = cfg.kernelModules; boot.initrd.availableKernelModules = cfg.kernelModules;
#boot.initrd.network.ssh.hostECDSAKey = cfg.hostECDSAKey;
boot.initrd.network.ssh.hostKeys = [ cfg.hostECDSAKey ];
}) })
]; ];
} }