Fixed deploy keys and added ssh keys pushed from deploy server

lib/fudo/hosts.nix

@@ -2,6 +2,8 @@
 
 with lib;
 let
+  mapOptional = f: val: if (val != null) then (f val) else null;
+
   hostOpts = { hostname, ... }: {
     options = with types; {
       domain = mkOption {
@@ -183,14 +185,6 @@ in {
       #defaultGateway = site.gateway-v4;
       #defaultGateway6 = site.gateway-v6;
 
-      # Necessary to ensure that Kerberos and Avahi both work. Kerberos needs
-      # the fqdn of the host, whereas Avahi wants just the simple hostname.`
-      # hosts = {
-      #   "127.0.0.2" = mkForce [ "${hostname}.${domain-name}" "${hostname}" ];
-      #   "127.0.0.1" = mkForce [ "${hostname}.${domain-name}" "${hostname}" ];
-      #   "::1" = mkForce [ "${hostname}.${domain-name}" "${hostname}" ];
-      # };
-
       firewall = {
         enable = (length host-cfg.external-interfaces) > 0;
         allowedTCPPorts = [ 22 ];
@@ -214,6 +208,11 @@ in {
       mode = "0444";
     };
 
+    fudo.hosts.${hostname}.build-pubkeys =
+      map builtins.readFile
+        (map (build-key-path: "${build-key-path}/${hostname}.key.pub")
+          (optional (site.build-key-path != null) site.build-key-path));
+
     nix = mkIf
       (has-build-servers && has-build-keys && site.enable-distributed-builds) {
         buildMachines = mapAttrsToList (hostname: buildOpts: {
@@ -221,6 +220,7 @@ in {
           maxJobs = buildOpts.max-jobs;
           speedFactor = buildOpts.speed-factor;
           supportedFeatures = buildOpts.supported-features;
+          sshKey = config.fudo.secrets.host-secrets.${hostname}.build-private-key.target-file;
         }) site.build-servers;
         distributedBuilds = true;
       };
@@ -242,18 +242,30 @@ in {
 
     boot.tmpOnTmpfs = host-cfg.tmp-on-tmpfs;
 
-    fudo.secrets.host-secrets.${hostname}.host-keytab = let
-      mapOptional = f: val: if (val != null) then (f val) else null;
-      keytab-file = mapOptional (keytab-path:
-        if (pathExists keytab-path) then
-          /. + builtins.toPath keytab-path
-        else
-          null) (mapOptional (keytab-dir: "${keytab-dir}/${hostname}.keytab")
-            site.keytab-directory);
-    in mkIf (keytab-file != null) {
-      source-file = /. + builtins.toPath keytab-file;
-      target-file = "/etc/krb5.keytab";
-      user = "root";
+    fudo.secrets.host-secrets.${hostname} = {
+      host-keytab = let
+        keytab-file = mapOptional (keytab-path:
+          if (pathExists keytab-path) then
+            /. + builtins.toPath keytab-path
+          else
+            null) (mapOptional (keytab-dir: "${keytab-dir}/${hostname}.keytab")
+              site.keytab-path);
+      in mkIf (keytab-file != null) {
+        source-file = /. + builtins.toPath keytab-file;
+        target-file = "/etc/krb5.keytab";
+        user = "root";
+      };
+
+      build-private-key = let
+        build-key-file = mapOptional
+          (build-key-file: if (pathExists build-key-file) then (/. + builtins.toPath build-key-file) else null)
+          (mapOptional (build-key-path: "${build-key-path}/${hostname}.key")
+            site.build-key-path);
+      in mkIf (build-key-file != null) {
+        source-file = build-key-file;
+        target-file = "/var/run/nix-build/host.key";
+        user = "root";
+      };
     };
 
     programs.adb.enable = host-cfg.android-dev;

lib/fudo/sites.nix

@@ -140,7 +140,7 @@ let
         default = [ ];
       };
 
-      keytab-directory = mkOption {
+      keytab-path = mkOption {
         type = nullOr str;
         description = ''
           Directory containing site keytabs (files named $hostname.keytab).
@@ -149,6 +149,16 @@ let
         '';
         default = null;
       };
+
+      build-key-path = mkOption {
+        type = nullOr str;
+        description = ''
+          Directory containing host build keys (files named $hostname.key).
+
+          Should exist only on build host.
+        '';
+        default = null;
+      };
     };
   };
 

lib/fudo/users.nix

@@ -94,6 +94,26 @@ let
         description = "List of Kerberos principals that map to this user.";
         default = [ ];
       };
+
+      ssh-keys = mkOption {
+        type = nullOr (submodule sshKeyOpts);
+        description = "Path to the user's public and private key files.";
+        default = null;
+      };
+    };
+  };
+
+  sshKeyOpts = { ... }: {
+    options = with types; {
+      private-key = mkOption {
+        type = str;
+        description = "Path to the user's private key.";
+      };
+
+      public-key = mkOption {
+        type = str;
+        description = "Path to the user's public key.";
+      };
     };
   };
 
@@ -211,6 +231,16 @@ in {
       }) config.fudo.system-users;
     };
 
+    programs.ssh.extraConfig = mkAfter ''
+      IdentityFile %h/.ssh/id_rsa
+      IdentityFile /etc/ssh/private_keys.d/%u.key
+    '';
+
+    environment.etc = let
+      privkey-users = filterAttrs (username: userOpts: userOpts.ssh-keys != null) sys.local-users;
+    in mapAttrs' (username: userOpts:
+      nameValuePair "ssh/private_keys.bd/${username}.key" userOpts.ssh-keys.private-key) privkey-users;
+
     users = {
       users = mapAttrs (username: userOpts: {
         isNormalUser = true;