Make all hosts' initrd network-accessible

First attempt

lib/default.nix

@@ -20,6 +20,7 @@ with lib; {
     ./fudo/global.nix
     ./fudo/grafana.nix
     ./fudo/hosts.nix
+    ./fudo/initrd-network.nix
     ./fudo/ipfs.nix
     ./fudo/kdc.nix
     ./fudo/ldap.nix

lib/fudo/hosts.nix

@@ -106,8 +106,6 @@ in {
       autoPrune.enable = true;
     };
 
-    boot.tmpOnTmpfs = host-cfg.tmp-on-tmpfs;
-
     fudo = let
       try-attr = attr: set: if (hasAttr attr set) then set.${attr} else null;
 
@@ -153,6 +151,8 @@ in {
       members = config.instance.local-admins;
     };
 
+    boot.tmpOnTmpfs = host-cfg.tmp-on-tmpfs;
+
     # programs.ssh.knownHosts = let
     #   keyed-hosts =
     #     filterAttrs (host: opts: opts.ssh-pubkeys != []) config.fudo.hosts;

lib/fudo/initrd-network.nix

@@ -0,0 +1,92 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  hostname = config.instance.hostname;
+  host-cfg = config.fudo.hosts.${hostname};
+  ip = host-cfg.initrd-ip;
+
+  gen-host-keys = hostname: pkgs.stdenv.mkDerivation {
+    name = "${hostname}-initrd-ssh-keys";
+
+    phases = [ "installPhase" ];
+
+    buildInputs = with pkgs; [ openssh ];
+
+    installPhase = ''
+      mkdir $out
+      ssh-keygen -q -t ed25519 -N "" -f $out/ssh_host_ed25519_key
+    '';
+  };
+
+  gen-sshfp-records = host: key-pkg: pkgs.stdenv.mkDerivation {
+    name = "${hostname}-initrd-ssh-fingerprints";
+
+    phases = [ "installPhase" ];
+
+    buildInputs = with pkgs; [ openssh ];
+
+    installPhase = ''
+      mkdir $out
+      ssh-keygen -r REMOVEME -f "${key-pkg}/ssh_host_ed25519_key" | sed 's/^REMOVEME IN SSHFP //' >> $out/ssh_host_ed25519_key.sshfp
+    '';
+  };
+
+  host-keys = genAttrs (attrNames config.instance.local-hosts)
+    (hostname: gen-host-keys hostname);
+
+in {
+  config = mkIf (ip != null) {
+    boot = {
+      kernelParams = [
+        "ip=${ip}"
+      ];
+      initrd = let
+        host-key-pkg = host-keys.${config.instance.hostname};
+        host-privkey = "${key-pkg}/ssh_host_ed25519_key";
+        initrd-keypath = "/var/run/secrets/ssh/ssh_host_ed25519_key";
+      in {
+        secrets = {
+          "${initrd-keypath}" = host-privkey;
+        };
+
+        network = {
+          enable = true;
+
+          ssh = let
+            admin-ssh-keys =
+              concatMap (admin: config.fudo.users.${admin}.ssh-authorized-keys)
+                config.instance.local-admins;
+          in {
+            enable = true;
+            port = 22;
+            authorizedKeys = admin-ssh-keys;
+            hostKeys = [
+              initrd-keypath
+            ];
+          };
+        };
+      };
+    };
+
+    fudo = {
+      local-network = {
+        network-definition.hosts = mapAttrs'
+          (hostname: hostOpts: nameValuePair "${hostname}-recovery"
+            {
+              ipv4-address = config.fudo.hosts.${hostname}.initrd-ip;
+              description = "${hostname} initrd host";
+            })
+          config.instance.local-hosts;
+
+        extra-records =
+          mapAttrs
+            (hostname: key-pkg: let
+              sshfp-pkg = gen-sshfp-records hostname key-pkg;
+              sshfps = read-lines "${sshfp-pkg}/ssh_host_ed25519_key.sshfp";
+            in map (sshfp: "${hostname} IN SSHFP ${sshfp}") sshfps)
+            host-keys;
+      };
+    };
+  };
+}

lib/fudo/local-network.nix

@@ -74,13 +74,19 @@ in {
       default = [ ];
     };
 
-    network-definition =
-      let networkOpts = import ../types/network-definition.nix { inherit lib; };
-      in mkOption {
-        type = submodule networkOpts;
-        description = "Definition of network to be served by local server.";
-        default = { };
-      };
+    network-definition = let
+      networkOpts = import ../types/network-definition.nix { inherit lib; };
+    in mkOption {
+      type = submodule networkOpts;
+      description = "Definition of network to be served by local server.";
+      default = { };
+    };
+
+    extra-records = mkOption {
+      type = listOf str;
+      description = "Extra records to add to the local zone.";
+      default = [ ];
+    };
   };
 
   config = mkIf cfg.enable {
@@ -224,6 +230,7 @@ in {
           ${join-lines (mapAttrsToList cnameRecord network.aliases)}
           ${join-lines network.verbatim-dns-records}
           ${pkgs.lib.fudo.dns.srvRecordsToBindZone network.srv-records}
+          ${join-lines cfg.extra-records}
         '';
       }] ++ blockZones;
     };

lib/fudo/ssh.nix

@@ -51,8 +51,6 @@ in {
             filename = sshfp-filename hostname keypair;
           in read-lines "${fingerprint-derivation}/${filename}") keypairs;
       }) config.fudo.secrets.files.host-ssh-keypairs;
-
-
     };
 
     services.openssh.hostKeys = map (keypair: {

lib/types/host.nix

@@ -176,6 +176,38 @@ rec {
       };
 
       android-dev = mkEnableOption "Enable ADB on the host.";
+
+      # FIXME: This probably belongs elsewhere...
+      initrd-ip = mkOption {
+        type = nullOr str;
+        description = "IP to assign to the kernel/initrd, to allow access when boot fails.";
+        default = null;
+      };
+
+      initrd-ssh-keypair = let
+        keypair = { ... }: {
+          options = {
+            public-key = mkOption {
+              type = str;
+              description = "SSH public key.";
+            };
+
+            private-key = mkOption {
+              type = str;
+              description = "SSH private key.";
+            };
+
+            type = mkOption {
+              type = enum [ "rsa" "ecdsa" "ed25519" ];
+              description = "SSH key type."
+            };
+          };
+        };
+      in mkOption {
+        type = nullOr (submodule keypair);
+        description = "SSH Keypair to use for initrd.";
+        default = null;
+      };
     };
   };
 }