nix/nixos-config
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Use primary SSH server for deploy...but use a backup ssh server too.

Browse Source
This commit is contained in:
Root
2021-04-10 10:43:40 -07:00
parent 1d89667433
commit 43e11861d1
3 changed files with 32 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/fudo/sites.nix
+29 -27
View File
@@ -84,6 +84,8 @@ let
default = null;
};
enable-ssh-backdoor = mkEnableOption "Enable a backup SSH server in case of failures of the primary.";
dropbear-rsa-key-path = mkOption {
type = str;
description = "Location of Dropbear RSA key.";
@@ -96,7 +98,7 @@ let
default = "/etc/dropbear/host_ecdsa_key";
};
dropbear-deploy-port = mkOption {
dropbear-port = mkOption {
type = port;
description = "Port to be used for the deploy SSH server.";
default = 2112;
@@ -111,15 +113,15 @@ in {
default = { };
};
config = mkIf (site-cfg.deploy-pubkey != null) {
environment.etc."dropbear/authorized_keys" = {
text = "${site-cfg.deploy-pubkey} root@deploy";
mode = "0400";
};
config = {
users.users.root.openssh.authorizedKeys.keys = mkIf (site-cfg.deploy-pubkey != null) [
site-cfg.deploy-pubkey
];
networking.firewall.allowedTCPPorts = [ site-cfg.dropbear-deploy-port ];
networking.firewall.allowedTCPPorts = mkIf site-cfg.enable-ssh-backdoor
[ site-cfg.dropbear-deploy-port ];
systemd = {
systemd = mkIf site-cfg.enable-ssh-backdoor {
sockets = {
dropbear-deploy = {
wantedBy = [ "sockets.target" ];
@@ -127,40 +129,40 @@ in {
ListenStream = "0.0.0.0:${toString site-cfg.dropbear-deploy-port}";
Accept = true;
};
unitConfig = {
restartIfChanged = true;
};
unitConfig = { restartIfChanged = true; };
};
};
services = {
dropbear-deploy-init = {
wantedBy = [ "multi-user.target" ];
script = ''
if [ ! -d /etc/dropbear ]; then
mkdir /etc/dropbear
chmod 700 /etc/dropbear
fi
if [ ! -d /etc/dropbear ]; then
mkdir /etc/dropbear
chmod 700 /etc/dropbear
fi
if [ ! -f ${site-cfg.dropbear-rsa-key-path} ]; then
${pkgs.dropbear}/bin/dropbearkey -t rsa -f ${site-cfg.dropbear-rsa-key-path}
${pkgs.coreutils}/bin/chmod 0400 ${site-cfg.dropbear-rsa-key-path}
fi
if [ ! -f ${site-cfg.dropbear-rsa-key-path} ]; then
${pkgs.dropbear}/bin/dropbearkey -t rsa -f ${site-cfg.dropbear-rsa-key-path}
${pkgs.coreutils}/bin/chmod 0400 ${site-cfg.dropbear-rsa-key-path}
fi
if [ ! -f ${site-cfg.dropbear-ecdsa-key-path} ]; then
${pkgs.dropbear}/bin/dropbearkey -t ecdsa -f ${site-cfg.dropbear-ecdsa-key-path}
${pkgs.coreutils}/bin/chmod 0400 ${site-cfg.dropbear-ecdsa-key-path}
fi
'';
if [ ! -f ${site-cfg.dropbear-ecdsa-key-path} ]; then
${pkgs.dropbear}/bin/dropbearkey -t ecdsa -f ${site-cfg.dropbear-ecdsa-key-path}
${pkgs.coreutils}/bin/chmod 0400 ${site-cfg.dropbear-ecdsa-key-path}
fi
'';
};
"dropbear-deploy@" = {
description = "Per-connection service for deployment, using dropbear.";
description =
"Per-connection service for deployment, using dropbear.";
requires = [ "dropbear-deploy-init.service" ];
after = [ "network.target" ];
serviceConfig = {
Type = "simple";
ExecStart = "${pkgs.dropbear}/bin/dropbear -F -i -m -s -j -k -r ${site-cfg.dropbear-rsa-key-path} -r ${site-cfg.dropbear-ecdsa-key-path}";
ExecStart =
"${pkgs.dropbear}/bin/dropbear -F -i -m -s -j -k -r ${site-cfg.dropbear-rsa-key-path} -r ${site-cfg.dropbear-ecdsa-key-path}";
ExecReload = "${pkgs.utillinux}/bin/kill -HUP $MAINPID";
StandardInput = "socket";
};