Fiiiine, I'll just use a local fuckin file.
This commit is contained in:
+30
-45
@@ -3,49 +3,29 @@
|
||||
with lib;
|
||||
let
|
||||
hostname = config.instance.hostname;
|
||||
host-cfg = config.fudo.hosts.${hostname};
|
||||
ip = host-cfg.initrd-ip;
|
||||
initrd-cfg = config.fudo.hosts.${hostname}.initrd-network;
|
||||
|
||||
key-type = "ed25519";
|
||||
|
||||
key-filename = "ssh_host_${key-type}_key";
|
||||
|
||||
gen-host-keys = hostname: pkgs.stdenv.mkDerivation {
|
||||
name = "${hostname}-initrd-ssh-keys";
|
||||
gen-sshfp-records = hostname: pubkey: let
|
||||
pubkey-file = wirteTextFile {
|
||||
name = "${hostname}-initrd-ssh-pubkey";
|
||||
text = pubkey;
|
||||
};
|
||||
in pkgs.stdenv.mkDerivation {
|
||||
name = "${hostname}-initrd-ssh-firngerprint";
|
||||
|
||||
phases = [ "installPhase" ];
|
||||
|
||||
buildInputs = with pkgs; [ openssh ];
|
||||
|
||||
installPhase = ''
|
||||
mkdir $out
|
||||
ssh-keygen -q -t ${key-type} -N "" -f $out/ssh_host_${key-type}_key
|
||||
ssh-keygen -r REMOVEME -f "${pubkey-file}" | sed 's/^REMOVEME IN SSHFP //' >> $out/${hostname}-initrd-ssh-pubkey.sshfp
|
||||
'';
|
||||
};
|
||||
|
||||
gen-sshfp-records = host: key-pkg: pkgs.stdenv.mkDerivation {
|
||||
name = "${hostname}-initrd-ssh-fingerprints";
|
||||
|
||||
phases = [ "installPhase" ];
|
||||
|
||||
buildInputs = with pkgs; [ openssh ];
|
||||
|
||||
installPhase = ''
|
||||
mkdir $out
|
||||
ssh-keygen -r REMOVEME -f "${key-pkg}/${key-filename}" | sed 's/^REMOVEME IN SSHFP //' >> $out/${key-filename}.sshfp
|
||||
'';
|
||||
};
|
||||
|
||||
host-keys = genAttrs (attrNames config.instance.local-hosts)
|
||||
(hostname: gen-host-keys hostname);
|
||||
|
||||
in {
|
||||
config = mkIf (ip != null) {
|
||||
boot = let
|
||||
hostname = config.instance.hostname;
|
||||
in {
|
||||
config = mkIf (initrd-cfg != null) {
|
||||
boot = {
|
||||
kernelParams = [
|
||||
"ip=${ip}"
|
||||
n "ip=${initrd-cfg.ip}"
|
||||
];
|
||||
initrd = {
|
||||
network = {
|
||||
@@ -60,7 +40,7 @@ in {
|
||||
port = 22;
|
||||
authorizedKeys = admin-ssh-keys;
|
||||
hostKeys = [
|
||||
"/var/run/ssh/${key-filename}"
|
||||
initrd-cfg.keypair.private-key-file
|
||||
];
|
||||
};
|
||||
};
|
||||
@@ -68,21 +48,24 @@ in {
|
||||
};
|
||||
|
||||
fudo = {
|
||||
secrets.host-secrets = mapAttrs
|
||||
(hostname: key-pkg: {
|
||||
initrd-ssh-host-key = {
|
||||
source-file = "${key-pkg}/${key-filename}";
|
||||
target-file = "/var/run/ssh/${key-filename}";
|
||||
user = "root";
|
||||
};
|
||||
})
|
||||
host-keys;
|
||||
## Sigh...this doesn't work because the file isn't available soon enough
|
||||
## during activation.
|
||||
#
|
||||
# secrets.host-secrets = mapAttrs
|
||||
# (hostname: key-pkg: {
|
||||
# initrd-ssh-host-key = {
|
||||
# source-file = "${key-pkg}/${key-filename}";
|
||||
# target-file = "/var/run/ssh/${key-filename}";
|
||||
# user = "root";
|
||||
# };
|
||||
# })
|
||||
# host-keys;
|
||||
|
||||
local-network = {
|
||||
network-definition.hosts = mapAttrs'
|
||||
(hostname: hostOpts: nameValuePair "${hostname}-recovery"
|
||||
{
|
||||
ipv4-address = config.fudo.hosts.${hostname}.initrd-ip;
|
||||
ipv4-address = hostOpts.initrd-network-config.ip;
|
||||
description = "${hostname} initrd host";
|
||||
})
|
||||
config.instance.local-hosts;
|
||||
@@ -90,8 +73,10 @@ in {
|
||||
extra-records =
|
||||
mapAttrs
|
||||
(hostname: key-pkg: let
|
||||
sshfp-pkg = gen-sshfp-records hostname key-pkg;
|
||||
sshfps = read-lines "${sshfp-pkg}/${key-filename}.sshfp";
|
||||
sshfp-pkg =
|
||||
gen-sshfp-records
|
||||
hostname hostOpts.initrd-network-config.keypair.public-key;
|
||||
sshfps = read-lines "${sshfp-pkg}/${hostname}-initrd-ssh-pubkey.sshfp";
|
||||
in map (sshfp: "${hostname} IN SSHFP ${sshfp}") sshfps)
|
||||
host-keys;
|
||||
};
|
||||
|
||||
@@ -32,7 +32,7 @@ let
|
||||
secret-service = target-host: secret-name:
|
||||
{ source-file, target-file, user, group, permissions }: {
|
||||
description = "decrypt secret ${secret-name} for ${target-host}.";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
wantedBy = [ "default.target" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
ExecStartPre = pkgs.writeShellScript
|
||||
@@ -140,7 +140,7 @@ in {
|
||||
in {
|
||||
services = host-secret-services // {
|
||||
fudo-secrets-watcher = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
wantedBy = [ "default.target" ];
|
||||
description =
|
||||
"Ensure access for group ${cfg.secret-group} to fudo secret paths.";
|
||||
serviceConfig = {
|
||||
@@ -154,7 +154,7 @@ in {
|
||||
};
|
||||
|
||||
paths.fudo-secrets-watcher = mkIf ((length cfg.secret-paths) > 0) {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
wantedBy = [ "default.target" ];
|
||||
description = "Watch fudo secret paths, and correct perms on changes.";
|
||||
pathConfig = {
|
||||
PathChanged = cfg.secret-paths;
|
||||
|
||||
+20
-18
@@ -177,35 +177,37 @@ rec {
|
||||
|
||||
android-dev = mkEnableOption "Enable ADB on the host.";
|
||||
|
||||
# FIXME: This probably belongs elsewhere...
|
||||
initrd-ip = mkOption {
|
||||
type = nullOr str;
|
||||
description = "IP to assign to the kernel/initrd, to allow access when boot fails.";
|
||||
default = null;
|
||||
};
|
||||
|
||||
initrd-ssh-keypair = let
|
||||
keypair = { ... }: {
|
||||
initrd-network = let
|
||||
keypair-type = { ... }: {
|
||||
options = {
|
||||
public-key = mkOption {
|
||||
type = str;
|
||||
description = "SSH public key.";
|
||||
};
|
||||
|
||||
private-key = mkOption {
|
||||
private-key-file = mkOption {
|
||||
type = str;
|
||||
description = "SSH private key.";
|
||||
};
|
||||
|
||||
type = mkOption {
|
||||
type = enum [ "rsa" "ecdsa" "ed25519" ];
|
||||
description = "SSH key type.";
|
||||
description = "Path to SSH private key (on the local host!).";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
initrd-network-config = { ... }: {
|
||||
options = {
|
||||
ip = mkOption {
|
||||
type = str;
|
||||
description = "IP to assign to the initrd image, allowing access to host during bootup.";
|
||||
};
|
||||
keypair = mkOption {
|
||||
type = keypair-type;
|
||||
description = "SSH host key pair to use for initrd.";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
in mkOption {
|
||||
type = nullOr (submodule keypair);
|
||||
description = "SSH Keypair to use for initrd.";
|
||||
type = nullOr (submodule initrd-network-config);
|
||||
description = "Configuration parameters to set up initrd SSH network.";
|
||||
default = null;
|
||||
};
|
||||
};
|
||||
|
||||
Reference in New Issue
Block a user