Changes...

lib/fudo/sites.nix

@@ -2,58 +2,62 @@
 
 with lib;
 let
+  hostname = config.instance.hostname;
+  site-name = config.fudo.hosts.${hostname}.site;
+  site-cfg = config.fudo.sites.${site-name};
+
   siteOpts = { site, ... }: {
-    options = {
+    options = with types; {
       site = mkOption {
-        type = types.str;
+        type = str;
         description = "Site name.";
         default = site;
       };
 
       network = mkOption {
-        type = types.str;
+        type = str;
         description = "Network to be treated as local.";
       };
 
       dynamic-network = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         description = "Network to be allocated by DHCP.";
         default = null;
       };
 
       gateway-v4 = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         description = "Gateway to use for public ipv4 internet access.";
         default = null;
       };
 
       gateway-v6 = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         description = "Gateway to use for public ipv6 internet access.";
         default = null;
       };
 
       gateway-host = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
         description = "Identity of the host to act as a gateway.";
         default = null;
       };
 
       local-groups = mkOption {
-        type = with types; listOf str;
+        type = listOf str;
         description = "List of groups which should exist at this site.";
         default = [ ];
       };
 
       local-users = mkOption {
-        type = with types; listOf str;
+        type = listOf str;
         description =
           "List of users which should exist on all hosts at this site.";
         default = [ ];
       };
 
       local-admins = mkOption {
-        type = with types; listOf str;
+        type = listOf str;
         description =
           "List of admin users which should exist on all hosts at this site.";
         default = [ ];
@@ -63,16 +67,34 @@ let
         mkEnableOption "Enable site-wide monitoring with prometheus.";
 
       nameservers = mkOption {
-        type = with types; listOf str;
+        type = listOf str;
         description = "List of nameservers to be used by hosts at this site.";
         default = [ ];
       };
 
       timezone = mkOption {
-        type = types.str;
+        type = str;
         description = "Timezone of the site.";
         example = "America/Winnipeg";
       };
+
+      deploy-pubkey = mkOption {
+        type = nullOr str;
+        description = "SSH pubkey of site deploy key. Used by dropbear daemon.";
+        default = null;
+      };
+
+      dropbear-rsa-key-path = mkOption {
+        type = str;
+        description = "Location of Dropbear RSA key.";
+        default = "/etc/dropbear/host_rsa_key";
+      };
+
+      dropbear-ecdsa-key-path = mkOption {
+        type = str;
+        description = "Location of Dropbear ECDSA key.";
+        default = "/etc/dropbear/host_ecdsa_key";
+      };
     };
   };
 
@@ -82,4 +104,45 @@ in {
     description = "Site configurations for all sites known to the system.";
     default = { };
   };
+
+  config = mkIf (site-cfg.deploy-pubkey != null) {
+    environment.etc."dropbear/authorized_keys" = {
+      text = "root@deploy ${site-cfg.deploy-pubkey}";
+      mode = "0400";
+    };
+
+    systemd.services = let dropbear-port = 2112;
+    in {
+
+      dropbear-init = {
+        wantedBy = [ "multi-user.target" ];
+        script = ''
+          if [ ! -d /etc/dropbear ]; then
+            mkdir /etc/dropbear
+            chmod 700 /etc/dropbear
+          fi
+
+          if [ ! -f ${site-cfg.dropbear-rsa-key-path} ]; then
+            ${pkgs.dropbear}/bin/dropbearkey -t rsa -f ${site-cfg.dropbear-rsa-key-path}
+            ${pkgs.coreutils}/bin/chmod 0400 ${site-cfg.dropbear-rsa-key-path}
+          fi
+
+          if [ ! -f ${site-cfg.dropbear-ecdsa-key-path} ]; then
+            ${pkgs.dropbear}/bin/dropbearkey -t ecdsa -f ${site-cfg.dropbear-ecdsa-key-path}
+            ${pkgs.coreutils}/bin/chmod 0400 ${site-cfg.dropbear-ecdsa-key-path}
+          fi
+        '';
+      };
+
+      dropbear = {
+        requires = [ "dropbear-init.service" ];
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+        serviceConfig = {
+          type = "simple";
+          ExecStart = "${pkgs.dropbear} -F -m -s -j -k -p ${dropbear-port}";
+        };
+      };
+    };
+  };
 }