65 lines
2.0 KiB
Nix
65 lines
2.0 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
let
|
|
hostname = config.fudo.instance.hostname;
|
|
has-attrs = set: length (attrNames set) > 0;
|
|
host-keypairs = config.fudo.secrets.files.host-ssh-keypairs.${hostname};
|
|
|
|
sshfp-filename = host: keypair: "ssh-${host}-${keypair.key-type}.sshfp-record";
|
|
|
|
dns-sshfp-records = host: keypair: let
|
|
filename = sshfp-filename host keypair;
|
|
in mkDerivation {
|
|
buildInputs = with pkgs; [ openssh ];
|
|
|
|
buildPhase = ''
|
|
ssh-keygen -r REMOVEME -f ${keypair.public-key} | sed 's/^REMOVEME IN SSHFP //' > ${filename}
|
|
'';
|
|
|
|
installPhase = ''
|
|
mv ${filename} $out/${filename}
|
|
'';
|
|
};
|
|
|
|
in {
|
|
config = {
|
|
fudo = {
|
|
secrets.host-secrets.${hostname} = mkIf (host-keypairs != [])
|
|
map (keypair: {
|
|
"host-${keypair.key-type}-private-key" = {
|
|
source-file = keypair.private-key;
|
|
target-file = "/var/run/ssh/private/host-${keypair.key-type}-private-key";
|
|
user = "root";
|
|
};
|
|
});
|
|
|
|
hosts = mapAttrs (hostname: keypairs: {
|
|
ssh-pubkeys = map (keypair: keypair.public-key) keypairs;
|
|
ssh-fingerprints = map (keypair:
|
|
let
|
|
fingerprint-derivation = dns-sshfp-records hostname keypair.public-key;
|
|
filename = sshfp-filename hostname keypair;
|
|
in builtins.readFile "${fingerprint-derivation}/${filename}") keypairs;
|
|
} config.fudo.secrets.files.host-ssh-keypairs);
|
|
|
|
|
|
};
|
|
|
|
services.openssh.hostKeys = mkIf (host-keypairs != [])
|
|
(map (keypair: {
|
|
path = "/var/run/ssh/private/host-${keypair.key-type}-private-key";
|
|
type = keypair.key-type;
|
|
}) host-keypairs);
|
|
|
|
programs.ssh.knownHosts = mapAttrs (hostname: keypairs: {
|
|
publicKeyFile = keypairs.public-key;
|
|
hostNames = let
|
|
host-cfg = config.fudo.hosts.${hostname};
|
|
domains = [host-cfg.domain] ++ host-cfg.extra-domains;
|
|
in [ hostname ] ++
|
|
(map (domain: "${hostname}.${domain}") domains);
|
|
});
|
|
};
|
|
}
|