From 3e5ebafed6435f47ed2e8dae3b87e45ae086d56b Mon Sep 17 00:00:00 2001 From: Sam Date: Thu, 23 May 2024 09:48:00 +0000 Subject: [PATCH] sops to create ssh keys for users --- flake.lock | 26 +++++++++++++------------- hosts/common/core/default.nix | 2 +- hosts/common/core/sops.nix | 16 ++++++++-------- hosts/common/optional/openssh.nix | 6 ++++++ hosts/common/users/media/default.nix | 15 +++++++++++++++ hosts/common/users/sam/default.nix | 8 +++++++- hosts/sparky/default.nix | 4 +++- 7 files changed, 53 insertions(+), 24 deletions(-) diff --git a/flake.lock b/flake.lock index 38191df..288083a 100644 --- a/flake.lock +++ b/flake.lock @@ -7,11 +7,11 @@ ] }, "locked": { - "lastModified": 1716394172, - "narHash": "sha256-B+pNhV8GFeCj9/MoH+qtGqKbgv6fU4hGaw2+NoYYtB0=", + "lastModified": 1716431128, + "narHash": "sha256-t3T8HlX3udO6f4ilLcN+j5eC3m2gqsouzSGiriKK6vk=", "owner": "nix-community", "repo": "disko", - "rev": "23c63fb09334c3e8958b57e2ddc3870b75b9111d", + "rev": "7ffc4354dfeb37c8c725ae1465f04a9b45ec8606", "type": "github" }, "original": { @@ -27,11 +27,11 @@ ] }, "locked": { - "lastModified": 1715930644, - "narHash": "sha256-W9pyM3/vePxrffHtzlJI6lDS3seANQ+Nqp+i58O46LI=", + "lastModified": 1716448020, + "narHash": "sha256-u1ddoBOILtLVX4NYzqSZ9Qaqusql1M4reLd1fs554hY=", "owner": "nix-community", "repo": "home-manager", - "rev": "e3ad5108f54177e6520535768ddbf1e6af54b59d", + "rev": "25dedb0d52c20448f6a63cc346df1adbd6ef417e", "type": "github" }, "original": { @@ -58,11 +58,11 @@ "nix-secrets": { "flake": false, "locked": { - "lastModified": 1716409441, - "narHash": "sha256-9H4tYbE2JAB+2+zc+ZfjKgaFa/dVsg80Bn1pv7lsw14=", + "lastModified": 1716456952, + "narHash": "sha256-fd57j4M++Fte1hrRZkDIqGbYbimqPNmERlFr/Fbh1Ek=", "ref": "refs/heads/master", - "rev": "87aeda54c8ce2f34e22585c158021636801c8c1f", - "revCount": 24, + "rev": "f5abdf254dbee888be5f65c96a4a571f2a91da91", + "revCount": 28, "type": "git", "url": "ssh://git@git.bitlab21.com/sam/nix-secrets.git" }, @@ -101,11 +101,11 @@ }, "nixpkgs-unstable": { "locked": { - "lastModified": 1716293225, - "narHash": "sha256-pU9ViBVE3XYb70xZx+jK6SEVphvt7xMTbm6yDIF4xPs=", + "lastModified": 1716330097, + "narHash": "sha256-8BO3B7e3BiyIDsaKA0tY8O88rClYRTjvAp66y+VBUeU=", "owner": "nixos", "repo": "nixpkgs", - "rev": "3eaeaeb6b1e08a016380c279f8846e0bd8808916", + "rev": "5710852ba686cc1fd0d3b8e22b3117d43ba374c2", "type": "github" }, "original": { diff --git a/hosts/common/core/default.nix b/hosts/common/core/default.nix index 790e75c..0da9641 100644 --- a/hosts/common/core/default.nix +++ b/hosts/common/core/default.nix @@ -1,4 +1,4 @@ -{pkgs, lib, inputs, config, ...}: +{ pkgs, lib, inputs, config, ...}: { imports = [ ./sops.nix diff --git a/hosts/common/core/sops.nix b/hosts/common/core/sops.nix index a78e6ea..dbd1b64 100644 --- a/hosts/common/core/sops.nix +++ b/hosts/common/core/sops.nix @@ -1,9 +1,8 @@ -{ pkgs, inputs, config, ... }: +{ pkgs, inputs, config, username, ... }: + let secretsDirectory = builtins.toString inputs.nix-secrets; secretsFile = "${secretsDirectory}/secrets.yaml"; - hostname = config.networking.hostName; - username = config.username; in { imports = [ @@ -17,10 +16,11 @@ in age = { sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; }; - secrets = builtins.merge ({ - "passwords/root".neededForUsers = true; - }) - if username != null then { "passwords/${username}".neededForUsers = true; } else {}; - }; + secrets = { + "passwords/root".neededForUsers = true; + "ssh_keys/deploy_key/id_ed25519" = { + path = "/etc/ssh/deploy_key-ssh-ed25519"; + }; + }; }; } diff --git a/hosts/common/optional/openssh.nix b/hosts/common/optional/openssh.nix index 6088f56..1ed4db4 100644 --- a/hosts/common/optional/openssh.nix +++ b/hosts/common/optional/openssh.nix @@ -23,5 +23,11 @@ in security.pam = { sshAgentAuth.enable = true; }; + programs.ssh.extraConfig = '' + Host git.bitlab21.com + IdentitiesOnly yes + StrictHostKeyChecking no + IdentityFile /etc/ssh/deploy_key-ssh-ed25519 + ''; networking.firewall.allowedTCPPorts = [ sshPort ]; } diff --git a/hosts/common/users/media/default.nix b/hosts/common/users/media/default.nix index f395418..b1e8591 100644 --- a/hosts/common/users/media/default.nix +++ b/hosts/common/users/media/default.nix @@ -3,6 +3,8 @@ let pubKeys = lib.filesystem.listFilesRecursive (../keys); hostname = config.networking.hostName; sopsHashedPasswordFile = lib.optionalString (lib.hasAttr "sops-nix" inputs) config.sops.secrets."passwords/media".path; + secretsDirectory = builtins.toString inputs.nix-secrets; + secretsFile = "${secretsDirectory}/secrets.yaml"; in { users.users.media = { @@ -19,6 +21,19 @@ in }; + sops.secrets."passwords/media" = { + sopsFile = "${secretsFile}"; + neededForUsers = true; + }; + + sops.secrets."ssh_keys/media/id_ed25519" = { + path = "/home/media/.ssh/id_ed25519"; + }; + + sops.secrets."ssh_keys/media/id_ed25519.pub" = { + path = "/home/media/.ssh/id_ed25519.pub"; + }; + programs.zsh.enable = true; programs.fuse.userAllowOther = true; diff --git a/hosts/common/users/sam/default.nix b/hosts/common/users/sam/default.nix index 9ca6dcc..c2a1dde 100644 --- a/hosts/common/users/sam/default.nix +++ b/hosts/common/users/sam/default.nix @@ -3,7 +3,8 @@ let hostname = config.networking.hostName; pubKeys = lib.filesystem.listFilesRecursive (../keys); sopsHashedPasswordFile = lib.optionalString (lib.hasAttr "sops-nix" inputs) config.sops.secrets."passwords/sam".path; - + secretsDirectory = builtins.toString inputs.nix-secrets; + secretsFile = "${secretsDirectory}/secrets.yaml"; in { users.users.sam = { @@ -23,6 +24,11 @@ in }; + sops.secrets."passwords/sam" = { + sopsFile = "${secretsFile}"; + neededForUsers = true; + }; + programs.zsh.enable = true; home-manager = { diff --git a/hosts/sparky/default.nix b/hosts/sparky/default.nix index 6739c9e..036893e 100644 --- a/hosts/sparky/default.nix +++ b/hosts/sparky/default.nix @@ -1,6 +1,8 @@ { inputs, config, lib, pkgs, outputs,... }: let sopsHashedPasswordFile = lib.optionalString (lib.hasAttr "sops-nix" inputs) config.sops.secrets."passwords/root".path; + secretsDirectory = builtins.toString inputs.nix-secrets; + secretsFile = "${secretsDirectory}/secrets.yaml"; in { imports = @@ -48,7 +50,7 @@ in "/etc/ssh/ssh_host_ed25519_key" "/etc/ssh/ssh_host_ed25519_key.pub" ]; - users.${config.username} = { + users.media= { directories = [ "sync" "keep"