sam
/
nixos
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

sops to create ssh keys for users

This commit is contained in:
Sam 2024-05-23 09:48:00 +00:00
parent 1c0725912d
commit 3e5ebafed6
7 changed files with 53 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
flake.lock
View File

@ -7,11 +7,11 @@
]
},
"locked": {
"lastModified": 1716394172,
"narHash": "sha256-B+pNhV8GFeCj9/MoH+qtGqKbgv6fU4hGaw2+NoYYtB0=",
"lastModified": 1716431128,
"narHash": "sha256-t3T8HlX3udO6f4ilLcN+j5eC3m2gqsouzSGiriKK6vk=",
"owner": "nix-community",
"repo": "disko",
"rev": "23c63fb09334c3e8958b57e2ddc3870b75b9111d",
"rev": "7ffc4354dfeb37c8c725ae1465f04a9b45ec8606",
"type": "github"
},
"original": {
@ -27,11 +27,11 @@
]
},
"locked": {
"lastModified": 1715930644,
"narHash": "sha256-W9pyM3/vePxrffHtzlJI6lDS3seANQ+Nqp+i58O46LI=",
"lastModified": 1716448020,
"narHash": "sha256-u1ddoBOILtLVX4NYzqSZ9Qaqusql1M4reLd1fs554hY=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "e3ad5108f54177e6520535768ddbf1e6af54b59d",
"rev": "25dedb0d52c20448f6a63cc346df1adbd6ef417e",
"type": "github"
},
"original": {
@ -58,11 +58,11 @@
"nix-secrets": {
"flake": false,
"locked": {
"lastModified": 1716409441,
"narHash": "sha256-9H4tYbE2JAB+2+zc+ZfjKgaFa/dVsg80Bn1pv7lsw14=",
"lastModified": 1716456952,
"narHash": "sha256-fd57j4M++Fte1hrRZkDIqGbYbimqPNmERlFr/Fbh1Ek=",
"ref": "refs/heads/master",
"rev": "87aeda54c8ce2f34e22585c158021636801c8c1f",
"revCount": 24,
"rev": "f5abdf254dbee888be5f65c96a4a571f2a91da91",
"revCount": 28,
"type": "git",
"url": "ssh://git@git.bitlab21.com/sam/nix-secrets.git"
},
@ -101,11 +101,11 @@
},
"nixpkgs-unstable": {
"locked": {
"lastModified": 1716293225,
"narHash": "sha256-pU9ViBVE3XYb70xZx+jK6SEVphvt7xMTbm6yDIF4xPs=",
"lastModified": 1716330097,
"narHash": "sha256-8BO3B7e3BiyIDsaKA0tY8O88rClYRTjvAp66y+VBUeU=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "3eaeaeb6b1e08a016380c279f8846e0bd8808916",
"rev": "5710852ba686cc1fd0d3b8e22b3117d43ba374c2",
"type": "github"
},
"original": {

2
hosts/common/core/default.nix
View File

@ -1,4 +1,4 @@
{pkgs, lib, inputs, config, ...}:
{ pkgs, lib, inputs, config, ...}:
{
imports = [
./sops.nix

12
hosts/common/core/sops.nix
View File

@ -1,9 +1,8 @@
{ pkgs, inputs, config, ... }:
{ pkgs, inputs, config, username, ... }:
let
secretsDirectory = builtins.toString inputs.nix-secrets;
secretsFile = "${secretsDirectory}/secrets.yaml";
hostname = config.networking.hostName;
username = config.username;
in
{
imports = [
@ -17,10 +16,11 @@ in
age = {
sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
};
secrets = builtins.merge ({
secrets = {
"passwords/root".neededForUsers = true;
})
if username != null then { "passwords/${username}".neededForUsers = true; } else {};
"ssh_keys/deploy_key/id_ed25519" = {
path = "/etc/ssh/deploy_key-ssh-ed25519";
};
};
};
}

6
hosts/common/optional/openssh.nix
View File

@ -23,5 +23,11 @@ in
security.pam = {
sshAgentAuth.enable = true;
};
programs.ssh.extraConfig = ''
Host git.bitlab21.com
IdentitiesOnly yes
StrictHostKeyChecking no
IdentityFile /etc/ssh/deploy_key-ssh-ed25519
'';
networking.firewall.allowedTCPPorts = [ sshPort ];
}

15
hosts/common/users/media/default.nix
View File

@ -3,6 +3,8 @@ let
pubKeys = lib.filesystem.listFilesRecursive (../keys);
hostname = config.networking.hostName;
sopsHashedPasswordFile = lib.optionalString (lib.hasAttr "sops-nix" inputs) config.sops.secrets."passwords/media".path;
secretsDirectory = builtins.toString inputs.nix-secrets;
secretsFile = "${secretsDirectory}/secrets.yaml";
in
{
users.users.media = {
@ -19,6 +21,19 @@ in
};
sops.secrets."passwords/media" = {
sopsFile = "${secretsFile}";
neededForUsers = true;
};
sops.secrets."ssh_keys/media/id_ed25519" = {
path = "/home/media/.ssh/id_ed25519";
};
sops.secrets."ssh_keys/media/id_ed25519.pub" = {
path = "/home/media/.ssh/id_ed25519.pub";
};
programs.zsh.enable = true;
programs.fuse.userAllowOther = true;

8
hosts/common/users/sam/default.nix
View File

@ -3,7 +3,8 @@ let
hostname = config.networking.hostName;
pubKeys = lib.filesystem.listFilesRecursive (../keys);
sopsHashedPasswordFile = lib.optionalString (lib.hasAttr "sops-nix" inputs) config.sops.secrets."passwords/sam".path;
secretsDirectory = builtins.toString inputs.nix-secrets;
secretsFile = "${secretsDirectory}/secrets.yaml";
in
{
users.users.sam = {
@ -23,6 +24,11 @@ in
};
sops.secrets."passwords/sam" = {
sopsFile = "${secretsFile}";
neededForUsers = true;
};
programs.zsh.enable = true;
home-manager = {

4
hosts/sparky/default.nix
View File

@ -1,6 +1,8 @@
{ inputs, config, lib, pkgs, outputs,... }:
let
sopsHashedPasswordFile = lib.optionalString (lib.hasAttr "sops-nix" inputs) config.sops.secrets."passwords/root".path;
secretsDirectory = builtins.toString inputs.nix-secrets;
secretsFile = "${secretsDirectory}/secrets.yaml";
in
{
imports =
@ -48,7 +50,7 @@ in
"/etc/ssh/ssh_host_ed25519_key"
"/etc/ssh/ssh_host_ed25519_key.pub"
];
users.${config.username} = {
users.media= {
directories = [
"sync"
"keep"