ssh config

6 files changed, 57 insertions, 26 deletions

diff --git a/hosts.toml b/hosts.toml
new file mode 100644
index 0000000..4d3b3c4
--- /dev/null
+++ b/hosts.toml
@@ -0,0 +1,13 @@
+[hosts.mercury]
+user_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAvxtKW0rmRBi8J67gLrLv8Zv338AcmZ3P20DePiUfnX collin@mercury"
+host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIQtMAgPdWwrOzlZT/lEIRQZ+ajhafG9AEJCrF2/bsmN"
+
+[hosts.ganymede]
+user_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFeAsRh11Jyv+7Fm4WhzV4XN0LMYQS1/yMbvT+pvFDcd collin@ganymede"
+host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlr+53UmlGVP1blkdNl6NFqn1w2umFJyjH1EVUPKIy9"
+
+[hosts.jupiter]
+host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPB7feUHl5qoD5zF9AMOV2meViA+wZYdVvbVjPkggZf8"
+
+[hosts.io]
+host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJXSvoVpMh/Y84THjKAYqkbuPmmv/yIU8DunMov7tKKT"
diff --git a/hosts/mercury/nixos.nix b/hosts/mercury/nixos.nix
index 8052bb1..d0ea0fa 100644
--- a/hosts/mercury/nixos.nix
+++ b/hosts/mercury/nixos.nix
@@ -24,15 +24,19 @@
 
   environment.defaultPackages = lib.mkForce []; # im not a noob
 
-  # programs.firefox.policies.Preferences.ExtensionSettings = {
-
-  # };
+  programs.firefox.policies.ExtensionSettings = {
+    "foxyproxy@eric.h.jung" = {
+      installation_mode = "force_installed";
+      install_url = "https://addons.mozilla.org/firefox/downloads/latest/foxyproxy-standard/latest.xpi";
+    };
+  };
 
   programs.ssh.extraConfig = ''
     Host ganymede
-      HostName 70.130.121.193
+      HostName williamsfam.us.com
       User collin
       IdentityFile /home/collin/.ssh/id_ed25519
-      LocalForward 8015 127.0.0.1:8015
+      LocalForward 8010 127.0.0.1:8010
+      DynamicForward 9090
   '';
 }
diff --git a/lib/nix-furnace/mkSystem.nix b/lib/nix-furnace/mkSystem.nix
index 2766082..856655a 100644
--- a/lib/nix-furnace/mkSystem.nix
+++ b/lib/nix-furnace/mkSystem.nix
@@ -2,6 +2,8 @@ let
   my-lib = import ../lib.nix;
   inherit (my-lib.globimport) getSubdirs lazyImport;
 
+  hosts = (builtins.fromTOML (builtins.readFile ../../hosts.toml)).hosts;
+
   listModules = getSubdirs ../../modules;
 
   nixosModules = hostname:
@@ -36,7 +38,7 @@ let
     username,
   }:
     inputs.nixpkgs.lib.nixosSystem {
-      specialArgs = {inherit inputs my-lib;};
+      specialArgs = {inherit inputs my-lib hosts;};
       modules = [
         {networking.hostName = hostname;}
 
@@ -52,7 +54,7 @@ let
           ];
           hjem = {
             extraModules = hjemModules hostname;
-            specialArgs = {inherit inputs my-lib;};
+            specialArgs = {inherit inputs my-lib hosts;};
             users.${username} = {
               enable = true;
               user = username;
diff --git a/modules/services/nixos/ssh.nix b/modules/services/nixos/ssh.nix
index 1826a5e..34265ed 100644
--- a/modules/services/nixos/ssh.nix
+++ b/modules/services/nixos/ssh.nix
@@ -1,6 +1,7 @@
 {
   config,
   lib,
+  hosts,
   ...
 }: let
   cfg = config.collinux.services.networking.sshd;
@@ -27,18 +28,23 @@ in {
         PasswordAuthentication = false;
       };
 
-      knownHosts = {
-        "mercury".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIQtMAgPdWwrOzlZT/lEIRQZ+ajhafG9AEJCrF2/bsmN";
-        "jupiter".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPB7feUHl5qoD5zF9AMOV2meViA+wZYdVvbVjPkggZf8";
-        "ganymede".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlr+53UmlGVP1blkdNl6NFqn1w2umFJyjH1EVUPKIy9";
-      };
+      knownHosts = builtins.mapAttrs (_: data: {publicKey = data.host_pubkey;}) hosts;
     };
 
-    users.users.${config.collinux.user.name}.openssh = {
-      authorizedKeys.keys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAvxtKW0rmRBi8J67gLrLv8Zv338AcmZ3P20DePiUfnX mercury"
-      ];
-    };
+    users.users.${config.collinux.user.name}.openssh.authorizedKeys.keys =
+      hosts
+      |> (builtins.mapAttrs (_: data: data.user_pubkey or null))
+      |> builtins.attrValues
+      |> (builtins.filter (x: x != null));
+
+    users.users."root".openssh.authorizedKeys.keys =
+      if config.services.openssh.settings.PermitRootLogin == "prohibit-password"
+      then
+        hosts
+        |> (builtins.mapAttrs (_: data: data.user_pubkey or null))
+        |> builtins.attrValues
+        |> (builtins.filter (x: x != null))
+      else {};
 
     systemd.services."openssh" = lib.mkIf config.collinux.services.networking.networkd.enable {
       after = lib.mkAfter ["network-online.target"];
diff --git a/modules/user/nixos/default.nix b/modules/user/nixos/default.nix
index 4edd535..30b03e3 100644
--- a/modules/user/nixos/default.nix
+++ b/modules/user/nixos/default.nix
@@ -1,6 +1,7 @@
 {
   config,
   lib,
+  hosts,
   ...
 }: let
   cfg = config.collinux.user;
@@ -8,7 +9,7 @@ in {
   users = {
     mutableUsers = true; # system passwords stored mutably
 
-    users."${cfg.name}" = {
+    users.${cfg.name} = {
       isNormalUser = true;
       description = cfg.name;
       extraGroups = ["networkmanager" "pipewire" "disks" "input" "video" "dialout" "kvm"] ++ (lib.optional cfg.isAdmin "wheel");
@@ -25,6 +26,14 @@ in {
 
   time.timeZone = "America/Chicago";
 
+  programs.ssh = {
+    knownHosts = builtins.mapAttrs (_: data: {publicKey = data.host_pubkey;}) hosts;
+
+    extraConfig = ''
+      StrictHostKeyChecking accept-new
+    '';
+  };
+
   hjem = {
     clobberByDefault = true;
     users."${cfg.name}" = {
diff --git a/secrets.nix b/secrets.nix
index d0a5ffb..2dae288 100644
--- a/secrets.nix
+++ b/secrets.nix
@@ -1,11 +1,8 @@
 let
-  # host keys
-  mercury = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIQtMAgPdWwrOzlZT/lEIRQZ+ajhafG9AEJCrF2/bsmN";
-  jupiter = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPB7feUHl5qoD5zF9AMOV2meViA+wZYdVvbVjPkggZf8";
-  ganymede = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlr+53UmlGVP1blkdNl6NFqn1w2umFJyjH1EVUPKIy9";
+  inherit (builtins.fromTOML ./hosts.toml) mercury ganymede jupiter;
 in {
-  "caddy-env.age".publicKeys = [ganymede];
-  "tsnsrv-authkey.age".publicKeys = [ganymede mercury];
-  "williams-psk.age".publicKeys = [ganymede];
-  "github-ssh-key.age".publicKeys = [mercury jupiter];
+  "caddy-env.age".publicKeys = [ganymede.host_pubkey];
+  "tsnsrv-authkey.age".publicKeys = [ganymede.host_pubkey mercury.host_pubkey];
+  "williams-psk.age".publicKeys = [ganymede.host_pubkey];
+  "github-ssh-key.age".publicKeys = [mercury.host_pubkey jupiter.host_pubkey];
 }