ssh config

2 files changed, 26 insertions, 11 deletions

diff --git a/modules/services/nixos/ssh.nix b/modules/services/nixos/ssh.nix
index 1826a5e..34265ed 100644
--- a/modules/services/nixos/ssh.nix
+++ b/modules/services/nixos/ssh.nix
@@ -1,6 +1,7 @@
 {
   config,
   lib,
+  hosts,
   ...
 }: let
   cfg = config.collinux.services.networking.sshd;
@@ -27,18 +28,23 @@ in {
         PasswordAuthentication = false;
       };
 
-      knownHosts = {
-        "mercury".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIQtMAgPdWwrOzlZT/lEIRQZ+ajhafG9AEJCrF2/bsmN";
-        "jupiter".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPB7feUHl5qoD5zF9AMOV2meViA+wZYdVvbVjPkggZf8";
-        "ganymede".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlr+53UmlGVP1blkdNl6NFqn1w2umFJyjH1EVUPKIy9";
-      };
+      knownHosts = builtins.mapAttrs (_: data: {publicKey = data.host_pubkey;}) hosts;
     };
 
-    users.users.${config.collinux.user.name}.openssh = {
-      authorizedKeys.keys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAvxtKW0rmRBi8J67gLrLv8Zv338AcmZ3P20DePiUfnX mercury"
-      ];
-    };
+    users.users.${config.collinux.user.name}.openssh.authorizedKeys.keys =
+      hosts
+      |> (builtins.mapAttrs (_: data: data.user_pubkey or null))
+      |> builtins.attrValues
+      |> (builtins.filter (x: x != null));
+
+    users.users."root".openssh.authorizedKeys.keys =
+      if config.services.openssh.settings.PermitRootLogin == "prohibit-password"
+      then
+        hosts
+        |> (builtins.mapAttrs (_: data: data.user_pubkey or null))
+        |> builtins.attrValues
+        |> (builtins.filter (x: x != null))
+      else {};
 
     systemd.services."openssh" = lib.mkIf config.collinux.services.networking.networkd.enable {
       after = lib.mkAfter ["network-online.target"];
diff --git a/modules/user/nixos/default.nix b/modules/user/nixos/default.nix
index 4edd535..30b03e3 100644
--- a/modules/user/nixos/default.nix
+++ b/modules/user/nixos/default.nix
@@ -1,6 +1,7 @@
 {
   config,
   lib,
+  hosts,
   ...
 }: let
   cfg = config.collinux.user;
@@ -8,7 +9,7 @@ in {
   users = {
     mutableUsers = true; # system passwords stored mutably
 
-    users."${cfg.name}" = {
+    users.${cfg.name} = {
       isNormalUser = true;
       description = cfg.name;
       extraGroups = ["networkmanager" "pipewire" "disks" "input" "video" "dialout" "kvm"] ++ (lib.optional cfg.isAdmin "wheel");
@@ -25,6 +26,14 @@ in {
 
   time.timeZone = "America/Chicago";
 
+  programs.ssh = {
+    knownHosts = builtins.mapAttrs (_: data: {publicKey = data.host_pubkey;}) hosts;
+
+    extraConfig = ''
+      StrictHostKeyChecking accept-new
+    '';
+  };
+
   hjem = {
     clobberByDefault = true;
     users."${cfg.name}" = {