declare github authentication key

5 files changed, 32 insertions, 4 deletions

diff --git a/modules/services/nixos/ssh.nix b/modules/services/nixos/ssh.nix
index b594a2d..2867d10 100644
--- a/modules/services/nixos/ssh.nix
+++ b/modules/services/nixos/ssh.nix
@@ -4,11 +4,10 @@
   ...
 }: let
   cfg = config.collinux.services.networking.sshd;
-in
-  lib.mkIf cfg.enable {
+in {
+  config = lib.mkIf cfg.enable {
     services.openssh = {
       enable = true;
-      openFirewall = true;
       hostKeys = [
         {
           path = "/etc/ssh/ssh_host_ed25519_key";
@@ -22,4 +21,5 @@ in
     };
 
     services.tailscale.extraSetFlags = lib.optional config.services.tailscale.enable "--ssh=true";
-  }
+  };
+}
diff --git a/modules/terminal/nixos/default.nix b/modules/terminal/nixos/default.nix
index 4ececfa..dd1f7b9 100644
--- a/modules/terminal/nixos/default.nix
+++ b/modules/terminal/nixos/default.nix
@@ -3,6 +3,7 @@
 in {
   imports = [
     ./bash.nix
+    ./github_ssh.nix
   ];
 
   programs.command-not-found.enable = false; # broken without nix-channels
diff --git a/modules/terminal/nixos/github-ssh-key.age b/modules/terminal/nixos/github-ssh-key.age
new file mode 100644
index 0000000..a6064b4
--- /dev/null
+++ b/modules/terminal/nixos/github-ssh-key.age
diff --git a/modules/terminal/nixos/github_ssh.nix b/modules/terminal/nixos/github_ssh.nix
new file mode 100644
index 0000000..0d30b64
--- /dev/null
+++ b/modules/terminal/nixos/github_ssh.nix
@@ -0,0 +1,26 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.collinux.terminal.programs.git;
+in
+  lib.mkIf cfg.installKey {
+    collinux.secrets = {
+      "github-ssh-key" = {
+        file = ./github-ssh-key.age;
+        owner = config.collinux.user.name;
+      };
+    };
+
+    programs.ssh = {
+      knownHosts."github.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
+
+      extraConfig = ''
+        Host github.com
+          User git
+          IdentityFile ${config.collinux.secrets."github-ssh-key".path}
+          IdentitiesOnly yes
+      '';
+    };
+  }
diff --git a/modules/terminal/options.nix b/modules/terminal/options.nix
index 77b1f13..25e0eb4 100644
--- a/modules/terminal/options.nix
+++ b/modules/terminal/options.nix
@@ -43,6 +43,7 @@ in {
           userEmail = mkOption {
             type = types.str;
           };
+          installKey = mkEnableOption "automatically install github authentication key";
         };
 
         helix = {