diff options
| -rw-r--r-- | hosts.toml | 13 | ||||
| -rw-r--r-- | hosts/mercury/nixos.nix | 14 | ||||
| -rw-r--r-- | lib/nix-furnace/mkSystem.nix | 6 | ||||
| -rw-r--r-- | modules/services/nixos/ssh.nix | 26 | ||||
| -rw-r--r-- | modules/user/nixos/default.nix | 11 | ||||
| -rw-r--r-- | secrets.nix | 13 |
6 files changed, 57 insertions, 26 deletions
diff --git a/hosts.toml b/hosts.toml new file mode 100644 index 0000000..4d3b3c4 --- /dev/null +++ b/hosts.toml @@ -0,0 +1,13 @@ +[hosts.mercury] +user_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAvxtKW0rmRBi8J67gLrLv8Zv338AcmZ3P20DePiUfnX collin@mercury" +host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIQtMAgPdWwrOzlZT/lEIRQZ+ajhafG9AEJCrF2/bsmN" + +[hosts.ganymede] +user_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFeAsRh11Jyv+7Fm4WhzV4XN0LMYQS1/yMbvT+pvFDcd collin@ganymede" +host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlr+53UmlGVP1blkdNl6NFqn1w2umFJyjH1EVUPKIy9" + +[hosts.jupiter] +host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPB7feUHl5qoD5zF9AMOV2meViA+wZYdVvbVjPkggZf8" + +[hosts.io] +host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJXSvoVpMh/Y84THjKAYqkbuPmmv/yIU8DunMov7tKKT" diff --git a/hosts/mercury/nixos.nix b/hosts/mercury/nixos.nix index 8052bb1..d0ea0fa 100644 --- a/hosts/mercury/nixos.nix +++ b/hosts/mercury/nixos.nix @@ -24,15 +24,19 @@ environment.defaultPackages = lib.mkForce []; # im not a noob - # programs.firefox.policies.Preferences.ExtensionSettings = { - - # }; + programs.firefox.policies.ExtensionSettings = { + "foxyproxy@eric.h.jung" = { + installation_mode = "force_installed"; + install_url = "https://addons.mozilla.org/firefox/downloads/latest/foxyproxy-standard/latest.xpi"; + }; + }; programs.ssh.extraConfig = '' Host ganymede - HostName 70.130.121.193 + HostName williamsfam.us.com User collin IdentityFile /home/collin/.ssh/id_ed25519 - LocalForward 8015 127.0.0.1:8015 + LocalForward 8010 127.0.0.1:8010 + DynamicForward 9090 ''; } diff --git a/lib/nix-furnace/mkSystem.nix b/lib/nix-furnace/mkSystem.nix index 2766082..856655a 100644 --- a/lib/nix-furnace/mkSystem.nix +++ b/lib/nix-furnace/mkSystem.nix @@ -2,6 +2,8 @@ let my-lib = import ../lib.nix; inherit (my-lib.globimport) getSubdirs lazyImport; + hosts = (builtins.fromTOML (builtins.readFile ../../hosts.toml)).hosts; + listModules = getSubdirs ../../modules; nixosModules = hostname: @@ -36,7 +38,7 @@ let username, }: inputs.nixpkgs.lib.nixosSystem { - specialArgs = {inherit inputs my-lib;}; + specialArgs = {inherit inputs my-lib hosts;}; modules = [ {networking.hostName = hostname;} @@ -52,7 +54,7 @@ let ]; hjem = { extraModules = hjemModules hostname; - specialArgs = {inherit inputs my-lib;}; + specialArgs = {inherit inputs my-lib hosts;}; users.${username} = { enable = true; user = username; diff --git a/modules/services/nixos/ssh.nix b/modules/services/nixos/ssh.nix index 1826a5e..34265ed 100644 --- a/modules/services/nixos/ssh.nix +++ b/modules/services/nixos/ssh.nix @@ -1,6 +1,7 @@ { config, lib, + hosts, ... }: let cfg = config.collinux.services.networking.sshd; @@ -27,18 +28,23 @@ in { PasswordAuthentication = false; }; - knownHosts = { - "mercury".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIQtMAgPdWwrOzlZT/lEIRQZ+ajhafG9AEJCrF2/bsmN"; - "jupiter".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPB7feUHl5qoD5zF9AMOV2meViA+wZYdVvbVjPkggZf8"; - "ganymede".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlr+53UmlGVP1blkdNl6NFqn1w2umFJyjH1EVUPKIy9"; - }; + knownHosts = builtins.mapAttrs (_: data: {publicKey = data.host_pubkey;}) hosts; }; - users.users.${config.collinux.user.name}.openssh = { - authorizedKeys.keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAvxtKW0rmRBi8J67gLrLv8Zv338AcmZ3P20DePiUfnX mercury" - ]; - }; + users.users.${config.collinux.user.name}.openssh.authorizedKeys.keys = + hosts + |> (builtins.mapAttrs (_: data: data.user_pubkey or null)) + |> builtins.attrValues + |> (builtins.filter (x: x != null)); + + users.users."root".openssh.authorizedKeys.keys = + if config.services.openssh.settings.PermitRootLogin == "prohibit-password" + then + hosts + |> (builtins.mapAttrs (_: data: data.user_pubkey or null)) + |> builtins.attrValues + |> (builtins.filter (x: x != null)) + else {}; systemd.services."openssh" = lib.mkIf config.collinux.services.networking.networkd.enable { after = lib.mkAfter ["network-online.target"]; diff --git a/modules/user/nixos/default.nix b/modules/user/nixos/default.nix index 4edd535..30b03e3 100644 --- a/modules/user/nixos/default.nix +++ b/modules/user/nixos/default.nix @@ -1,6 +1,7 @@ { config, lib, + hosts, ... }: let cfg = config.collinux.user; @@ -8,7 +9,7 @@ in { users = { mutableUsers = true; # system passwords stored mutably - users."${cfg.name}" = { + users.${cfg.name} = { isNormalUser = true; description = cfg.name; extraGroups = ["networkmanager" "pipewire" "disks" "input" "video" "dialout" "kvm"] ++ (lib.optional cfg.isAdmin "wheel"); @@ -25,6 +26,14 @@ in { time.timeZone = "America/Chicago"; + programs.ssh = { + knownHosts = builtins.mapAttrs (_: data: {publicKey = data.host_pubkey;}) hosts; + + extraConfig = '' + StrictHostKeyChecking accept-new + ''; + }; + hjem = { clobberByDefault = true; users."${cfg.name}" = { diff --git a/secrets.nix b/secrets.nix index d0a5ffb..2dae288 100644 --- a/secrets.nix +++ b/secrets.nix @@ -1,11 +1,8 @@ let - # host keys - mercury = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIQtMAgPdWwrOzlZT/lEIRQZ+ajhafG9AEJCrF2/bsmN"; - jupiter = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPB7feUHl5qoD5zF9AMOV2meViA+wZYdVvbVjPkggZf8"; - ganymede = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlr+53UmlGVP1blkdNl6NFqn1w2umFJyjH1EVUPKIy9"; + inherit (builtins.fromTOML ./hosts.toml) mercury ganymede jupiter; in { - "caddy-env.age".publicKeys = [ganymede]; - "tsnsrv-authkey.age".publicKeys = [ganymede mercury]; - "williams-psk.age".publicKeys = [ganymede]; - "github-ssh-key.age".publicKeys = [mercury jupiter]; + "caddy-env.age".publicKeys = [ganymede.host_pubkey]; + "tsnsrv-authkey.age".publicKeys = [ganymede.host_pubkey mercury.host_pubkey]; + "williams-psk.age".publicKeys = [ganymede.host_pubkey]; + "github-ssh-key.age".publicKeys = [mercury.host_pubkey jupiter.host_pubkey]; } |