Add luks-ssh to lindberg
This commit is contained in:
parent
c899616768
commit
a572c0ab37
2 changed files with 31 additions and 6 deletions
|
@ -6,4 +6,10 @@ in {
|
||||||
|
|
||||||
networking.useDHCP = false;
|
networking.useDHCP = false;
|
||||||
networking.interfaces.enp5s0.useDHCP = true;
|
networking.interfaces.enp5s0.useDHCP = true;
|
||||||
|
|
||||||
|
services.qois.luks-ssh = {
|
||||||
|
enable = true;
|
||||||
|
interface = "enp5s0";
|
||||||
|
sshPort = 2222;
|
||||||
|
};
|
||||||
}
|
}
|
||||||
|
|
|
@ -18,24 +18,41 @@ in {
|
||||||
ip = mkOption {
|
ip = mkOption {
|
||||||
type = types.str;
|
type = types.str;
|
||||||
example = "192.168.0.1";
|
example = "192.168.0.1";
|
||||||
|
default = "dhcp";
|
||||||
description = ''
|
description = ''
|
||||||
Host IP Address.
|
Host IP Address or "dhcp" (default).
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
gateway = mkOption {
|
gateway = mkOption {
|
||||||
type = types.str;
|
type = types.str;
|
||||||
|
default = null;
|
||||||
example = "192.168.0.1";
|
example = "192.168.0.1";
|
||||||
description = ''
|
description = ''
|
||||||
IP of gateway.
|
IP of gateway. May be null if ip is aquired by dhcp.
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
netmask = mkOption {
|
netmask = mkOption {
|
||||||
type = types.str;
|
type = types.str;
|
||||||
|
default = null;
|
||||||
example = "192.168.0.1";
|
example = "192.168.0.1";
|
||||||
description = ''
|
description = ''
|
||||||
Netmask of internal network.
|
Netmask of internal network. May be null if ip is aquired by dhcp.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
sshHostKey = mkOption {
|
||||||
|
type = types.str;
|
||||||
|
default = "/secrets/initrd_ssh_key_ed25519";
|
||||||
|
description = ''
|
||||||
|
Hostkey for ssh connection.
|
||||||
|
The key is stored in an unencrypted form,
|
||||||
|
so it is strongly advised against using the normal host key.
|
||||||
|
|
||||||
|
You can generate a host key with:
|
||||||
|
|
||||||
|
ssh-keygen -t ed25519 -N "" -f /secrets/initrd_ssh_key_ed25519
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
|
@ -61,8 +78,7 @@ in {
|
||||||
user.openssh.authorizedKeys.keys
|
user.openssh.authorizedKeys.keys
|
||||||
else
|
else
|
||||||
[ ]) config.users.users);
|
[ ]) config.users.users);
|
||||||
# Generate hostkey with ssh-keygen -t ed25519 -N "" -f /secrets/initrd_ssh_key_ed25519
|
hostKeys = [ cfg.sshHostKey ];
|
||||||
hostKeys = [ "/secrets/initrd_ssh_key_ed25519" ];
|
|
||||||
};
|
};
|
||||||
postCommands = ''
|
postCommands = ''
|
||||||
echo 'cryptsetup-askpass' >> /root/.profile
|
echo 'cryptsetup-askpass' >> /root/.profile
|
||||||
|
@ -70,7 +86,10 @@ in {
|
||||||
};
|
};
|
||||||
|
|
||||||
boot.kernelParams = [
|
boot.kernelParams = [
|
||||||
"ip=${cfg.ip}::${cfg.gateway}:${cfg.netmask}:${config.networking.hostName}:${cfg.interface}:none"
|
(if cfg.ip == "dhcp" then
|
||||||
|
"ip=::::${config.networking.hostName}:${cfg.interface}:dhcp"
|
||||||
|
else
|
||||||
|
"ip=${cfg.ip}::${cfg.gateway}:${cfg.netmask}:${config.networking.hostName}:${cfg.interface}:none")
|
||||||
]; # see https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt
|
]; # see https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt
|
||||||
|
|
||||||
boot.initrd.postMountCommands = ''
|
boot.initrd.postMountCommands = ''
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue