Add luks-ssh to lindberg

This commit is contained in:
qo.is sysadmin 2021-04-10 18:37:07 +02:00
parent c899616768
commit a572c0ab37
2 changed files with 31 additions and 6 deletions

View file

@ -6,4 +6,10 @@ in {
networking.useDHCP = false; networking.useDHCP = false;
networking.interfaces.enp5s0.useDHCP = true; networking.interfaces.enp5s0.useDHCP = true;
services.qois.luks-ssh = {
enable = true;
interface = "enp5s0";
sshPort = 2222;
};
} }

View file

@ -18,24 +18,41 @@ in {
ip = mkOption { ip = mkOption {
type = types.str; type = types.str;
example = "192.168.0.1"; example = "192.168.0.1";
default = "dhcp";
description = '' description = ''
Host IP Address. Host IP Address or "dhcp" (default).
''; '';
}; };
gateway = mkOption { gateway = mkOption {
type = types.str; type = types.str;
default = null;
example = "192.168.0.1"; example = "192.168.0.1";
description = '' description = ''
IP of gateway. IP of gateway. May be null if ip is aquired by dhcp.
''; '';
}; };
netmask = mkOption { netmask = mkOption {
type = types.str; type = types.str;
default = null;
example = "192.168.0.1"; example = "192.168.0.1";
description = '' description = ''
Netmask of internal network. Netmask of internal network. May be null if ip is aquired by dhcp.
'';
};
sshHostKey = mkOption {
type = types.str;
default = "/secrets/initrd_ssh_key_ed25519";
description = ''
Hostkey for ssh connection.
The key is stored in an unencrypted form,
so it is strongly advised against using the normal host key.
You can generate a host key with:
ssh-keygen -t ed25519 -N "" -f /secrets/initrd_ssh_key_ed25519
''; '';
}; };
@ -61,8 +78,7 @@ in {
user.openssh.authorizedKeys.keys user.openssh.authorizedKeys.keys
else else
[ ]) config.users.users); [ ]) config.users.users);
# Generate hostkey with ssh-keygen -t ed25519 -N "" -f /secrets/initrd_ssh_key_ed25519 hostKeys = [ cfg.sshHostKey ];
hostKeys = [ "/secrets/initrd_ssh_key_ed25519" ];
}; };
postCommands = '' postCommands = ''
echo 'cryptsetup-askpass' >> /root/.profile echo 'cryptsetup-askpass' >> /root/.profile
@ -70,7 +86,10 @@ in {
}; };
boot.kernelParams = [ boot.kernelParams = [
"ip=${cfg.ip}::${cfg.gateway}:${cfg.netmask}:${config.networking.hostName}:${cfg.interface}:none" (if cfg.ip == "dhcp" then
"ip=::::${config.networking.hostName}:${cfg.interface}:dhcp"
else
"ip=${cfg.ip}::${cfg.gateway}:${cfg.netmask}:${config.networking.hostName}:${cfg.interface}:none")
]; # see https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt ]; # see https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt
boot.initrd.postMountCommands = '' boot.initrd.postMountCommands = ''