Use modules from qois-infrastructure
This commit is contained in:
parent
d90be28dee
commit
c9f16dff77
5 changed files with 56 additions and 106 deletions
|
@ -1,5 +1,5 @@
|
|||
{ config, pkgs, ... }: {
|
||||
|
||||
imports = [ ./luks-ssh ];
|
||||
imports = [ ];
|
||||
|
||||
}
|
||||
|
|
|
@ -1,99 +0,0 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let cfg = config.services.qois.luks-ssh;
|
||||
in {
|
||||
options.services.qois.luks-ssh = {
|
||||
enable = mkEnableOption "luks-ssh service";
|
||||
|
||||
interface = mkOption {
|
||||
type = types.str;
|
||||
example = "enp0";
|
||||
description = ''
|
||||
Interface name.
|
||||
'';
|
||||
};
|
||||
|
||||
ip = mkOption {
|
||||
type = types.str;
|
||||
example = "192.168.0.1";
|
||||
default = "dhcp";
|
||||
description = ''
|
||||
Host IP Address or "dhcp" (default).
|
||||
'';
|
||||
};
|
||||
|
||||
gateway = mkOption {
|
||||
type = types.str;
|
||||
default = null;
|
||||
example = "192.168.0.1";
|
||||
description = ''
|
||||
IP of gateway. May be null if ip is aquired by dhcp.
|
||||
'';
|
||||
};
|
||||
|
||||
netmask = mkOption {
|
||||
type = types.str;
|
||||
default = null;
|
||||
example = "192.168.0.1";
|
||||
description = ''
|
||||
Netmask of internal network. May be null if ip is aquired by dhcp.
|
||||
'';
|
||||
};
|
||||
|
||||
sshHostKey = mkOption {
|
||||
type = types.str;
|
||||
default = "/secrets/initrd_ssh_key_ed25519";
|
||||
description = ''
|
||||
Hostkey for ssh connection.
|
||||
The key is stored in an unencrypted form,
|
||||
so it is strongly advised against using the normal host key.
|
||||
|
||||
You can generate a host key with:
|
||||
|
||||
ssh-keygen -t ed25519 -N "" -f /secrets/initrd_ssh_key_ed25519
|
||||
'';
|
||||
};
|
||||
|
||||
sshPort = mkOption {
|
||||
type = types.addCheck types.int (n: n > 0 && n < 65536);
|
||||
default = 2222;
|
||||
description = ''
|
||||
SSH Port of the initrd ssh server.
|
||||
Should be different from default SSH port to prevent known hosts collissions.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
boot.initrd.network = {
|
||||
enable = true;
|
||||
ssh = {
|
||||
enable = true;
|
||||
port = cfg.sshPort;
|
||||
authorizedKeys = with lib;
|
||||
concatLists (mapAttrsToList (name: user:
|
||||
if elem "wheel" user.extraGroups then
|
||||
user.openssh.authorizedKeys.keys
|
||||
else
|
||||
[ ]) config.users.users);
|
||||
hostKeys = [ cfg.sshHostKey ];
|
||||
};
|
||||
postCommands = ''
|
||||
echo 'cryptsetup-askpass' >> /root/.profile
|
||||
'';
|
||||
};
|
||||
|
||||
boot.kernelParams = [
|
||||
(if cfg.ip == "dhcp" then
|
||||
"ip=::::${config.networking.hostName}:${cfg.interface}:dhcp"
|
||||
else
|
||||
"ip=${cfg.ip}::${cfg.gateway}:${cfg.netmask}:${config.networking.hostName}:${cfg.interface}:none")
|
||||
]; # see https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt
|
||||
|
||||
boot.initrd.postMountCommands = ''
|
||||
ip link set ${cfg.interface} down
|
||||
'';
|
||||
};
|
||||
}
|
Loading…
Add table
Add a link
Reference in a new issue