99 lines
2.5 KiB
Nix
99 lines
2.5 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
|
|
let cfg = config.services.qois.luks-ssh;
|
|
in {
|
|
options.services.qois.luks-ssh = {
|
|
enable = mkEnableOption "luks-ssh service";
|
|
|
|
interface = mkOption {
|
|
type = types.str;
|
|
example = "enp0";
|
|
description = ''
|
|
Interface name.
|
|
'';
|
|
};
|
|
|
|
ip = mkOption {
|
|
type = types.str;
|
|
example = "192.168.0.1";
|
|
default = "dhcp";
|
|
description = ''
|
|
Host IP Address or "dhcp" (default).
|
|
'';
|
|
};
|
|
|
|
gateway = mkOption {
|
|
type = types.str;
|
|
default = null;
|
|
example = "192.168.0.1";
|
|
description = ''
|
|
IP of gateway. May be null if ip is aquired by dhcp.
|
|
'';
|
|
};
|
|
|
|
netmask = mkOption {
|
|
type = types.str;
|
|
default = null;
|
|
example = "192.168.0.1";
|
|
description = ''
|
|
Netmask of internal network. May be null if ip is aquired by dhcp.
|
|
'';
|
|
};
|
|
|
|
sshHostKey = mkOption {
|
|
type = types.str;
|
|
default = "/secrets/initrd_ssh_key_ed25519";
|
|
description = ''
|
|
Hostkey for ssh connection.
|
|
The key is stored in an unencrypted form,
|
|
so it is strongly advised against using the normal host key.
|
|
|
|
You can generate a host key with:
|
|
|
|
ssh-keygen -t ed25519 -N "" -f /secrets/initrd_ssh_key_ed25519
|
|
'';
|
|
};
|
|
|
|
sshPort = mkOption {
|
|
type = types.addCheck types.int (n: n > 0 && n < 65536);
|
|
default = 2222;
|
|
description = ''
|
|
SSH Port of the initrd ssh server.
|
|
Should be different from default SSH port to prevent known hosts collissions.
|
|
'';
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
boot.initrd.network = {
|
|
enable = true;
|
|
ssh = {
|
|
enable = true;
|
|
port = cfg.sshPort;
|
|
authorizedKeys = with lib;
|
|
concatLists (mapAttrsToList (name: user:
|
|
if elem "wheel" user.extraGroups then
|
|
user.openssh.authorizedKeys.keys
|
|
else
|
|
[ ]) config.users.users);
|
|
hostKeys = [ cfg.sshHostKey ];
|
|
};
|
|
postCommands = ''
|
|
echo 'cryptsetup-askpass' >> /root/.profile
|
|
'';
|
|
};
|
|
|
|
boot.kernelParams = [
|
|
(if cfg.ip == "dhcp" then
|
|
"ip=::::${config.networking.hostName}:${cfg.interface}:dhcp"
|
|
else
|
|
"ip=${cfg.ip}::${cfg.gateway}:${cfg.netmask}:${config.networking.hostName}:${cfg.interface}:none")
|
|
]; # see https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt
|
|
|
|
boot.initrd.postMountCommands = ''
|
|
ip link set ${cfg.interface} down
|
|
'';
|
|
};
|
|
}
|