109 lines
2.5 KiB
Nix
109 lines
2.5 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
|
|
with lib;
|
|
|
|
let
|
|
cfg = config.services.qois.luks-ssh;
|
|
in
|
|
{
|
|
options.services.qois.luks-ssh = {
|
|
enable = mkEnableOption "luks-ssh service";
|
|
|
|
interface = mkOption {
|
|
type = types.str;
|
|
example = "enp0";
|
|
description = ''
|
|
Interface name.
|
|
'';
|
|
};
|
|
|
|
ip = mkOption {
|
|
type = types.str;
|
|
example = "192.168.0.1";
|
|
default = "dhcp";
|
|
description = ''
|
|
Host IP Address or "dhcp" (default).
|
|
'';
|
|
};
|
|
|
|
gateway = mkOption {
|
|
type = types.str;
|
|
default = null;
|
|
example = "192.168.0.1";
|
|
description = ''
|
|
IP of gateway. May be null if ip is aquired by dhcp.
|
|
'';
|
|
};
|
|
|
|
netmask = mkOption {
|
|
type = types.str;
|
|
default = null;
|
|
example = "192.168.0.1";
|
|
description = ''
|
|
Netmask of internal network. May be null if ip is aquired by dhcp.
|
|
'';
|
|
};
|
|
|
|
sshHostKey = mkOption {
|
|
type = types.str;
|
|
default = "/secrets/initrd_ssh_key_ed25519";
|
|
description = ''
|
|
Hostkey for ssh connection.
|
|
The key is stored in an unencrypted form,
|
|
so it is strongly advised against using the normal host key.
|
|
|
|
You can generate a host key with:
|
|
|
|
ssh-keygen -t ed25519 -N "" -f /secrets/initrd_ssh_key_ed25519
|
|
'';
|
|
};
|
|
|
|
sshPort = mkOption {
|
|
type = types.addCheck types.int (n: n > 0 && n < 65536);
|
|
default = 2222;
|
|
description = ''
|
|
SSH Port of the initrd ssh server.
|
|
Should be different from default SSH port to prevent known hosts collissions.
|
|
'';
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
boot.initrd.network = {
|
|
enable = true;
|
|
ssh = {
|
|
enable = true;
|
|
port = cfg.sshPort;
|
|
authorizedKeys =
|
|
with lib;
|
|
concatLists (
|
|
mapAttrsToList (
|
|
name: user: if elem "wheel" user.extraGroups then user.openssh.authorizedKeys.keys else [ ]
|
|
) config.users.users
|
|
);
|
|
hostKeys = [ cfg.sshHostKey ];
|
|
};
|
|
postCommands = ''
|
|
echo 'cryptsetup-askpass' >> /root/.profile
|
|
'';
|
|
};
|
|
|
|
boot.initrd.network.udhcpc.enable = cfg.ip == "dhcp";
|
|
boot.kernelParams =
|
|
if cfg.ip == "dhcp" then
|
|
[ ]
|
|
else
|
|
[
|
|
"ip=${cfg.ip}::${cfg.gateway}:${cfg.netmask}:${config.networking.hostName}:${cfg.interface}:none"
|
|
]; # See boot.initrd.network.enable
|
|
|
|
boot.initrd.postMountCommands = ''
|
|
ip link set ${cfg.interface} down
|
|
'';
|
|
};
|
|
}
|