blob: 83aeadfab9331dc382261c39611e73d0dc49f332 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
|
{
config,
lib,
...
}: let
cfg = config.vhack.openssh;
in {
options.vhack.openssh = {
enable = lib.mkEnableOption ''
a sane openssh implementation.
'';
};
config = lib.mkIf cfg.enable {
/*
FIXME(@bpeetz):
This results in a boot error, as the `/var/lib/sshd` directory
is only mounted _after_ the stage 2 init and with it the system
activation. `agenix` needs the sshd hostkey however to decrypt the
secrets and thus we have to ensure that this directory is mounted
_before_ the system activation. Alas the only way I see to achieve
that is to store the ssh hostkey directly on /srv, which is mounted
before (it's marked as 'neededForBoot' after all).
It should be possible to achieve this with impermanence however,
as `/var/log` is mounted in the stage 1 init; The problem is that
I have no idea _why_ only this is mounted and nothing else.
vhack.persist.directories = [
{
directory = "/var/lib/sshd";
user = "root";
group = "root";
mode = "0755";
}
];
*/
users = {
users.sshd.uid = config.vhack.constants.ids.uids.sshd;
groups.sshd.gid = config.vhack.constants.ids.gids.sshd;
};
services.openssh = {
enable = true;
settings.PasswordAuthentication = false;
hostKeys = [
{
# FIXME: Remove the dependency on `/srv` this workaround.
# See the explanation for using `/srv` above.
path = "/srv/var/lib/sshd/ssh_host_ed25519_key";
rounds = 1000;
type = "ed25519";
}
];
};
};
}
|
