colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

fix host ssh key persistence

Browse Source
This commit is contained in:
colin
2022-10-30 20:03:00 -07:00
parent 34d77542e7
commit b3b45ec0f2
2 changed files with 14 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
modules/impermanence.nix
View File

@@ -74,15 +74,13 @@ in
files = [ "/etc/machine-id" ]; files = [ "/etc/machine-id" ];
}; };
# secret decoding depends on /etc/ssh keys, which are persisted # secret decoding depends on /etc/ssh keys, which may be persisted
system.activationScripts.setupSecrets.deps = [ "persist-ssh-host-keys" ]; system.activationScripts.setupSecrets.deps = [ "persist-ssh-host-keys" ];
system.activationScripts.setupSecretsForUsers = lib.mkIf secretsForUsers { system.activationScripts.setupSecretsForUsers = lib.mkIf secretsForUsers {
deps = [ "persist-ssh-host-keys" ]; deps = [ "persist-ssh-host-keys" ];
}; };
system.activationScripts.persist-ssh-host-keys = { # populated by ssh.nix, which persists /etc/ssh/host_keys
text = "mount /etc/ssh/host_keys"; system.activationScripts.persist-ssh-host-keys.text = lib.mkDefault "";
deps = [ "createPersistentStorageDirs" ]; # provided by impermanence; ensures both mount endpoints exist
};
}; };
} }

12
modules/universal/ssh.nix
View File

@@ -1,9 +1,19 @@
{ ... }: { ... }:
{ {
# we place the host keys (which we want to be persisted) into their own directory to ease that. # we place the host keys (which we want to be persisted) into their own directory so that we can
# bind mount that whole directory instead of doing it per-file.
# otherwise, this is identical to nixos defaults # otherwise, this is identical to nixos defaults
sane.impermanence.service-dirs = [ "/etc/ssh/host_keys" ]; sane.impermanence.service-dirs = [ "/etc/ssh/host_keys" ];
# we can't naively `mount /etc/ssh/host_keys` directly,
# as /etc/fstab may not be populated yet (since that file depends on e.g. activationScripts.users)
# we can't even depend on impermanence's `createPersistentStorageDirs` to create the source/target directories
# since that also depends on `users`.
system.activationScripts.persist-ssh-host-keys.text = ''
mkdir -p /etc/ssh/host_keys
mount --bind /nix/persist/etc/ssh/host_keys /etc/ssh/host_keys
'';
services.openssh.hostKeys = [ services.openssh.hostKeys = [
{ type = "rsa"; bits = 4096; path = "/etc/ssh/host_keys/ssh_host_rsa_key"; } { type = "rsa"; bits = 4096; path = "/etc/ssh/host_keys/ssh_host_rsa_key"; }
{ type = "ed25519"; path = "/etc/ssh/host_keys/ssh_host_ed25519_key"; } { type = "ed25519"; path = "/etc/ssh/host_keys/ssh_host_ed25519_key"; }