colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

don't bind-mount /etc/ssh/host_keys: symlink them instead

Browse Source
This commit is contained in:
colin
2022-12-20 00:04:09 +00:00
parent 97044bf70e
commit d60e5264f3
1 changed files with 4 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
hosts/common/ssh.nix
View File

@@ -1,22 +1,14 @@
{ ... }:
{
# we place the host keys (which we want to be persisted) into their own directory so that we can
# bind mount that whole directory instead of doing it per-file.
# otherwise, this is identical to nixos defaults
sane.impermanence.service-dirs = [ "/etc/ssh/host_keys" ];
# we can't naively `mount /etc/ssh/host_keys` directly,
# as /etc/fstab may not be populated yet (since that file depends on e.g. activationScripts.users)
# we can't even depend on impermanence's `createPersistentStorageDirs` to create the source/target directories
# since that also depends on `users`.
# previously we manually `mount --bind` the host_keys here, but it's difficult to make that idempotent.
# symlinking seems to work just as well, and is easier to make idempotent
system.activationScripts.persist-ssh-host-keys.text = ''
mkdir -p /etc/ssh/host_keys
if ! (mountpoint /etc/ssh/host_keys)
then
# avoid mounting the keys more than once, otherwise we have a million _stacked_ entries.
# TODO: should we just symlink? or find a way to make sure the existing mount is correct.
mount --bind /nix/persist/etc/ssh/host_keys /etc/ssh/host_keys
fi
mkdir -p /etc/ssh
ln -sf /nix/persist/etc/ssh/host_keys /etc/ssh/
'';
services.openssh.hostKeys = [