nix-stuff/common-config.nix

{ config, pkgs, lib, ... }: with lib; let
  cfg = config.vacu;
  knownHosts = attrValues cfg.ssh.knownHosts;
  knownHostsText = (flip (concatMapStringsSep "\n") knownHosts
  (h: assert h.hostNames != [];
    optionalString h.certAuthority "@cert-authority " + concatStringsSep "," h.hostNames + " "
    + (if h.publicKey != null then h.publicKey else readFile h.publicKeyFile)
  )) + "\n";
in {
  options = {
    vacu.ssh.authorizedKeys = mkOption {
      type = types.listOf types.str;
    };
    vacu.ssh.config = mkOption {
      type = types.lines;
    };
    # Straight copied from nixpkgs 
    # https://github.com/NixOS/nixpkgs/blob/46397778ef1f73414b03ed553a3368f0e7e33c2f/nixos/modules/programs/ssh.nix
    vacu.ssh.knownHosts = mkOption {
      default = {};
      type = types.attrsOf (types.submodule ({ name, config, options, ... }: {
        options = {
          certAuthority = mkOption {
            type = types.bool;
            default = false;
            description = mdDoc ''
              This public key is an SSH certificate authority, rather than an
              individual host's key.
            '';
          };
          hostNames = mkOption {
            type = types.listOf types.str;
            default = [ name ] ++ config.extraHostNames;
            defaultText = literalExpression "[ ${name} ] ++ config.${options.extraHostNames}";
            description = mdDoc ''
              A list of host names and/or IP numbers used for accessing
              the host's ssh service. This list includes the name of the
              containing `knownHosts` attribute by default
              for convenience. If you wish to configure multiple host keys
              for the same host use multiple `knownHosts`
              entries with different attribute names and the same
              `hostNames` list.
            '';
          };
          extraHostNames = mkOption {
            type = types.listOf types.str;
            default = [];
            description = mdDoc ''
              A list of additional host names and/or IP numbers used for
              accessing the host's ssh service. This list is ignored if
              `hostNames` is set explicitly.
            '';
          };
          publicKey = mkOption {
            default = null;
            type = types.nullOr types.str;
            example = "ecdsa-sha2-nistp521 AAAAE2VjZHN...UEPg==";
            description = mdDoc ''
              The public key data for the host. You can fetch a public key
              from a running SSH server with the {command}`ssh-keyscan`
              command. The public key should not include any host names, only
              the key type and the key itself.
            '';
          };
          publicKeyFile = mkOption {
            default = null;
            type = types.nullOr types.path;
            description = mdDoc ''
              The path to the public key file for the host. The public
              key file is read at build time and saved in the Nix store.
              You can fetch a public key file from a running SSH server
              with the {command}`ssh-keyscan` command. The content
              of the file should follow the same format as described for
              the `publicKey` option. Only a single key
              is supported. If a host has multiple keys, use
              {option}`programs.ssh.knownHostsFiles` instead.
            '';
          };
        };
      }));
      description = mdDoc ''
        The set of system-wide known SSH hosts. To make simple setups more
        convenient the name of an attribute in this set is used as a host name
        for the entry. This behaviour can be disabled by setting
        `hostNames` explicitly. You can use
        `extraHostNames` to add additional host names without
        disabling this default.
      '';
      example = literalExpression ''
        {
          myhost = {
            extraHostNames = [ "myhost.mydomain.com" "10.10.1.4" ];
            publicKeyFile = ./pubkeys/myhost_ssh_host_dsa_key.pub;
          };
          "myhost2.net".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILIRuJ8p1Fi+m6WkHV0KWnRfpM1WxoW8XAS+XvsSKsTK";
          "myhost2.net/dsa" = {
            hostNames = [ "myhost2.net" ];
            publicKeyFile = ./pubkeys/myhost2_ssh_host_dsa_key.pub;
          };
        }
      '';
    };
    vacu.nix.extraSubstituters = mkOption { type = types.listOf types.str; };
    vacu.nix.extraTrustedKeys = mkOption { type = types.listOf types.str; };
  };
  config = {
    vacu.nix.extraSubstituters = [
      "https://nixcache.shelvacu.com/"
      "https://nix-community.cachix.org/"
    ];
    vacu.nix.extraTrustedKeys = [
      "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
      "nixcache.shelvacu.com:73u5ZGBpPRoVZfgNJQKYYBt9K9Io/jPwgUfuOLsJbsM="
    ];
    assertions = flip mapAttrsToList cfg.ssh.knownHosts (name: data: {
      assertion = (data.publicKey == null && data.publicKeyFile != null) ||
                  (data.publicKey != null && data.publicKeyFile == null);
      message = "knownHost ${name} must contain either a publicKey or publicKeyFile";
    });
    vacu.ssh.authorizedKeys = [
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC4LYvUe9dsQb9OaTDFI4QKPtMmOHOGLwWsXsEmcJW86" # Termux on pixel6pro
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHcYwYy9/0Gu/GsqS72Nkz6OkId+zevqXA/aTIcvqflp" # t460s windows
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFsErA6M9LSHj2hPlLuHD8Lpei7WjMup1JxI1vxA6B8W" # pixel6pro nix-on-droid
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKoy1TrmfhBGWtVedgOM1FB1oD2UdodN3LkBnnLx6Tug" # compute-deck
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICVeSzDkGTueZijB0xUa08e06ovAEwwZK/D+Cc7bo91g" # triple-dezert
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOtwtao/TXbiuQOYJbousRPVesVcb/2nP0PCFUec0Nv8" # triple-dezert (root)
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAxAFFxQMXAgi+0cmGaNE/eAkVfEl91wafUqFIuAkI5I" # compute-deck (root)
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDcRDekd8ZOYfQS5X95/yNof3wFYIbHqWeq4jY0+ywQX" # pro1x nix-on-droid
    ];
    vacu.ssh.config = ''
      Host deckvacu
        User deck
      
      Host rsb
        User user
        HostName finaltask.xyz
        Port 2222
      
      Host awoo
        HostName 45.142.157.71

      Host trip
        HostName trip.shelvacu.com
        Port 6922
      
      Host liam
        HostName 178.128.79.152

      Host pluto
        HostName pluto.somevideogam.es

      Host *
        User shelvacu
        GlobalKnownHostsFile ${pkgs.writeText "known_hosts" knownHostsText}
    '';

    vacu.ssh.knownHosts = {
      #public hosts
      "github.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
      "gitlab.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf";

      #colin's stuff
      "uninsane.org" = {
        extraHostNames = [ "git.uninsane.org" ];
        publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfdSmFkrVT6DhpgvFeQKm3Fh9VKZ9DbLYOPOJWYQ0E8";
      };
      "desko" = {
        publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFw9NoRaYrM6LbDd3aFBc4yyBlxGQn8HjeHd/dZ3CfHk";
      };

      #daymocker's stuff
      "pluto" = {
        extraHostNames = [ "74.208.184.137" ];
        publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICpHY4fLZ1hNuB2oRQM7R3b4eQyIHbFB45ZYp3XCELLg";
      };

      #personal hosts
      "zigbee-hub" = {
        extraHostNames = [ "10.78.79.114" ];
        publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBJxwUYddOxgViJDOiokfaQ6CsCx/Sw+b3IisdJv8zFN root@zigbee-hub";
      };
      trip = {
        extraHostNames = [ "triple-dezert" "trip.shelvacu.com" "[trip.shelvacu.com]:6922" ];
        publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGUQux9V0mSF5IauoO1z311NXR7ymEbwRMzT+OaaNQr+";
      };
      servacu = {
        extraHostNames = [ "mail.dis8.net" "servacu.shelvacu.com" ];
        publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE+E6na7np0HnBV2X7owno+Fg+bNNRSHLxO6n1JzdUTV";
      };
      finaltask = {
        extraHostNames = [ "rsb" "finaltask.xyz" "[finaltask.xyz]:2222" ];
        publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPTx8WBNNKBVRV98HgDChpd59SHbreJ87SXU+zOKan6y";
      };
      compute-deck = {
        publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGt43GmXCxkl5QjgPQ/QimW11lKfXmV4GFWvlxQSf4TQ";
      };
      "2esrever" = {
        extraHostNames = [ "10.4.5.218" "10.244.46.71" ];
        publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH0LnPrJxAdffZ//uRe3NBiIfFCBNMLqKVylkyU0llvT";
      };
      awoo = {
        extraHostNames = [ "45.142.157.71" ];
        publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQaDjjfSK8jnk9aFIiYH9LZO4nLY/oeAc7BKIPUXMh1";
      };
      deckvacu = {
        publicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEa8qpFkIlLLJkH8rmEAn6/MZ9ilCGmEQWC3CeFae7r1kOqfwRk0nq0oyOGJ50uIh+PpwEh3rbgq6mLfpRfsFmM=";
      };
      liam = {
        extraHostNames = [ "liam.dis8.net" "178.128.79.152" ];
        publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHOqJYVHOIFmEA5uRbbirIupWvyBLAFwic/8EZQRdN/c";
      };
    };
  };
}