276 lines
10 KiB
Nix
276 lines
10 KiB
Nix
{ config, pkgs, lib, inputs, ... }: let
|
|
inherit (lib) mkOption types flip concatMapStringsSep optionalString concatStringsSep readFile mapAttrsToList literalExpression;
|
|
inherit (builtins) attrValues;
|
|
cfg = config.vacu;
|
|
knownHosts = attrValues cfg.ssh.knownHosts;
|
|
knownHostsText = (flip (concatMapStringsSep "\n") knownHosts
|
|
(h: assert h.hostNames != [];
|
|
optionalString h.certAuthority "@cert-authority " + concatStringsSep "," h.hostNames + " "
|
|
+ (if h.publicKey != null then h.publicKey else readFile h.publicKeyFile)
|
|
)) + "\n";
|
|
packageNames = lib.splitString "\n" ''
|
|
nixos-rebuild
|
|
nano
|
|
vim
|
|
wget
|
|
screen
|
|
tmux
|
|
lsof
|
|
htop
|
|
mosh
|
|
dnsutils
|
|
iperf3
|
|
nmap
|
|
rsync
|
|
ethtool
|
|
sshfs
|
|
ddrescue
|
|
pciutils
|
|
ncdu
|
|
nix-index
|
|
git
|
|
pv
|
|
unzip
|
|
file
|
|
ripgrep
|
|
jq
|
|
units
|
|
tree
|
|
rclone
|
|
iputils
|
|
ssh-to-age
|
|
sops
|
|
inetutils
|
|
neovim
|
|
diffutils
|
|
findutils
|
|
utillinux
|
|
tzdata
|
|
hostname
|
|
man
|
|
gnugrep
|
|
gnused
|
|
gnutar
|
|
bzip2
|
|
gzip
|
|
xz
|
|
zip
|
|
unzip
|
|
openssh
|
|
git'';
|
|
plainPackageOpts = map (name: { name = name; value = { enable = lib.mkDefault true; }; }) packageNames;
|
|
packageOpts = lib.recursiveUpdate (builtins.listToAttrs plainPackageOpts) {
|
|
nix-search-cli.package = inputs.nix-search-cli.packages.${pkgs.system}.default;
|
|
nix-search-cli.enable = lib.mkDefault true;
|
|
nix-inspect.package = inputs.nix-inspect.packages.${pkgs.system}.default;
|
|
nix-inspect.enable = lib.mkDefault true;
|
|
};
|
|
in {
|
|
imports = [ ./package-set.nix ];
|
|
options = {
|
|
vacu.ssh.authorizedKeys = mkOption {
|
|
type = types.listOf types.str;
|
|
};
|
|
vacu.ssh.config = mkOption {
|
|
type = types.lines;
|
|
};
|
|
# Straight copied from nixpkgs
|
|
# https://github.com/NixOS/nixpkgs/blob/46397778ef1f73414b03ed553a3368f0e7e33c2f/nixos/modules/programs/ssh.nix
|
|
vacu.ssh.knownHosts = mkOption {
|
|
default = {};
|
|
type = types.attrsOf (types.submodule ({ name, config, options, ... }: {
|
|
options = {
|
|
certAuthority = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = ''
|
|
This public key is an SSH certificate authority, rather than an
|
|
individual host's key.
|
|
'';
|
|
};
|
|
hostNames = mkOption {
|
|
type = types.listOf types.str;
|
|
default = [ name ] ++ config.extraHostNames;
|
|
defaultText = literalExpression "[ ${name} ] ++ config.${options.extraHostNames}";
|
|
description = ''
|
|
A list of host names and/or IP numbers used for accessing
|
|
the host's ssh service. This list includes the name of the
|
|
containing `knownHosts` attribute by default
|
|
for convenience. If you wish to configure multiple host keys
|
|
for the same host use multiple `knownHosts`
|
|
entries with different attribute names and the same
|
|
`hostNames` list.
|
|
'';
|
|
};
|
|
extraHostNames = mkOption {
|
|
type = types.listOf types.str;
|
|
default = [];
|
|
description = ''
|
|
A list of additional host names and/or IP numbers used for
|
|
accessing the host's ssh service. This list is ignored if
|
|
`hostNames` is set explicitly.
|
|
'';
|
|
};
|
|
publicKey = mkOption {
|
|
default = null;
|
|
type = types.nullOr types.str;
|
|
example = "ecdsa-sha2-nistp521 AAAAE2VjZHN...UEPg==";
|
|
description = ''
|
|
The public key data for the host. You can fetch a public key
|
|
from a running SSH server with the {command}`ssh-keyscan`
|
|
command. The public key should not include any host names, only
|
|
the key type and the key itself.
|
|
'';
|
|
};
|
|
publicKeyFile = mkOption {
|
|
default = null;
|
|
type = types.nullOr types.path;
|
|
description = ''
|
|
The path to the public key file for the host. The public
|
|
key file is read at build time and saved in the Nix store.
|
|
You can fetch a public key file from a running SSH server
|
|
with the {command}`ssh-keyscan` command. The content
|
|
of the file should follow the same format as described for
|
|
the `publicKey` option. Only a single key
|
|
is supported. If a host has multiple keys, use
|
|
{option}`programs.ssh.knownHostsFiles` instead.
|
|
'';
|
|
};
|
|
};
|
|
}));
|
|
description = ''
|
|
The set of system-wide known SSH hosts. To make simple setups more
|
|
convenient the name of an attribute in this set is used as a host name
|
|
for the entry. This behaviour can be disabled by setting
|
|
`hostNames` explicitly. You can use
|
|
`extraHostNames` to add additional host names without
|
|
disabling this default.
|
|
'';
|
|
example = literalExpression ''
|
|
{
|
|
myhost = {
|
|
extraHostNames = [ "myhost.mydomain.com" "10.10.1.4" ];
|
|
publicKeyFile = ./pubkeys/myhost_ssh_host_dsa_key.pub;
|
|
};
|
|
"myhost2.net".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILIRuJ8p1Fi+m6WkHV0KWnRfpM1WxoW8XAS+XvsSKsTK";
|
|
"myhost2.net/dsa" = {
|
|
hostNames = [ "myhost2.net" ];
|
|
publicKeyFile = ./pubkeys/myhost2_ssh_host_dsa_key.pub;
|
|
};
|
|
}
|
|
'';
|
|
};
|
|
vacu.nix.extraSubstituters = mkOption { type = types.listOf types.str; };
|
|
vacu.nix.extraTrustedKeys = mkOption { type = types.listOf types.str; };
|
|
};
|
|
config = {
|
|
vacu.packages = packageOpts;
|
|
vacu.nix.extraSubstituters = [
|
|
"https://nixcache.shelvacu.com/"
|
|
"https://nix-community.cachix.org/"
|
|
];
|
|
vacu.nix.extraTrustedKeys = [
|
|
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
|
|
"nixcache.shelvacu.com:73u5ZGBpPRoVZfgNJQKYYBt9K9Io/jPwgUfuOLsJbsM="
|
|
];
|
|
assertions = flip mapAttrsToList cfg.ssh.knownHosts (name: data: {
|
|
assertion = (data.publicKey == null && data.publicKeyFile != null) ||
|
|
(data.publicKey != null && data.publicKeyFile == null);
|
|
message = "knownHost ${name} must contain either a publicKey or publicKeyFile";
|
|
});
|
|
vacu.ssh.authorizedKeys = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC4LYvUe9dsQb9OaTDFI4QKPtMmOHOGLwWsXsEmcJW86" # Termux on pixel6pro
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHcYwYy9/0Gu/GsqS72Nkz6OkId+zevqXA/aTIcvqflp" # t460s windows
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFsErA6M9LSHj2hPlLuHD8Lpei7WjMup1JxI1vxA6B8W" # pixel6pro nix-on-droid
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKoy1TrmfhBGWtVedgOM1FB1oD2UdodN3LkBnnLx6Tug" # compute-deck
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICVeSzDkGTueZijB0xUa08e06ovAEwwZK/D+Cc7bo91g" # triple-dezert
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOtwtao/TXbiuQOYJbousRPVesVcb/2nP0PCFUec0Nv8" # triple-dezert (root)
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAxAFFxQMXAgi+0cmGaNE/eAkVfEl91wafUqFIuAkI5I" # compute-deck (root)
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDcRDekd8ZOYfQS5X95/yNof3wFYIbHqWeq4jY0+ywQX" # pro1x nix-on-droid
|
|
];
|
|
vacu.ssh.config = ''
|
|
Host deckvacu
|
|
User deck
|
|
|
|
Host rsb
|
|
User user
|
|
HostName finaltask.xyz
|
|
Port 2222
|
|
|
|
Host awoo
|
|
HostName 45.142.157.71
|
|
|
|
Host trip
|
|
HostName trip.shelvacu.com
|
|
Port 6922
|
|
|
|
Host liam
|
|
HostName 178.128.79.152
|
|
|
|
Host pluto
|
|
HostName pluto.somevideogam.es
|
|
|
|
Host *
|
|
User shelvacu
|
|
GlobalKnownHostsFile ${pkgs.writeText "known_hosts" knownHostsText}
|
|
'';
|
|
|
|
vacu.ssh.knownHosts = {
|
|
#public hosts
|
|
"github.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
|
|
"gitlab.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf";
|
|
|
|
#colin's stuff
|
|
"uninsane.org" = {
|
|
extraHostNames = [ "git.uninsane.org" ];
|
|
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfdSmFkrVT6DhpgvFeQKm3Fh9VKZ9DbLYOPOJWYQ0E8";
|
|
};
|
|
"desko" = {
|
|
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFw9NoRaYrM6LbDd3aFBc4yyBlxGQn8HjeHd/dZ3CfHk";
|
|
};
|
|
|
|
#daymocker's stuff
|
|
"pluto" = {
|
|
extraHostNames = [ "74.208.184.137" ];
|
|
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICpHY4fLZ1hNuB2oRQM7R3b4eQyIHbFB45ZYp3XCELLg";
|
|
};
|
|
|
|
#personal hosts
|
|
"zigbee-hub" = {
|
|
extraHostNames = [ "10.78.79.114" ];
|
|
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBJxwUYddOxgViJDOiokfaQ6CsCx/Sw+b3IisdJv8zFN root@zigbee-hub";
|
|
};
|
|
trip = {
|
|
extraHostNames = [ "triple-dezert" "trip.shelvacu.com" "[trip.shelvacu.com]:6922" ];
|
|
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGUQux9V0mSF5IauoO1z311NXR7ymEbwRMzT+OaaNQr+";
|
|
};
|
|
servacu = {
|
|
extraHostNames = [ "mail.dis8.net" "servacu.shelvacu.com" ];
|
|
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE+E6na7np0HnBV2X7owno+Fg+bNNRSHLxO6n1JzdUTV";
|
|
};
|
|
finaltask = {
|
|
extraHostNames = [ "rsb" "finaltask.xyz" "[finaltask.xyz]:2222" ];
|
|
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPTx8WBNNKBVRV98HgDChpd59SHbreJ87SXU+zOKan6y";
|
|
};
|
|
compute-deck = {
|
|
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGt43GmXCxkl5QjgPQ/QimW11lKfXmV4GFWvlxQSf4TQ";
|
|
};
|
|
"2esrever" = {
|
|
extraHostNames = [ "10.4.5.218" "10.244.46.71" ];
|
|
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH0LnPrJxAdffZ//uRe3NBiIfFCBNMLqKVylkyU0llvT";
|
|
};
|
|
awoo = {
|
|
extraHostNames = [ "45.142.157.71" ];
|
|
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQaDjjfSK8jnk9aFIiYH9LZO4nLY/oeAc7BKIPUXMh1";
|
|
};
|
|
deckvacu = {
|
|
publicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEa8qpFkIlLLJkH8rmEAn6/MZ9ilCGmEQWC3CeFae7r1kOqfwRk0nq0oyOGJ50uIh+PpwEh3rbgq6mLfpRfsFmM=";
|
|
};
|
|
liam = {
|
|
extraHostNames = [ "liam.dis8.net" "178.128.79.152" ];
|
|
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHOqJYVHOIFmEA5uRbbirIupWvyBLAFwic/8EZQRdN/c";
|
|
};
|
|
};
|
|
};
|
|
}
|