john/dendritic
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

pruned old ssh module

Browse Source
This commit is contained in:
John Lancaster
2026-07-05 19:23:32 -05:00
parent b37ee5777d
commit 87821ed109
1 changed files with 0 additions and 248 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/services/ssh.nix
-248
View File
@@ -1,248 +0,0 @@
{ inputs, ... }:
let
sshHostCAPubKeyPath = ../hosts/janus/public/ssh_host_ca_key.pub;
in
{
flake.modules.nixos.ssh = { config, pkgs, lib, ... }:
let
cfg = config.ssh;
configDir = "/etc/ssh";
sshHostCAPubKey = lib.removeSuffix "\n" (builtins.readFile sshHostCAPubKeyPath);
in
{
options.ssh = {
hostKey = lib.mkOption {
description = "String path to the host private key file";
type = lib.types.str;
default = "ssh_host_ed25519_key";
};
hostKeyType = lib.mkOption {
description = "OpenSSH host key type for ssh.hostKey.";
type = lib.types.enum [ "ed25519" "rsa" "ecdsa" ];
default = "ed25519";
};
fallbackHostKeys = lib.mkOption {
description = "Additional non-certificate host keys that keep sshd reachable during certificate bootstrap.";
type = with lib.types; listOf (submodule {
options = {
path = lib.mkOption {
description = "Path to the host private key file.";
type = str;
};
type = lib.mkOption {
description = "OpenSSH host key type.";
type = enum [ "ed25519" "rsa" "ecdsa" ];
};
};
});
default = [
{
path = "${configDir}/ssh_host_rsa_key";
type = "rsa";
}
];
};
certificates = {
enable = lib.mkEnableOption "Enable SSH host certificates";
userCA = lib.mkOption {
description = "Content for the SSH user CA file (public key)";
type = lib.types.path;
default = sshHostCAPubKeyPath;
};
userCAFile = lib.mkOption {
description = "String path to the SSh user CA";
type = lib.types.str;
default = "ssh_user_ca_key.pub";
};
};
};
config = {
services.openssh = {
enable = true;
hostKeys = cfg.fallbackHostKeys ++ [
{
path = "${configDir}/${cfg.hostKey}";
type = cfg.hostKeyType;
}
];
# require public key authentication for better security
settings = lib.mkMerge [
{
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
}
(lib.mkIf cfg.certificates.enable {
TrustedUserCAKeys = "${configDir}/${cfg.certificates.userCAFile}";
HostCertificate = "${configDir}/${cfg.hostKey}-cert.pub";
})
];
};
environment.etc."ssh/${cfg.certificates.userCAFile}" = lib.mkIf cfg.certificates.enable {
source = cfg.certificates.userCA;
};
programs.ssh.knownHosts = lib.mkIf cfg.certificates.enable {
"192.168.1.*" = {
certAuthority = true;
publicKey = sshHostCAPubKey;
};
"*.john-stream.com" = {
certAuthority = true;
publicKey = sshHostCAPubKey;
};
};
};
};
flake.modules.homeManager.ssh = { config, pkgs, lib, ... }:
let
cfg = config.ssh;
configDir = "${config.home.homeDirectory}/.ssh";
identityFile = cfg.identityFile;
publicKeyFile = "${identityFile}.pub";
certificateFile = "${identityFile}-cert.pub";
sshHostCAPubKey = lib.removeSuffix "\n" (builtins.readFile sshHostCAPubKeyPath);
in
{
options.ssh = with lib; {
identityFile = mkOption {
# Intentionally not using a path type here because that will end up with the private key getting copied into the store
type = types.str;
default = "${config.home.homeDirectory}/.ssh/id_ed25519";
description = "Path to the SSH identity file.";
};
certificates = {
enable = mkEnableOption "Enable SSH client certificates";
};
knownHostsFile = mkOption {
type = types.str;
default = "${configDir}/known_hosts";
};
knownHosts = mkOption {
description = "";
type = types.listOf types.str;
default = [ ];
};
matchSets = {
appdaemon = mkEnableOption "Enable AppDaemon SSH targets";
certs = mkEnableOption "Enable Janus and Soteria SSH targets";
homelab = mkEnableOption "Enable various Homelab targets";
dev = mkEnableOption "Enable development targets";
tailscale = mkEnableOption "Enable tailscale targets";
};
};
config = {
home.file.".ssh/known_hosts" = {
text = lib.concatStringsSep "\n" (
cfg.knownHosts ++ lib.optionals cfg.certificates.enable [
"@cert-authority 192.168.1.* ${sshHostCAPubKey}"
"@cert-authority *.john-stream.com ${sshHostCAPubKey}"
]
);
};
programs.ssh = {
enable = true;
enableDefaultConfig = false;
extraConfig = ''
SetEnv TERM="xterm-256color"
'';
settings = lib.mkMerge [
{
"john-pc-ubuntu" = {
HostName = "192.168.1.85";
};
"*" = lib.mkMerge [
{
User = "john";
IdentityAgent = "${config.home.homeDirectory}/.1password/agent.sock";
Compression = false;
ServerAliveInterval = 0;
ServerAliveCountMax = 3;
IdentitiesOnly = true;
IdentityFile = identityFile;
HashKnownHosts = false;
UserKnownHostsFile = cfg.knownHostsFile;
AddKeysToAgent = "yes";
ForwardAgent = false;
}
(lib.mkIf cfg.certificates.enable { CertificateFile = certificateFile; })
];
}
(lib.mkIf cfg.matchSets.appdaemon {
"appdaemon" = {
HostName = "192.168.1.242";
User = "appdaemon";
};
"ad-nix" = {
HostName = "192.168.1.201";
User = "appdaemon";
};
})
(lib.mkIf cfg.matchSets.certs {
"janus" = {
HostName = "fded:fb16:653e:25da:be24:11ff:fe6b:4d57";
User = "root";
};
"soteria" = {
HostName = "soteria.john-stream.com";
User = "john";
};
})
(lib.mkIf cfg.matchSets.homelab {
"docs" = {
HostName = "192.168.1.110";
User = "root";
RequestTTY = "force";
RemoteCommand = "~/.nix-profile/bin/jsl-zsh";
};
"gitea" = {
HostName = "192.168.1.104";
User = "john";
};
"hermes" = {
HostName = "192.168.1.150";
User = "root";
# Enabling this breaks the ability of Zed to install its remote stuff
# RequestTTY = "force";
# RemoteCommand = "/root/.nix-profile/bin/jsl-zsh";
};
"panoptes" = {
HostName = "192.168.1.107";
User = "panoptes";
};
})
(lib.mkIf cfg.matchSets.dev {
"test-nix" = {
HostName = "fded:fb16:653e:25da:be24:11ff:fea0:753f";
User = "john";
RequestTTY = "auto";
# RemoteCommand = "/run/current-system/sw/bin/jsl-zsh";
};
})
(lib.mkIf cfg.matchSets.tailscale {
"jdl-docker" = {
HostName = "jdl-docker.tailcf205.ts.net";
User = "john";
RequestTTY = "auto";
# RemoteCommand = "~/.nix-profile/bin/jsl-zsh";
};
})
];
};
};
};
}