john/dendritic
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ssh user certs in home-manager

Browse Source
This commit is contained in:
John Lancaster
2026-07-09 09:01:34 -05:00
parent a0f5783bbc
commit b21bfd6bb4
4 changed files with 51 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/features/ssh/default.nix
+8 -17
View File
@@ -65,10 +65,6 @@ in
then adminJwkPath
else null;
};
userScripts = mkUserScripts {
inherit cfg pkgs;
provisionerPasswordFile = adminJwkPath;
};
CAknownHosts = (lib.genAttrs caPatterns (_: {
certAuthority = true;
publicKey = lib.removeSuffix "\n" (builtins.readFile sshHostCAPath);
@@ -157,10 +153,6 @@ in
home-manager.users.root = lib.mkIf cfg.certificates.user.enable {
home.stateVersion = lib.mkDefault config.system.stateVersion;
imports = [ inputs.self.modules.homeManager.ssh-new ];
home.packages = [
userScripts.sign
userScripts.check
];
ssh-new.certificates.user.enable = true;
};
};
@@ -169,6 +161,10 @@ in
flake.modules.homeManager.ssh-new = { config, pkgs, lib, ... }:
let
cfg = config.ssh-new;
userKeyPath =
if lib.hasPrefix "/" cfg.user.keyFile || lib.hasPrefix "~/" cfg.user.keyFile
then cfg.user.keyFile
else "${config.home.homeDirectory}/.ssh/${cfg.user.keyFile}";
hasAdminJwk = lib.hasAttrByPath [ "sops" "secrets" "janus/admin_jwk" ] config;
adminJwkPath = if hasAdminJwk then config.sops.secrets."janus/admin_jwk".path else null;
hostScripts = mkHostScripts { inherit cfg pkgs; };
@@ -186,16 +182,11 @@ in
config = {
home.file.".ssh/known_hosts" = lib.mkIf cfg.certificates.user.enable {
text = knownHostsText;
force = true;
};
home.packages = [
home.packages = lib.optionals cfg.certificates.user.enable [
userScripts.sign
userScripts.check
]
++ lib.optionals cfg.host.enable-scripts [
hostScripts.sign
hostScripts.renew
hostScripts.renewalCheck
hostScripts.check
];
programs.ssh = {
enable = true;
@@ -216,7 +207,7 @@ in
PasswordAuthentication = "no";
PreferredAuthentications = "publickey";
IdentitiesOnly = true;
IdentityFile = cfg.user.keyFile;
IdentityFile = userKeyPath;
StrictHostKeyChecking = "accept-new";
UserKnownHostsFile = "${config.home.homeDirectory}/.ssh/known_hosts";
@@ -232,7 +223,7 @@ in
# SSH certificate settings
++ lib.optionals cfg.certificates.user.enable [
{
CertificateFile = "${cfg.user.keyFile}-cert.pub";
CertificateFile = "${userKeyPath}-cert.pub";
}
]
);
modules/features/ssh/ssh-wrappers.nix
+9 -3
View File
@@ -67,7 +67,10 @@ in
flake.wrappers.signUserWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
imports = [ sshCertConfig ];
config = let cfg = config.ssh-new; in {
config =
let
cfg = config.ssh-new;
in {
binName = "ssh-user-cert-sign";
package = config.pkgs.step-cli;
args = [ "ssh" "certificate" "--sign" ]
@@ -84,11 +87,14 @@ in
flake.wrappers.userCheckWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
imports = [ sshCertConfig ];
config = {
config =
let
cfg = config.ssh-new;
in {
binName = "ssh-user-cert-check";
package = config.pkgs.openssh;
exePath = lib.getExe' config.pkgs.openssh "ssh-keygen";
args = [ "-Lf" "${config.ssh-new.user.keyFile}-cert.pub" ];
args = [ "-Lf" "$HOME/.ssh/${config.ssh-new.user.keyFile}-cert.pub" ];
};
});
modules/hosts/john-pc/default.nix
+6 -4
View File
@@ -47,10 +47,12 @@ in
];
docker.enable = true;
# ssh-new = {
# certificates.enable = true;
# host-scripts.enable = true;
# };
ssh-new = {
certificates = {
provisioner = "admin";
user.enable = true;
};
};
# ssh = {
# matchSets = {
# certs = true;
modules/users/john.nix
+28 -26
View File
@@ -16,44 +16,46 @@ in
authorizedKeys = [
# Shared keys for every host can go here.
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIAUa4dcg1TWc4pW++uodyhX4eOqrX/QYIxFWtEP7HFJ john@john-pc-ubuntu"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFn5ilhqaeDsOWSk7y29se2NvxGm8djlfL3RGLokj0q6 john@john-p14s"
];
};
flake.modules = {
nixos."${username}" = { config, pkgs, ... }: {
nixos."${username}" = { config, pkgs, ... }: let
selfMeta = inputs.self.meta.users."${username}";
in {
imports = [
baseUserModules.nixos."${username}"
];
users.users."${username}" = {
openssh.authorizedKeys.keys = inputs.self.meta.users."${username}".authorizedKeys;
openssh.authorizedKeys.keys = selfMeta.authorizedKeys;
};
};
# This module will be imported by the user factory
homeManager."${username}" = { pkgs, ... }:
with inputs.self.meta.users."${username}";
let
selfPkgs = inputs.self.packages.${pkgs.stdenv.hostPlatform.system};
in {
home.stateVersion = "25.11";
imports = with inputs.self.modules.homeManager; [
ssh-new
shell-tools
git
];
xdg.enable = true;
home.packages = [
selfPkgs.neovim-min
];
home.sessionVariables = {
EDITOR = "nvim";
VISUAL = "nvim";
GIT_EDITOR = "nvim";
SOPS_EDITOR = "nvim";
};
programs.git.settings.user.name = name;
programs.git.settings.user.email = email;
programs.git.settings.core.editor = "nvim";
homeManager."${username}" = { pkgs, ... }: let
selfMeta = inputs.self.meta.users."${username}";
selfPkgs = inputs.self.packages.${pkgs.stdenv.hostPlatform.system};
in {
home.stateVersion = "25.11";
imports = with inputs.self.modules.homeManager; [
ssh-new
shell-tools
git
];
xdg.enable = true;
home.packages = [
selfPkgs.neovim-min
];
home.sessionVariables = {
EDITOR = "nvim";
VISUAL = "nvim";
GIT_EDITOR = "nvim";
SOPS_EDITOR = "nvim";
};
programs.git.settings.user.name = selfMeta.name;
programs.git.settings.user.email = selfMeta.email;
programs.git.settings.core.editor = "nvim";
};
};
}