started new ssh module with janus
This commit is contained in:
John Lancaster
@@ -128,6 +128,9 @@ in
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = "admin";
|
||||
};
|
||||
provisionerPasswordFile = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
};
|
||||
validUsers = lib.mkOption {
|
||||
description = "A list of the user names that this cert will be valid for";
|
||||
type = lib.types.listOf lib.types.str;
|
||||
@@ -141,6 +144,9 @@ in
|
||||
package = config.pkgs.step-cli;
|
||||
args = [ "ssh" "certificate" "--sign" ]
|
||||
++ lib.optionals (config.provisioner != null) [ "--provisioner" "${config.provisioner}" ]
|
||||
++ lib.optionals (config.provisionerPasswordFile != null) [
|
||||
"--provisioner-password-file" "${config.provisionerPasswordFile}"
|
||||
]
|
||||
++ lib.optionals config.overwrite [ "-f" ]
|
||||
++ mkPrincipalArgs config.validUsers;
|
||||
};
|
||||
|
||||
@@ -0,0 +1,263 @@
|
||||
# New attempt at consolidating SSH config that wraps the step client, SSH certs, and all that in a top-level module
|
||||
{ self, inputs, ... }:
|
||||
let
|
||||
caPatterns = [ "*.john-stream.com" "192.168.1.*" "fded:fb16:653e:25da:be24:11ff:*" ];
|
||||
in
|
||||
{
|
||||
flake.modules.nixos.ssh-new = { config, pkgs, lib, ... }:
|
||||
let
|
||||
cfg = config.ssh-new;
|
||||
hostKeyFile = "${cfg.host.configDir}/${cfg.host.keyFile}";
|
||||
hostCertFile = "${hostKeyFile}-cert.pub";
|
||||
userCAFile = "${cfg.host.configDir}/${cfg.certificates.user.CAFile}";
|
||||
sshHostCAContent = lib.removeSuffix "\n" (builtins.readFile ../hosts/janus/public/ssh_host_ca_key.pub);
|
||||
CAknownHosts = (lib.genAttrs caPatterns (_: {
|
||||
certAuthority = true;
|
||||
publicKey = sshHostCAContent;
|
||||
}));
|
||||
|
||||
wrappers = inputs.self.wrappers;
|
||||
provisionerPasswordFile = config.sops.secrets."janus/admin_jwk".path;
|
||||
sshHostCertSign = (wrappers.signHostWrapper.apply {
|
||||
inherit pkgs provisionerPasswordFile;
|
||||
inherit (cfg.certificates) provisioner;
|
||||
inherit (cfg.certificates.host) extraPrincipals;
|
||||
}).wrapper;
|
||||
sshHostCertRenew = (wrappers.renewHostWrapper.apply {
|
||||
inherit pkgs;
|
||||
sshHostKeyFile = hostKeyFile;
|
||||
overwrite = true;
|
||||
}).wrapper;
|
||||
sshHostCertCheck = (wrappers.hostCheckWrapper.apply {
|
||||
inherit pkgs;
|
||||
certPath = hostCertFile;
|
||||
}).wrapper;
|
||||
sshHostRenewalCheck = (wrappers.renewalCheck.apply {
|
||||
inherit pkgs;
|
||||
certPath = hostCertFile;
|
||||
expires-in = "4h";
|
||||
}).wrapper;
|
||||
sshUserCertSign = (wrappers.signUserWrapper.apply {
|
||||
inherit pkgs provisionerPasswordFile;
|
||||
inherit (cfg.certificates) provisioner;
|
||||
validUsers = [ "root" "john" "appdaemon" ];
|
||||
}).wrapper;
|
||||
sshUserCertCheck = (wrappers.userCheckWrapper.apply {
|
||||
inherit pkgs;
|
||||
certPath = "${cfg.user.keyFile}-cert.pub";
|
||||
}).wrapper;
|
||||
in
|
||||
{
|
||||
options.ssh-new = {
|
||||
user = {
|
||||
keyFile = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "$HOME/.ssh/id_ed25519";
|
||||
};
|
||||
};
|
||||
host = {
|
||||
configDir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/etc/ssh";
|
||||
};
|
||||
keyFile = lib.mkOption {
|
||||
description = "String path to the host private key file";
|
||||
type = lib.types.str;
|
||||
default = "ssh_host_ed25519_key";
|
||||
};
|
||||
keyType = lib.mkOption {
|
||||
description = "OpenSSH host key type for ssh.hostKey.";
|
||||
type = lib.types.enum [ "ed25519" "rsa" "ecdsa" ];
|
||||
default = "ed25519";
|
||||
};
|
||||
extraSettings = lib.mkOption {
|
||||
description = "Extra settings to merge";
|
||||
type = lib.types.attrs;
|
||||
default = { };
|
||||
};
|
||||
};
|
||||
certificates = {
|
||||
provisioner = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
};
|
||||
host = {
|
||||
enable = lib.mkEnableOption "Enable SSH host certs";
|
||||
autoRenew = lib.mkEnableOption "Auto-renew the SSH host certs with a systemd service/timer";
|
||||
extraPrincipals = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
default = [ ];
|
||||
};
|
||||
};
|
||||
user = {
|
||||
enable = lib.mkEnableOption "Enable SSH user certs";
|
||||
CAFile = lib.mkOption {
|
||||
description = "Filename of the SSH user CA with the config directory";
|
||||
type = lib.types.str;
|
||||
default = "ssh_user_ca_key.pub";
|
||||
};
|
||||
extraPrincipals = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
default = [ ];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
hostKeys = [
|
||||
{
|
||||
path = hostKeyFile;
|
||||
type = cfg.host.keyType;
|
||||
}
|
||||
];
|
||||
settings = lib.mkMerge [
|
||||
{
|
||||
PasswordAuthentication = false;
|
||||
KbdInteractiveAuthentication = false;
|
||||
}
|
||||
cfg.host.extraSettings
|
||||
(lib.mkIf cfg.certificates.host.enable {
|
||||
HostCertificate = "${hostKeyFile}-cert.pub";
|
||||
})
|
||||
(lib.mkIf cfg.certificates.user.enable {
|
||||
TrustedUserCAKeys = "${cfg.host.configDir}/${cfg.certificates.user.CAFile}";
|
||||
})
|
||||
];
|
||||
};
|
||||
|
||||
environment.etc."ssh/${cfg.certificates.user.CAFile}" = lib.mkIf cfg.certificates.user.enable {
|
||||
source = ../hosts/janus/public/ssh_user_ca_key.pub;
|
||||
};
|
||||
|
||||
environment.systemPackages = (
|
||||
lib.optionals cfg.certificates.host.enable [
|
||||
sshHostCertSign
|
||||
sshHostCertRenew
|
||||
sshHostRenewalCheck
|
||||
sshHostCertCheck
|
||||
]
|
||||
);
|
||||
|
||||
sops = lib.mkIf cfg.certificates.host.autoRenew {
|
||||
secrets."janus/admin_jwk" = {
|
||||
sopsFile = ../../keys/secrets.yaml;
|
||||
owner = "root";
|
||||
group = "root";
|
||||
mode = "0400";
|
||||
};
|
||||
};
|
||||
|
||||
systemd = lib.mkIf cfg.certificates.host.autoRenew {
|
||||
services.ssh-certs-renew = {
|
||||
description = "SSH host certificate renewal";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network-online.target" ];
|
||||
wants = [ "network-online.target" ];
|
||||
path = with pkgs; [ step-cli systemd ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
User = "root";
|
||||
Group = "root";
|
||||
ExecCondition = lib.getExe sshHostRenewalCheck;
|
||||
ExecStart = lib.getExe sshHostCertRenew;
|
||||
};
|
||||
};
|
||||
timers.ssh-certs-renew = {
|
||||
description = "Periodic Step SSH host certificate renewal";
|
||||
wantedBy = [ "timers.target" ];
|
||||
timerConfig = {
|
||||
OnBootSec = "5m";
|
||||
OnUnitActiveSec = "4h";
|
||||
RandomizedDelaySec = "15m";
|
||||
Persistent = true;
|
||||
Unit = "ssh-certs-renew.service";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# This winds up in /etc/ssh/ssh_known_hosts, which applies to all users
|
||||
programs.ssh.knownHosts = lib.mkIf cfg.certificates.user.enable CAknownHosts;
|
||||
|
||||
home-manager.users.root = lib.mkIf cfg.certificates.user.enable {
|
||||
home.stateVersion = lib.mkDefault config.system.stateVersion;
|
||||
imports = with inputs.self.modules.homeManager; [
|
||||
ssh-new
|
||||
];
|
||||
home.packages = [
|
||||
sshUserCertSign
|
||||
sshUserCertCheck
|
||||
];
|
||||
ssh-new.certificates.enable = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
flake.modules.homeManager.ssh-new = { config, pkgs, lib, ... }:
|
||||
let
|
||||
cfg = config.ssh-new;
|
||||
sshHostCAContent = lib.removeSuffix "\n" (builtins.readFile ../hosts/janus/public/ssh_host_ca_key.pub);
|
||||
knownHostsText = lib.concatMapStrings
|
||||
(pattern: "@cert-authority ${pattern} ${sshHostCAContent}\n")
|
||||
caPatterns;
|
||||
in
|
||||
{
|
||||
options.ssh-new = {
|
||||
keyFile = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "${config.home.homeDirectory}/.ssh/id_ed25519";
|
||||
};
|
||||
certificates = {
|
||||
enable = lib.mkEnableOption "Enable SSH client certificates";
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
home.file = lib.mkIf cfg.certificates.enable {
|
||||
".ssh/known_hosts".text = knownHostsText;
|
||||
};
|
||||
programs.ssh = {
|
||||
enable = true;
|
||||
enableDefaultConfig = false;
|
||||
settings = {
|
||||
# These settings apply to all connections
|
||||
"*" = lib.mkMerge (
|
||||
[
|
||||
# Default settings
|
||||
{
|
||||
Compression = false;
|
||||
ServerAliveInterval = 60;
|
||||
ServerAliveCountMax = 3;
|
||||
TCPKeepAlive = "yes";
|
||||
|
||||
PubkeyAuthentication = "yes";
|
||||
PasswordAuthentication = "no";
|
||||
PreferredAuthentications = "publickey";
|
||||
IdentitiesOnly = true;
|
||||
IdentityFile = cfg.keyFile;
|
||||
|
||||
StrictHostKeyChecking = "accept-new";
|
||||
UserKnownHostsFile = "${config.home.homeDirectory}/.ssh/known_hosts";
|
||||
|
||||
HashKnownHosts = lib.mkDefault false;
|
||||
AddKeysToAgent = lib.mkDefault "yes";
|
||||
ForwardAgent = lib.mkDefault false;
|
||||
|
||||
RequestTTY = lib.mkDefault "auto";
|
||||
SetEnv.TERM = "xterm-256color";
|
||||
}
|
||||
]
|
||||
# SSH certificate settings
|
||||
++ lib.optionals cfg.certificates.enable [
|
||||
{
|
||||
CertificateFile = "${cfg.keyFile}-cert.pub";
|
||||
}
|
||||
]
|
||||
);
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -4,13 +4,15 @@ let
|
||||
hostname = "janus";
|
||||
ipv4 = "192.168.1.32";
|
||||
ipv6 = "fded:fb16:653e:25da:be24:11ff:fe6b:4d57";
|
||||
names = [ "${hostname}.john-stream.com" ipv4 ipv6 ];
|
||||
in
|
||||
{
|
||||
flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
|
||||
modules = with inputs.self.modules; [
|
||||
nixos.lxc
|
||||
nixos.mysops
|
||||
nixos.ssh-certs
|
||||
# nixos.ssh-certs
|
||||
nixos.ssh-new
|
||||
nixos.step-client
|
||||
nixos.step-ca
|
||||
inputs.home-manager.nixosModules.home-manager
|
||||
@@ -24,18 +26,19 @@ in
|
||||
"Step-CA" = "step-ca";
|
||||
};
|
||||
sops.defaultSopsFile = ./secrets.yaml;
|
||||
ssh-certs = {
|
||||
ssh-new.certificates = {
|
||||
provisioner = "admin";
|
||||
extraPrincipals = [ "janus.john-stream.com" ipv4 ipv6 ];
|
||||
host = {
|
||||
enable = true;
|
||||
extraPrincipals = names;
|
||||
autoRenew = true;
|
||||
};
|
||||
user.enable = true;
|
||||
};
|
||||
step-ca = {
|
||||
rootCertPath = ./public/root_ca.crt;
|
||||
intermediateCertPath = ./public/intermediate_ca.crt;
|
||||
dnsNames = [
|
||||
"${hostname}.john-stream.com"
|
||||
ipv4
|
||||
ipv6
|
||||
];
|
||||
dnsNames = names;
|
||||
secrets = {
|
||||
sopsFile = ./secrets.yaml;
|
||||
caPassword = "janus/ca_password";
|
||||
@@ -67,10 +70,6 @@ in
|
||||
);
|
||||
};
|
||||
|
||||
# users.users."${username}".openssh.authorizedKeys.keys = [
|
||||
# "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMOkGLo4N/L3RYvaIZ1FmePlxa1HK0fMciZxKtRhN58F root@janus"
|
||||
# ];
|
||||
|
||||
home-manager.users."${username}" = {
|
||||
imports = with inputs.self.modules.homeManager; [
|
||||
mysops
|
||||
|
||||
@@ -15,12 +15,9 @@
|
||||
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
||||
environment.systemPackages = with pkgs; [
|
||||
git
|
||||
zsh
|
||||
selfPackages.jsl-zsh-tty
|
||||
];
|
||||
environment.shells = lib.mkAfter [
|
||||
rootShellPath
|
||||
];
|
||||
environment.shells = lib.mkAfter [ rootShellPath ];
|
||||
users.users.root.shell = lib.mkForce rootShellPath;
|
||||
|
||||
# security.sudo-rs.enable = true;
|
||||
|
||||
Reference in New Issue
Block a user