john/dendritic
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ssh certificates on desktop

Browse Source
This commit is contained in:
John Lancaster
2026-03-15 14:45:33 -05:00
parent cdbfeb101d
commit e1b093929c
4 changed files with 26 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
modules/services/ssh.nix
View File

@@ -1,6 +1,7 @@
{inputs, ... }:
let
userName = "john";
sshHostPubKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNug18oLH0vZxnibXJzMJvTWFPZTnSlhCDDVi+rHhgnIum6ZXQ4SF+VHOOAM5BbzZmMKitNJ5lcrGP15Eur7DzQ=";
in
{
flake.modules.nixos.ssh = { pkgs, config, lib, ... }:
@@ -10,7 +11,7 @@ in
{
options.ssh = {
certificates = {
enable = lib.mkEnableOption "Enable SSH certificates";
enable = lib.mkEnableOption "Enable SSH host certificates";
userCA = lib.mkOption {
type = lib.types.path;
default = ../../keys/ssh_user_ca.pub;
@@ -42,7 +43,7 @@ in
programs.ssh.knownHosts = lib.mkIf cfg.certificates.enable {
"192.168.1.*" = {
certAuthority = true;
publicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNug18oLH0vZxnibXJzMJvTWFPZTnSlhCDDVi+rHhgnIum6ZXQ4SF+VHOOAM5BbzZmMKitNJ5lcrGP15Eur7DzQ=";
publicKey = sshHostPubKey;
};
};
};
@@ -64,11 +65,16 @@ in
homelab = lib.mkEnableOption "Enable various Homelab targets";
dev = lib.mkEnableOption "Enable development targets";
};
certificates = {
enable = lib.mkEnableOption "Enable SSH user certificates";
};
};
# All this stuff has to be wrapped in a config attribute because of the presence of the options here?
config = let
identityFile = config.ssh.IdentityFile;
cfg = config.ssh;
identityFile = cfg.IdentityFile;
publicKeyFile = "${identityFile}.pub";
certificateFile = "${identityFile}-cert.pub";
userKnownHostsFile = "${config.home.homeDirectory}/.ssh/known_hosts";
@@ -86,6 +92,14 @@ in
'')
];
home.file.".ssh/known_hosts" = {
text = lib.concatStringsSep "\n" (
[
"fded:fb16:653e:25da:be24:11ff:fea0:753f ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ9ZqiWPrCwHjxFCiu0lT4rlQs7KyMapxKJQQ5PJP1eh"
] ++ (lib.optional cfg.certificates.enable "@cert-authority 192.168.1.* ${sshHostPubKey}")
);
};
programs.ssh = {
enable = true;
enableDefaultConfig = false;
@@ -113,7 +127,7 @@ in
forwardAgent = false;
};
}
(lib.mkIf config.ssh.matchSets.appdaemon {
(lib.mkIf cfg.matchSets.appdaemon {
"appdaemon" = {
hostname = "192.168.1.242";
user = "appdaemon";
@@ -123,7 +137,7 @@ in
user = "appdaemon";
};
})
(lib.mkIf config.ssh.matchSets.certs {
(lib.mkIf cfg.matchSets.certs {
"janus" = {
hostname = "janus.john-stream.com";
user = "root";
@@ -133,7 +147,7 @@ in
user = "john";
};
})
(lib.mkIf config.ssh.matchSets.homelab {
(lib.mkIf cfg.matchSets.homelab {
"docs" = {
hostname = "192.168.1.110";
user = "root";
@@ -151,7 +165,7 @@ in
user = "panoptes";
};
})
(lib.mkIf config.ssh.matchSets.dev {
(lib.mkIf cfg.matchSets.dev {
"test-nix" = {
hostname = "fded:fb16:653e:25da:be24:11ff:fea0:753f";
user = "john";