dadada/nix-config
dadada/nix-config
1
0
Fork 0
Code Issues 2 Pull requests 5 Projects Releases Packages Wiki Activity Actions

ninurta: use initrd ssh key from agenix

Browse source
This commit is contained in:
Tim Schubert 2023-06-04 02:38:42 +02:00
parent 1524f02094
commit 41dc68ae6f
Signed by: dadada
GPG key ID: EEB8D1CE62C4DFEA
4 changed files with 26 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

46
nixos/ninurta/configuration.nix
View file

@ -10,7 +10,7 @@ let
wgHydraPrivKey = "pruflas-wg-hydra-key"; wgHydraPrivKey = "pruflas-wg-hydra-key";
wg0PresharedKey = "pruflas-wg0-preshared-key"; wg0PresharedKey = "pruflas-wg0-preshared-key";
hydraGitHubAuth = "hydra-github-authorization"; hydraGitHubAuth = "hydra-github-authorization";
initrdPrivateKey = "/etc/ssh/initrd_ssh_host_ed25519_key"; initrdSshKey = "ninurta-initrd-ssh-key";
in in
{ {
imports = [ imports = [
@ -44,29 +44,29 @@ in
enable = true; enable = true;
port = 2222; port = 2222;
authorizedKeys = config.dadada.admin.users.dadada.keys; authorizedKeys = config.dadada.admin.users.dadada.keys;
hostKeys = [ initrdPrivateKey ]; hostKeys = [ age.secrets.${initrdSshKey}.path ];
}; };
}; };
# Kinda does not work? # Kinda does not work?
# systemd = { systemd = {
# enable = true; enable = true;
# network = { network = {
# enable = true; enable = true;
# links = { links = {
# "10-lan" = { "10-lan" = {
# matchConfig.Name = "e*"; matchConfig.Name = "e*";
# linkConfig.MACAddressPolicy = "persistent"; linkConfig.MACAddressPolicy = "persistent";
# }; };
# }; };
# networks = { networks = {
# "10-lan" = { "10-lan" = {
# matchConfig.Name = "e*"; matchConfig.Name = "e*";
# networkConfig.DHCP = "ipv4"; networkConfig.DHCP = "ipv4";
# linkConfig.RequiredForOnline = "routable"; linkConfig.RequiredForOnline = "routable";
# }; };
# }; };
# }; };
# }; };
}; };
fileSystems."/mnt/storage" = { fileSystems."/mnt/storage" = {
@ -151,6 +151,10 @@ in
age.secrets.${wg0PrivKey}.file = "${secretsPath}/${wg0PrivKey}.age"; age.secrets.${wg0PrivKey}.file = "${secretsPath}/${wg0PrivKey}.age";
age.secrets.${wg0PresharedKey}.file = "${secretsPath}/${wg0PresharedKey}.age"; age.secrets.${wg0PresharedKey}.file = "${secretsPath}/${wg0PresharedKey}.age";
age.secrets.${wgHydraPrivKey}.file = "${secretsPath}/${wgHydraPrivKey}.age"; age.secrets.${wgHydraPrivKey}.file = "${secretsPath}/${wgHydraPrivKey}.age";
age.secrets.${initrdSshKey} = {
file = "${secretsPath}/${initrdSshKey}.age";
mode = "700";
};
services.snapper = { services.snapper = {
cleanupInterval = "1d"; cleanupInterval = "1d";

BIN
secrets/ninurta-initrd-ssh-key.age Normal file
View file

Binary file not shown.

BIN
secrets/ninurta-initrd_ssh_host_ed25519_key.age
View file

Binary file not shown.

2
secrets/secrets.nix
View file

@ -22,7 +22,7 @@ in
"gorgon-backup-passphrase-gs.age".publicKeys = [ systems.gorgon dadada ]; "gorgon-backup-passphrase-gs.age".publicKeys = [ systems.gorgon dadada ];
"paperless.age".publicKeys = [ systems.gorgon dadada ]; "paperless.age".publicKeys = [ systems.gorgon dadada ];
"surgat-ssh_host_ed25519_key.age".publicKeys = [ systems.surgat dadada ]; "surgat-ssh_host_ed25519_key.age".publicKeys = [ systems.surgat dadada ];
"ninurta-initrd_ssh_host_ed25519_key.age".publicKeys = [ systems.ninurta dadada ]; "ninurta-initrd-ssh-key.age".publicKeys = [ systems.ninurta dadada ];
} // } //
backupSecrets "ninurta" // backupSecrets "ninurta" //
backupSecrets "gorgon" // backupSecrets "gorgon" //