sora/nixconfig
1
0
Fork 0
Code Issues 2 Pull Requests Actions Releases Activity

Fix SSH

Browse Source
This commit is contained in:
soraefir
2026-05-02 20:49:35 +02:00
parent a7edc932a8
commit 0baf9c1800
10 changed files with 41 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
modules/nixos/system/network/wireguard/default.nix
View File

@@ -1,19 +1,10 @@
{ config, lib, pkgs, ... }: let
systemsDir = ../../../../../systems;
systemNames = lib.attrNames (lib.filterAttrs
(name: type: type == "directory" && builtins.pathExists (systemsDir + "/${name}/cfg.nix"))
(builtins.readDir systemsDir));
# Use a helper to check if the attribute path exists safely
# This prevents the "attribute 'net' missing" error
isValidPeer = p:
(p ? syscfg.net.wg.enable) &&
(p.syscfg.net.wg.enable == true) &&
(p.syscfg.net.wg.pubkey != config.syscfg.net.wg.pubkey);
importedConfigs = map (name: import (systemsDir + "/${name}/cfg.nix")) systemNames;
activePeers = builtins.filter isValidPeer importedConfigs;
activePeers = builtins.filter isValidPeer config.syscfg.peers;
in
{
imports = [ ./forwarding.nix ];

15
modules/server/sops/default.nix
View File

@@ -1,19 +1,4 @@
{ config, pkgs, ... }: {
sops.secrets.INFOMANIAK_API_KEY = { sopsFile = ./server.yaml; };
sops.secrets."${config.syscfg.hostname}_ssh_pub" = {
mode = "0400";
owner = config.users.users.${config.syscfg.defaultUser}.name;
group = config.users.users.${config.syscfg.defaultUser}.group;
};
sops.secrets."iriy_ssh_pub" = {
mode = "0444";
owner = config.users.users.${config.syscfg.defaultUser}.name;
group = config.users.users.${config.syscfg.defaultUser}.group;
};
sops.secrets."valinor_ssh_pub" = {
mode = "0444";
owner = config.users.users.${config.syscfg.defaultUser}.name;
group = config.users.users.${config.syscfg.defaultUser}.group;
};
sops.secrets."${config.syscfg.hostname}_wg_priv" = { };
}

28
modules/shared/sops/common.yaml
View File

File diff suppressed because one or more lines are too long

9
modules/shared/sops/default.nix
View File

@@ -22,16 +22,7 @@ in {
owner = config.users.users.${config.syscfg.defaultUser}.name;
group = config.users.users.${config.syscfg.defaultUser}.group;
};
"${config.syscfg.hostname}_ssh_pub" = {
mode = "0444";
owner = config.users.users.${config.syscfg.defaultUser}.name;
group = config.users.users.${config.syscfg.defaultUser}.group;
};
"${config.syscfg.hostname}_wg_priv" = { };
}
(lib.genAttrs
(map (peer: "${peer}_ssh_pub") ["iriy" "avalon" "valinor"])
(_: { mode = "0444"; })
)
];
}

9
modules/shared/syscfg/default.nix
View File

@@ -1,7 +1,13 @@
{ inputs, lib, ... }:
let
systemsDir = ../../../systems;
systemNames = lib.attrNames (lib.filterAttrs
(name: type: type == "directory" && builtins.pathExists (systemsDir + "/${name}/cfg.nix"))
(builtins.readDir systemsDir));
userOpt = with lib; {
username = mkOption { type = types.str; };
pubssh = mkOption { type = types.str; default=""; };
wm = mkOption {
type = types.enum [ "Wayland" "X11" "-" ];
default = "-";
@@ -138,6 +144,9 @@ in with lib; {
type = types.listOf (types.submodule { options = userOpt; });
default = [ ];
};
peers = mkOption {
default = map (name: import (systemsDir + "/${name}/cfg.nix")) systemNames;
};
server = mkOption {
type = types.oneOf [
(types.attrs)

1
systems/gateway/cfg.nix
View File

@@ -6,6 +6,7 @@
defaultUser = "sora";
users = [{
username = "sora";
pubssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrrUB0KBjeAKPVG2Bdcm4mI9AMab7y97SOCdEHGogYv sora@gateway";
wm = "-";
git = {
email = "soraefir+git@helcel";

25
systems/gateway/default.nix
View File

@@ -1,13 +1,22 @@
{ config, lib, inputs, ... }: {
{ config, lib, inputs, ... }:
let
allUsers = lib.concatMap (peer: if peer ? users then peer.users else []) config.syscfg.peers;
groupedUsers = lib.groupBy (u: u.username) allUsers;
allowedUsernames = map (u: u.username) config.syscfg.users;
activeUsers = lib.filterAttrs (name: _: lib.elem name allowedUsernames) groupedUsers;
userConfigs = lib.mapAttrs (name: userList: {
isNormalUser = true;
openssh.authorizedKeys.keys = lib.unique (map (u: u.pubssh) userList);
}) groupedUsers;
in {
imports = [ ./hardware.nix ];
services.openssh.enable = true;
services.openssh.authorizedKeysFiles = [
config.sops.secrets."iriy_ssh_pub".path
config.sops.secrets."valinor_ssh_pub".path
];
users.users.root.openssh.authorizedKeys.keys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC0GpKd62XMlO410/iYkNG8MHdGGaeMG3Gmsf3Pv3u2BllUzR9Dpym1ZOz2lwo3iK0FimcQpOiJqSIahO59HJl8jQ9BoQrJMXH7l2kuq1T09cMNWGjlzowg0LWKWOzoBzOwcheyW68OJGgkSfvk9BdshkUYTLVBXjiI9jo/8Qkcv1WLJJvJmDBDwnbYDQpODXCEDQ/t3YVubb+ocLmh40sDUffJLWZQXN6OFW9N5XxnvY7K5x9ci9GU4Reei40K8yDw2Hgi0njzijRdzie3MJlKPPawJ2TATu9LsGuxfx8bJXVx+mNxP0lhO8dOOhP7p0ozTxlJJY9ZWaKgOz3SzYNCgJ1gH7NtTBtSruXd6pfmErUmuJEAeMD6+QF3yJ5tnVFNPoSHqjP+oL3CgSRpmuvn7ChSSI3J3UVhLux165VtwIL7UhosO2mCqmn0Yk2mSBkB/L4ZiWFmO3vYdagYNQX7xZHzCJ5my8vomiT+DUGb2h/o1NetKwIZJiFAuHxKt3k= sora@valinor"
];
users.users = lib.mapAttrs (name: userList: {
openssh.authorizedKeys.keys = lib.unique (map (u: u.pubssh) userList);
}) activeUsers // {
root = {openssh.authorizedKeys.keys = [];};
};
}

1
systems/iriy/cfg.nix
View File

@@ -6,6 +6,7 @@
defaultUser = "sora";
users = [{
username = "sora";
pubssh = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDGtotfQkclilrhEOzY3QUpOwYF+eOjHvqN6Of3NVg4x8NQLjx/X/gxC+GAllQxy9Zkz/N5wY0Fa4/6HoGheCRvWaN/nofz95VgtX8a1A/flrT8CGdBfRqXlcd4OEXhpFcbEm9VRXmxSKnsD4zySZr/151S+1PlQr8pJ1yyzxsIQx+RNo9P4gzpoJgkfZ3JIqLWb6B4aXallAg9Ha1WX0lx24voWNgg9AQt6/lccfmeoWAzBGUNq5a/mH59O+UCIM2y19ksEweY6URHpk6Ss597zp+0j2NYg8MS4rToYUb0Y7giNNBdKAzqNd+Wp6gjqBthuDIOfsXM082O5IarPKPJNVbx/Xpf3m1hYtxfL+LhEkdoE94iue601WqTltC0btS63LeZuoAZYji/GG/D8U7V77Lh3MV5/hJm5sK6wM6r7fCoenehgiy49z00NqtgM33rWNrpL9eXNKb//5Lxe7U58jPyteWpsL8+fJFcs/2uh4D5zN3d/I+yLZ1OMgUN6LM= sora@iriy";
wm = "Wayland";
git = {
email = "soraefir+git@helcel";

4
systems/sandbox/default.nix
View File

@@ -2,10 +2,6 @@
imports = [ ./hardware.nix ../../modules/server ];
services.openssh.enable = true;
services.openssh.authorizedKeysFiles = [
config.sops.secrets."iriy_ssh_pub".path
config.sops.secrets."valinor_ssh_pub".path
];
users.users.root.openssh.authorizedKeys.keys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC0GpKd62XMlO410/iYkNG8MHdGGaeMG3Gmsf3Pv3u2BllUzR9Dpym1ZOz2lwo3iK0FimcQpOiJqSIahO59HJl8jQ9BoQrJMXH7l2kuq1T09cMNWGjlzowg0LWKWOzoBzOwcheyW68OJGgkSfvk9BdshkUYTLVBXjiI9jo/8Qkcv1WLJJvJmDBDwnbYDQpODXCEDQ/t3YVubb+ocLmh40sDUffJLWZQXN6OFW9N5XxnvY7K5x9ci9GU4Reei40K8yDw2Hgi0njzijRdzie3MJlKPPawJ2TATu9LsGuxfx8bJXVx+mNxP0lhO8dOOhP7p0ozTxlJJY9ZWaKgOz3SzYNCgJ1gH7NtTBtSruXd6pfmErUmuJEAeMD6+QF3yJ5tnVFNPoSHqjP+oL3CgSRpmuvn7ChSSI3J3UVhLux165VtwIL7UhosO2mCqmn0Yk2mSBkB/L4ZiWFmO3vYdagYNQX7xZHzCJ5my8vomiT+DUGb2h/o1NetKwIZJiFAuHxKt3k= sora@valinor"
];

1
systems/valinor/cfg.nix
View File

@@ -6,6 +6,7 @@
defaultUser = "sora";
users = [{
username = "sora";
pubssh = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDCZibVYTvS4Dd+ZhGCpRpKfxs1fQeepNTzfzYk9I12Hyez25pQCeH+6ArrVhf6yX5Na1ffkvqTrNIDYJ1V2GHhemX0ruYp2B3xt229JszI7DeRC7YeG7v5uvsfTgicADCstGPSNorKXuNnHuBebSHpmWWbuKrYZdmcA/Az7H8uwF5+VQrnyASgZgwGV94MHinFVWsisB7o6iq4qxqpsUdtuZGbU0stDE5f9DLMDYuUxtx+jASRt+X60Bzjv3OFjU/b/YYzojTtuujkYXunNNTceCB4DTue5YMKQOlmd/IezL5nPAK9IsonPqojX9LPk2RvTCr4qalQ6AD92nq+xMW6FY1uJaKT81S8TvZcaqTm4FhEDkChuFq77biSUDhQkpcdNVOjUn5OtKpYl+0VkCaAx/8uyoylBacrn1XXLLg+gjwGCFHa2eeNu/BKIUa+5EK/FRwLpnEoPDkAHQ95JXQewChcUKG8A+Bz29XRKr9J64kbbGmwa+yjlVTPLSE6ZZE= sora@valinor";
wm = "Wayland";
git = {
email = "soraefir+git@helcel";