jawz/NixOS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refactor SSH key management to use centralized key retrieval function for nixremote users across configurations.

Browse Source
This commit is contained in:
Danilo Reyes 2025-10-12 20:28:39 -06:00
parent 0f7e28abd0
commit de5ad541b8
6 changed files with 37 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
config/jawz.nix
View File

@ -68,14 +68,14 @@ in
"plugdev" "plugdev"
"bluetooth" "bluetooth"
]; ];
openssh.authorizedKeys.keyFiles = [ openssh.authorizedKeys.keyFiles = inputs.self.lib.getSshKeys [
../secrets/ssh/ed25519_deacero.pub "deacero"
../secrets/ssh/ed25519_workstation.pub "workstation"
../secrets/ssh/ed25519_server.pub "server"
../secrets/ssh/ed25519_miniserver.pub "miniserver"
../secrets/ssh/ed25519_galaxy.pub "galaxy"
../secrets/ssh/ed25519_phone.pub "phone"
../secrets/ssh/ed25519_vps.pub "vps"
]; ];
}; };
} }

6
hosts/miniserver/configuration.nix
View File

@ -9,9 +9,9 @@
nix.cores = 3; nix.cores = 3;
nix.maxJobs = 8; nix.maxJobs = 8;
users.nixremote.enable = true; users.nixremote.enable = true;
users.nixremote.authorizedKeys = [ users.nixremote.authorizedKeys = inputs.self.lib.getSshKeys [
../../secrets/ssh/ed25519_nixworkstation.pub "nixworkstation"
../../secrets/ssh/ed25519_nixserver.pub "nixserver"
]; ];
}; };
nix.buildMachines = nix.buildMachines =

6
hosts/server/configuration.nix
View File

@ -13,9 +13,9 @@
my = import ./toggles.nix { inherit config inputs; } // { my = import ./toggles.nix { inherit config inputs; } // {
nix.cores = 6; nix.cores = 6;
users.nixremote.enable = true; users.nixremote.enable = true;
users.nixremote.authorizedKeys = [ users.nixremote.authorizedKeys = inputs.self.lib.getSshKeys [
../../secrets/ssh/ed25519_nixworkstation.pub "nixworkstation"
../../secrets/ssh/ed25519_nixminiserver.pub "nixminiserver"
]; ];
network.firewall.enabledServicePorts = true; network.firewall.enabledServicePorts = true;
network.firewall.additionalPorts = [ network.firewall.additionalPorts = [

6
hosts/workstation/configuration.nix
View File

@ -26,9 +26,9 @@ in
nix.cores = 8; nix.cores = 8;
nix.maxJobs = 8; nix.maxJobs = 8;
users.nixremote.enable = true; users.nixremote.enable = true;
users.nixremote.authorizedKeys = [ users.nixremote.authorizedKeys = inputs.self.lib.getSshKeys [
../../secrets/ssh/ed25519_nixserver.pub "nixserver"
../../secrets/ssh/ed25519_nixminiserver.pub "nixminiserver"
]; ];
}; };
home-manager.users.jawz = { home-manager.users.jawz = {

10
modules/users/nixremote.nix
View File

@ -1,13 +1,13 @@
{ lib, config, ... }: { lib, config, inputs, ... }:
{ {
options.my.users.nixremote = { options.my.users.nixremote = {
enable = lib.mkEnableOption "nixremote user for distributed builds"; enable = lib.mkEnableOption "nixremote user for distributed builds";
authorizedKeys = lib.mkOption { authorizedKeys = lib.mkOption {
type = lib.types.listOf lib.types.path; type = lib.types.listOf lib.types.path;
default = [ default = inputs.self.lib.getSshKeys [
../../secrets/ssh/ed25519_nixworkstation.pub "nixworkstation"
../../secrets/ssh/ed25519_nixserver.pub "nixserver"
../../secrets/ssh/ed25519_nixminiserver.pub "nixminiserver"
]; ];
description = "List of SSH public key files to authorize for nixremote user"; description = "List of SSH public key files to authorize for nixremote user";
}; };

15
parts/core.nix
View File

@ -197,6 +197,21 @@ in
mkPostgresDependencies = mkPostgresDependencies =
config: serviceMap: config: serviceMap:
serviceMap |> map (entry: inputs.self.lib.mkPostgresDependency config entry.service entry.name); serviceMap |> map (entry: inputs.self.lib.mkPostgresDependency config entry.service entry.name);
sshKeys = {
deacero = ../../secrets/ssh/ed25519_deacero.pub;
workstation = ../../secrets/ssh/ed25519_workstation.pub;
server = ../../secrets/ssh/ed25519_server.pub;
miniserver = ../../secrets/ssh/ed25519_miniserver.pub;
galaxy = ../../secrets/ssh/ed25519_galaxy.pub;
phone = ../../secrets/ssh/ed25519_phone.pub;
vps = ../../secrets/ssh/ed25519_vps.pub;
emacs = ../../secrets/ssh/ed25519_emacs.pub;
# Build user keys (nixremote)
nixworkstation = ../../secrets/ssh/ed25519_nixworkstation.pub;
nixserver = ../../secrets/ssh/ed25519_nixserver.pub;
nixminiserver = ../../secrets/ssh/ed25519_nixminiserver.pub;
};
getSshKeys = keyNames: keyNames |> map (name: inputs.self.lib.sshKeys.${name});
}; };
}; };
} }