ymir: openssh ca

1 files changed, 11 insertions, 0 deletions

diff --git a/ymir.nix b/ymir.nix
index df306121..8f01ad6b 100644
--- a/ymir.nix
+++ b/ymir.nix
@@ -212,9 +212,20 @@ in rec {
     challengeResponseAuthentication = false;
     extraConfig = ''
       AllowGroups ssh
+
+      HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub
+      HostCertificate /etc/ssh/ssh_host_rsa_key-cert.pub
+      RevokedKeys /etc/ssh/krl.bin
     '';
     knownHosts = import ./knownHosts.nix;
+    hostKeys = [
+      { bits = 4096; path = "/etc/ssh/ssh_host_rsa_key"; type = "rsa"; }
+      { path = "/etc/ssh/ssh_host_ed25519_key"; type = "ed25519"; }
+    ];
   };
+  environment.etc."ssh/ssh_host_rsa_key-cert.pub".source = ./ymir/rsa-cert.pub;
+  environment.etc."ssh/ssh_host_ed25519_key-cert.pub".source = ./ymir/ed25519-cert.pub;
+  environment.etc."ssh/krl.bin".source = ./krl.bin;
   users.groups."ssh" = {
     members = ["gitolite" "uucp" "root"];
   };