1 files changed, 31 insertions, 19 deletions

diff --git a/system-profiles/openssh/default.nix b/system-profiles/openssh/default.nix
index 048a948f..19bc46b7 100644
--- a/system-profiles/openssh/default.nix
+++ b/system-profiles/openssh/default.nix
@@ -1,22 +1,34 @@
 { customUtils, lib, config, hostName, pkgs, ... }:
-{
+
+with lib;
+
+let
+  cfg = config.services.openssh;
+in {
+  options = {
+    services.openssh.staticHostKeys = mkOption {
+      type = types.bool;
+      default = true;
+    };
+  };
+  
   config = {
-    systemd.user.services."ssh-agent".enable = lib.mkForce false; # ssh-agent should be done via home-manager
+    systemd.user.services."ssh-agent".enable = mkForce false; # ssh-agent should be done via home-manager
 
-    services.openssh = lib.mkIf config.services.openssh.enable {
-      hostKeys = lib.mkForce []; # done manually
+    services.openssh = mkIf cfg.enable {
+      hostKeys = mkIf cfg.staticHostKeys (mkForce []); # done manually
       ciphers = [ "chacha20-poly1305@openssh.com" "aes256-gcm@openssh.com" "aes256-ctr" ];
       macs = [ "hmac-sha2-256-etm@openssh.com" "hmac-sha2-256" "hmac-sha2-512-etm@openssh.com" "hmac-sha2-512" ];
       kexAlgorithms = [ "curve25519-sha256@libssh.org" "diffie-hellman-group-exchange-sha256" ];
-      moduliFile = config.sops.secrets.ssh_moduli.path;
+      moduliFile = mkIf (config.sops.secrets ? "ssh_moduli") config.sops.secrets.ssh_moduli.path;
       extraConfig = ''
         HostKeyAlgorithms sk-ssh-ed25519-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-256,rsa-sha2-512
         CASignatureAlgorithms sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-256,rsa-sha2-512
 
-        HostKey /etc/ssh/ssh_host_ed25519_key
-        HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub
-        HostKey /etc/ssh/ssh_host_rsa_key
-        HostCertificate /etc/ssh/ssh_host_rsa_key-cert.pub
+        ${optionalString cfg.staticHostKeys "HostKey /etc/ssh/ssh_host_ed25519_key"}
+        ${optionalString (config.environment.etc ? "ssh/ssh_host_ed25519_key-cert.pub") "HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub"}
+        ${optionalString cfg.staticHostKeys "HostKey /etc/ssh/ssh_host_rsa_key"}
+        ${optionalString (config.environment.etc ? "ssh/ssh_host_rsa_key-cert.pub") "HostCertificate /etc/ssh/ssh_host_rsa_key-cert.pub"}
         RevokedKeys /etc/ssh/krl.bin
       '';
       logLevel = "VERBOSE";
@@ -45,35 +57,35 @@
       '';
     };
 
-    sops.secrets = lib.mkIf config.services.openssh.enable {
-      ssh_host_rsa_key = {
+    sops.secrets = mkIf cfg.enable {
+      ssh_host_rsa_key = mkIf cfg.staticHostKeys {
         key = "rsa";
         path = "/etc/ssh/ssh_host_rsa_key";
         sopsFile = ./host-keys + "/${hostName}.yaml";
       };
-      ssh_host_ed25519_key = {
+      ssh_host_ed25519_key = mkIf cfg.staticHostKeys {
         key = "ed25519";
         path = "/etc/ssh/ssh_host_ed25519_key";
         sopsFile = ./host-keys + "/${hostName}.yaml";
       };
-      ssh_moduli = {
+      ssh_moduli = mkIf (pathExists (./host-moduli + "/${hostName}")) {
         format = "binary";
         path = "/etc/ssh/moduli";
         sopsFile = ./host-moduli + "/${hostName}";
       };
     };
 
-    environment.etc = lib.mkIf config.services.openssh.enable {
-      "ssh/ssh_host_rsa_key.pub".source = ./known-hosts + "/${hostName}/rsa.pub";
-      "ssh/ssh_host_ed25519_key.pub".source = ./known-hosts + "/${hostName}/ed25519.pub";
+    environment.etc = mkIf cfg.enable {
+      "ssh/ssh_host_rsa_key.pub" = mkIf cfg.staticHostKeys { source = ./known-hosts + "/${hostName}/rsa.pub"; };
+      "ssh/ssh_host_ed25519_key.pub" = mkIf cfg.staticHostKeys { source = ./known-hosts + "/${hostName}/ed25519.pub"; };
 
-      "ssh/ssh_host_rsa_key-cert.pub".source = ./known-hosts + "/${hostName}/rsa-cert.pub";
-      "ssh/ssh_host_ed25519_key-cert.pub".source = ./known-hosts + "/${hostName}/ed25519-cert.pub";
+      "ssh/ssh_host_rsa_key-cert.pub" = mkIf cfg.staticHostKeys { source = ./known-hosts + "/${hostName}/rsa-cert.pub"; };
+      "ssh/ssh_host_ed25519_key-cert.pub" = mkIf cfg.staticHostKeys { source = ./known-hosts + "/${hostName}/ed25519-cert.pub"; };
 
       "ssh/krl.bin".source = ./ca/krl.bin;
     };
 
-    environment.systemPackages = lib.mkIf config.services.openssh.enable (with pkgs; [
+    environment.systemPackages = mkIf cfg.enable (with pkgs; [
       rxvt_unicode.terminfo alacritty.terminfo
     ]);
   };