4 files changed, 88 insertions, 40 deletions

diff --git a/system-profiles/rebuild-machines/default.nix b/system-profiles/rebuild-machines/default.nix
index 53bba06b..e2a15aae 100644
--- a/system-profiles/rebuild-machines/default.nix
+++ b/system-profiles/rebuild-machines/default.nix
@@ -1,5 +1,21 @@
-{ pkgs, hostName, ... }:
+{ config, pkgs, hostName, lib, ... }:
+
+with lib;
+
 let
+  cfg = config.system.rebuild-machine;
+
+  sshConfig = pkgs.writeText "config" ''
+    UserKnownHostsFile ${knownHostsFile}
+
+    Host ${cfg.repoHost}
+      User ${cfg.repoUser}
+      IdentityFile ${if isNull cfg.sopsConfig then cfg.repoPrivkey else config.sops.secrets."${cfg.sopsName}".path}
+      IdentitiesOnly yes
+  '';
+
+  knownHostsFile = pkgs.writeText "known_hosts" (concatMapStringsSep "\n" (kPath: cfg.repoHost + " " + readFile kPath) (attrValues cfg.repoPubkeys));
+  
   rebuildScript = pkgs.stdenv.mkDerivation {
     name = "rebuild-${hostName}";
 
@@ -9,8 +25,11 @@ let
 
     phases = [ "buildPhase" "installPhase" ];
 
-    inherit (pkgs) zsh;
-    inherit hostName;
+    inherit (pkgs) zsh coreutils openssh;
+    inherit (cfg) flake scriptName;
+    nixosRebuild = config.system.build.nixos-rebuild;
+    inherit (config.security) wrapperDir;
+    inherit sshConfig;
 
     buildPhase = ''
       substituteAll $src rebuild-machine.zsh
@@ -18,49 +37,75 @@ let
 
     installPhase = ''
       mkdir -p $out/bin
-      install -m 0755 rebuild-machine.zsh $out/bin/rebuild-${hostName}
+      install -m 0755 rebuild-machine.zsh $out/bin/${cfg.scriptName}
     '';
   };
 in {
-  home-manager.users."root" = {
-    programs.ssh = {
-      enable = true;
-      matchBlocks = {
-        "machines" = {
-          hostname = "git.yggdrasil.li";
-          user = "gitolite";
-          identityFile = "/root/.ssh/machines";
-        };
+  options = {
+    system.rebuild-machine = {
+      scriptName = mkOption {
+        type = types.str;
+        default = "rebuild-${hostName}";
+        description = ''
+          Name of the script wrapping <literal>nixos-rebuild</literal>
+        '';
+      };
+      
+      flake = mkOption {
+        type = types.nullOr types.str;
+        default = "git+ssh://${cfg.repoHost}/nixos?ref=flakes#${hostName}";
+        description = ''
+          The Flake URI of the NixOS configuration to build.
+        '';
       };
-    };
-  };
 
-  sops.secrets = {
-    rebuild-machines = {
-      path = "/root/.ssh/machines";
-      sopsFile = ./ssh + "/${hostName}/private";
-      format = "binary";
-    };
-  };
+      repoHost = mkOption {
+        type = types.str;
+        default = "git.yggdrasil.li";
+      };
+      
+      repoUser = mkOption {
+        type = types.str;
+        default = "gitolite";
+      };
 
-  system.activationScripts.rebuild-machines-publickey = ''
-    install -m 0644 ${./ssh + "/${hostName}/public"} /root/.ssh/machines.pub
-  '';
+      repoPubkeys = mkOption {
+        type = types.attrsOf types.path;
+        default = genAttrs ["rsa" "ed25519"] (kType: ./ssh-pub + "/${cfg.repoHost}-${kType}.pub");
+      };
 
-  environment.systemPackages = [ rebuildScript ];
+      repoPrivkey = mkOption {
+        type = types.path;
+        default = ./ssh + "/${hostName}/private";
+      };
 
-  services.openssh.knownHosts = {
-    rsa = {
-      hostNames = [ "git.yggdrasil.li" ];
-      publicKey = ''
-        ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDNr7oFNneR3sVuAhdbnU83PuG6gTU6rDmiz+qykkRUr5Qdtm0NIr9lI7nhoO/MaALWmkMXsBGjvJ2UxvY959g0wQRHJZnuJDwOMo3YJjfuDGMTtp8ikzd646uMHQB+y/xb4dou6f0INr94eRsZcji7AQgZQnyWVV3DZuSADBfNK0Tx6sT6IdbJXaCwYoexnfSfzDdu3i5zMuReF4zdkFUEfAdcbOM8Cr0Abnn4+iLVrof/QaOEuZDC+Pf5QUhkAArETdavSCUIbV6+1md0jz/T8yalgrTCsYOoEUbSPwM/8vmiYDWSo/tvAf3KnVIPjjK2UFz7Qu0HyK0y1dBEXoYLGZ1ep4x67aE4zy7GlR2GZdAYilHknugZB+/kvYGDEixHFfcUh/uvF5PY8sm63C6HUBT1s/aQHXGHgE4uUru6YvbU3UW3fRdslABY/atZ9gc3MuKu9Zk27b1SYfAAoK1R8rKsOKWqUWvvMVCfKBNKqqb7+30q75iGeneB8Tb1C9lToyDG2Yl5p+Gpfnj8YmaU/xFm0HFEC42crRbaQyz01LmupHWf8VwH/O2LsjztAF9b4Oe2q/NwqQAF+h5hIm2tfM2fzxHGCmw1sFYf6dEdkyV5pge/IJrnuQn27iO06tRC6tvrt/ocbpwEEOk/3WWpAWW4oT8L5ceh7iAXrCRWpw==
-      '';
+      sopsName = mkOption {
+        type = types.nullOr types.str;
+        default = "rebuild-machines";
+      };
+
+      sopsConfig = mkOption {
+        type = types.nullOr types.attrs;
+        default = {
+          format = "binary";
+        };
+      };
     };
-    ed25519 = {
-      hostNames = [ "git.yggdrasil.li" ];
-      publicKey = ''
-        ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDeBBux2bIXnS/RUv+Y/NCpzI/SCW0KOJSzf48KDiEZD
-      '';
+  };
+  
+  config = {
+    assertions = [
+      { assertion = isNull cfg.sopsConfig || (!(isNull cfg.sopsName));
+        message = "If option sopsConfig is not null option sopsName may not be null";
+      }
+    ];
+    
+    sops.secrets = lib.mkIf (!(isNull cfg.sopsConfig)) {
+      "${cfg.sopsName}" = {
+        sopsFile = cfg.repoPrivkey;
+      } // cfg.sopsConfig;
     };
+
+    environment.systemPackages = [ rebuildScript ];
   };
 }
diff --git a/system-profiles/rebuild-machines/rebuild-machine.zsh b/system-profiles/rebuild-machines/rebuild-machine.zsh
index 59df8999..e9e1655f 100644
--- a/system-profiles/rebuild-machines/rebuild-machine.zsh
+++ b/system-profiles/rebuild-machines/rebuild-machine.zsh
@@ -1,7 +1,8 @@
 #!@zsh@/bin/zsh -e
 
-if [[ $(whoami) != "root" ]]; then
-    exec sudo -H -- $0 $@
+if [[ $(@coreutils@/bin/whoami) != "root" ]]; then
+    exec @wrapperDir@/sudo -H -- @out@/bin/@scriptName@ $@
 fi
 
-exec -- nixos-rebuild --refresh --flake 'git+ssh://machines/nixos?ref=flakes#@hostName@' ${@:-switch}
+export NIX_SSHOPTS="-F @sshConfig@" GIT_SSH_COMMAND="@openssh@/bin/ssh -F @sshConfig@"
+exec -- @nixosRebuild@/bin/nixos-rebuild --refresh --flake '@flake@' ${@:-switch}
diff --git a/system-profiles/rebuild-machines/ssh-pub/git.yggdrasil.li-ed25519.pub b/system-profiles/rebuild-machines/ssh-pub/git.yggdrasil.li-ed25519.pub
new file mode 100644
index 00000000..aaf4b012
--- /dev/null
+++ b/system-profiles/rebuild-machines/ssh-pub/git.yggdrasil.li-ed25519.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDeBBux2bIXnS/RUv+Y/NCpzI/SCW0KOJSzf48KDiEZD
diff --git a/system-profiles/rebuild-machines/ssh-pub/git.yggdrasil.li-rsa.pub b/system-profiles/rebuild-machines/ssh-pub/git.yggdrasil.li-rsa.pub
new file mode 100644
index 00000000..7748d3a1
--- /dev/null
+++ b/system-profiles/rebuild-machines/ssh-pub/git.yggdrasil.li-rsa.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDNr7oFNneR3sVuAhdbnU83PuG6gTU6rDmiz+qykkRUr5Qdtm0NIr9lI7nhoO/MaALWmkMXsBGjvJ2UxvY959g0wQRHJZnuJDwOMo3YJjfuDGMTtp8ikzd646uMHQB+y/xb4dou6f0INr94eRsZcji7AQgZQnyWVV3DZuSADBfNK0Tx6sT6IdbJXaCwYoexnfSfzDdu3i5zMuReF4zdkFUEfAdcbOM8Cr0Abnn4+iLVrof/QaOEuZDC+Pf5QUhkAArETdavSCUIbV6+1md0jz/T8yalgrTCsYOoEUbSPwM/8vmiYDWSo/tvAf3KnVIPjjK2UFz7Qu0HyK0y1dBEXoYLGZ1ep4x67aE4zy7GlR2GZdAYilHknugZB+/kvYGDEixHFfcUh/uvF5PY8sm63C6HUBT1s/aQHXGHgE4uUru6YvbU3UW3fRdslABY/atZ9gc3MuKu9Zk27b1SYfAAoK1R8rKsOKWqUWvvMVCfKBNKqqb7+30q75iGeneB8Tb1C9lToyDG2Yl5p+Gpfnj8YmaU/xFm0HFEC42crRbaQyz01LmupHWf8VwH/O2LsjztAF9b4Oe2q/NwqQAF+h5hIm2tfM2fzxHGCmw1sFYf6dEdkyV5pge/IJrnuQn27iO06tRC6tvrt/ocbpwEEOk/3WWpAWW4oT8L5ceh7iAXrCRWpw==