From ae278d745dd8eca94374b27c1fa9a977e54c23c2 Mon Sep 17 00:00:00 2001 From: Gregor Kleen Date: Sat, 12 Mar 2022 18:40:38 +0100 Subject: vidhar: netboot installer --- system-profiles/networkmanager.nix | 26 +++++++++++++++++++ system-profiles/openssh/default.nix | 50 +++++++++++++++++++++++-------------- system-profiles/zfs.nix | 4 +-- 3 files changed, 59 insertions(+), 21 deletions(-) create mode 100644 system-profiles/networkmanager.nix (limited to 'system-profiles') diff --git a/system-profiles/networkmanager.nix b/system-profiles/networkmanager.nix new file mode 100644 index 00000000..d1eb9cd1 --- /dev/null +++ b/system-profiles/networkmanager.nix @@ -0,0 +1,26 @@ +{ lib, ... }: + +with lib; + +{ + config = { + networking = { + networkmanager = { + enable = true; + dhcp = "internal"; + dns = mkForce "dnsmasq"; + extraConfig = '' + [connectivity] + uri=https://online.yggdrasil.li + ''; + }; + + dhcpcd.enable = false; + }; + + systemd.services."NetworkManager-wait-online".enable = false; + systemd.services."systemd-networkd-wait-online".enable = false; + + services.resolved.enable = false; + }; +} diff --git a/system-profiles/openssh/default.nix b/system-profiles/openssh/default.nix index 048a948f..19bc46b7 100644 --- a/system-profiles/openssh/default.nix +++ b/system-profiles/openssh/default.nix @@ -1,22 +1,34 @@ { customUtils, lib, config, hostName, pkgs, ... }: -{ + +with lib; + +let + cfg = config.services.openssh; +in { + options = { + services.openssh.staticHostKeys = mkOption { + type = types.bool; + default = true; + }; + }; + config = { - systemd.user.services."ssh-agent".enable = lib.mkForce false; # ssh-agent should be done via home-manager + systemd.user.services."ssh-agent".enable = mkForce false; # ssh-agent should be done via home-manager - services.openssh = lib.mkIf config.services.openssh.enable { - hostKeys = lib.mkForce []; # done manually + services.openssh = mkIf cfg.enable { + hostKeys = mkIf cfg.staticHostKeys (mkForce []); # done manually ciphers = [ "chacha20-poly1305@openssh.com" "aes256-gcm@openssh.com" "aes256-ctr" ]; macs = [ "hmac-sha2-256-etm@openssh.com" "hmac-sha2-256" "hmac-sha2-512-etm@openssh.com" "hmac-sha2-512" ]; kexAlgorithms = [ "curve25519-sha256@libssh.org" "diffie-hellman-group-exchange-sha256" ]; - moduliFile = config.sops.secrets.ssh_moduli.path; + moduliFile = mkIf (config.sops.secrets ? "ssh_moduli") config.sops.secrets.ssh_moduli.path; extraConfig = '' HostKeyAlgorithms sk-ssh-ed25519-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-256,rsa-sha2-512 CASignatureAlgorithms sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-256,rsa-sha2-512 - HostKey /etc/ssh/ssh_host_ed25519_key - HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub - HostKey /etc/ssh/ssh_host_rsa_key - HostCertificate /etc/ssh/ssh_host_rsa_key-cert.pub + ${optionalString cfg.staticHostKeys "HostKey /etc/ssh/ssh_host_ed25519_key"} + ${optionalString (config.environment.etc ? "ssh/ssh_host_ed25519_key-cert.pub") "HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub"} + ${optionalString cfg.staticHostKeys "HostKey /etc/ssh/ssh_host_rsa_key"} + ${optionalString (config.environment.etc ? "ssh/ssh_host_rsa_key-cert.pub") "HostCertificate /etc/ssh/ssh_host_rsa_key-cert.pub"} RevokedKeys /etc/ssh/krl.bin ''; logLevel = "VERBOSE"; @@ -45,35 +57,35 @@ ''; }; - sops.secrets = lib.mkIf config.services.openssh.enable { - ssh_host_rsa_key = { + sops.secrets = mkIf cfg.enable { + ssh_host_rsa_key = mkIf cfg.staticHostKeys { key = "rsa"; path = "/etc/ssh/ssh_host_rsa_key"; sopsFile = ./host-keys + "/${hostName}.yaml"; }; - ssh_host_ed25519_key = { + ssh_host_ed25519_key = mkIf cfg.staticHostKeys { key = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; sopsFile = ./host-keys + "/${hostName}.yaml"; }; - ssh_moduli = { + ssh_moduli = mkIf (pathExists (./host-moduli + "/${hostName}")) { format = "binary"; path = "/etc/ssh/moduli"; sopsFile = ./host-moduli + "/${hostName}"; }; }; - environment.etc = lib.mkIf config.services.openssh.enable { - "ssh/ssh_host_rsa_key.pub".source = ./known-hosts + "/${hostName}/rsa.pub"; - "ssh/ssh_host_ed25519_key.pub".source = ./known-hosts + "/${hostName}/ed25519.pub"; + environment.etc = mkIf cfg.enable { + "ssh/ssh_host_rsa_key.pub" = mkIf cfg.staticHostKeys { source = ./known-hosts + "/${hostName}/rsa.pub"; }; + "ssh/ssh_host_ed25519_key.pub" = mkIf cfg.staticHostKeys { source = ./known-hosts + "/${hostName}/ed25519.pub"; }; - "ssh/ssh_host_rsa_key-cert.pub".source = ./known-hosts + "/${hostName}/rsa-cert.pub"; - "ssh/ssh_host_ed25519_key-cert.pub".source = ./known-hosts + "/${hostName}/ed25519-cert.pub"; + "ssh/ssh_host_rsa_key-cert.pub" = mkIf cfg.staticHostKeys { source = ./known-hosts + "/${hostName}/rsa-cert.pub"; }; + "ssh/ssh_host_ed25519_key-cert.pub" = mkIf cfg.staticHostKeys { source = ./known-hosts + "/${hostName}/ed25519-cert.pub"; }; "ssh/krl.bin".source = ./ca/krl.bin; }; - environment.systemPackages = lib.mkIf config.services.openssh.enable (with pkgs; [ + environment.systemPackages = mkIf cfg.enable (with pkgs; [ rxvt_unicode.terminfo alacritty.terminfo ]); }; diff --git a/system-profiles/zfs.nix b/system-profiles/zfs.nix index 5703f7ed..85e5ad03 100644 --- a/system-profiles/zfs.nix +++ b/system-profiles/zfs.nix @@ -1,6 +1,6 @@ -{ pkgs, ... } : { +{ config, pkgs, ... } : { config.boot = { - kernelPackages = pkgs.linuxPackages_5_15; + kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages; supportedFilesystems = [ "zfs" ]; zfs.enableUnstable = true; }; -- cgit v1.2.3