aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--flake.nix8
-rw-r--r--home/modules/userinfo.nix10
-rw-r--r--profiles/defaults.nix19
-rw-r--r--profiles/git-server.nix9
-rw-r--r--profiles/remote-unlock.nix24
-rw-r--r--profiles/users/admin-user.nix15
-rw-r--r--profiles/users/builder.nix22
7 files changed, 44 insertions, 63 deletions
diff --git a/flake.nix b/flake.nix
index c2a3b63..870bccb 100644
--- a/flake.nix
+++ b/flake.nix
@@ -101,6 +101,14 @@
userinfo = {
email = "franck@fcuny.net";
fullName = "Franck Cuny";
+ sshPublicKeys = {
+ onepassword = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBkozy+X96u5ciX766bJ/AyQ3xm1tXZTIr5+4Puffs";
+ yubikey-personal-nano = "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGX4+CuUjiX6Doi4n6RqmznzFUyRrxKhEFvuIxROzXDKAAAABHNzaDo=";
+ yubikey-personal-keychain = "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDnU4Xd8bElZYVWDbknlIgskR/q7ORrbvO0FLnJMQX+eAAAABHNzaDo=";
+ yubikey-personal-backup = "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAINLBHE4O9RrTgTa+m0kcWL2Mhpi3C57MpTpip7riTophAAAABHNzaDo=";
+ yubikey-work-nano = "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIBVuEgqp/pmfskha3gIaYIfP0JEgKG/vVV3Bswb63wr2AAAABHNzaDo=";
+ yubikey-work-backup = "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGjs8WvWBuiL6hujqSaXLxBIs5unjBex22Whdrj/radmAAAABHNzaDo=";
+ };
};
};
diff --git a/home/modules/userinfo.nix b/home/modules/userinfo.nix
index 46afc73..bea964e 100644
--- a/home/modules/userinfo.nix
+++ b/home/modules/userinfo.nix
@@ -10,6 +10,16 @@
type = types.str;
example = "some@email.com";
};
+ sshPublicKeys = mkOption {
+ type = types.attrsOf types.str;
+ default = { };
+ example = {
+ yubikey-keychain = "sk-ssh-ed25519@openssh.com AAAAC3NzaC1lZDI1NTE5...";
+ yubikey-backup = "sk-ssh-ed25519@openssh.com AAAAC3NzaC1lZDI1NTE5...";
+ yubikey-nano = "sk-ssh-ed25519@openssh.com AAAAC3NzaC1lZDI1NTE5...";
+ };
+ description = "SSH public keys tagged by their source/location";
+ };
};
};
}
diff --git a/profiles/defaults.nix b/profiles/defaults.nix
index 96b1461..2683c5a 100644
--- a/profiles/defaults.nix
+++ b/profiles/defaults.nix
@@ -2,6 +2,7 @@
config,
pkgs,
lib,
+ adminUser,
...
}:
{
@@ -112,19 +113,11 @@
users = {
mutableUsers = false;
- users.root.openssh.authorizedKeys.keys = [
- # 1password
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBkozy+X96u5ciX766bJ/AyQ3xm1tXZTIr5+4PVFZFi"
- # YubiKey 5C Nano (personal)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGX4+CuUjiX6Doi4n6RqmznzFUyRrxKhEFvuIxROzXDKAAAABHNzaDo= ssh:"
- # Yubikey 5C (keychain)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDnU4Xd8bElZYVWDbknlIgskR/q7ORrbvO0FLnJMQX+eAAAABHNzaDo= ssh:"
- # Yubikey 5C NFC (backup)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAINLBHE4O9RrTgTa+m0kcWL2Mhpi3C57MpTpip7riTophAAAABHNzaDo= ssh:"
- # Yubikey 5C Nano (work)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIBVuEgqp/pmfskha3gIaYIfP0JEgKG/vVV3Bswb63wr2AAAABHNzaDo="
- # Yubikey Security Key C NFC (work, backup)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGjs8WvWBuiL6hujqSaXLxBIs5unjBex22Whdrj/radmAAAABHNzaDo="
+ users.root.openssh.authorizedKeys.keys = with adminUser.userinfo.sshPublicKeys; [
+ onepassword
+ yubikey-personal-nano
+ yubikey-personal-keychain
+ yubikey-personal-backup
];
};
diff --git a/profiles/git-server.nix b/profiles/git-server.nix
index 504027a..d162a8e 100644
--- a/profiles/git-server.nix
+++ b/profiles/git-server.nix
@@ -1,4 +1,9 @@
-{ pkgs, lib, ... }:
+{
+ pkgs,
+ lib,
+ adminUser,
+ ...
+}:
let
cgit-org2html = pkgs.writeShellScriptBin "org2html" ''
${pkgs.pandoc}/bin/pandoc \
@@ -27,7 +32,7 @@ in
{
services.gitolite = {
enable = true;
- adminPubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBkozy+X96u5ciX766bJ/AyQ3xm1tXZTIr5+4PVFZFi";
+ adminPubkey = adminUser.userinfo.sshPublicKeys."yubikey-personal-nano";
user = "git";
group = "git";
extraGitoliteRc = ''
diff --git a/profiles/remote-unlock.nix b/profiles/remote-unlock.nix
index 310d52b..9812ce8 100644
--- a/profiles/remote-unlock.nix
+++ b/profiles/remote-unlock.nix
@@ -1,4 +1,4 @@
-{ ... }:
+{ adminUser, ... }:
{
boot.kernelParams = [
"ip=dhcp"
@@ -14,23 +14,11 @@
hostKeys = [
"/etc/initrd/ssh_host_ed25519_key"
];
- authorizedKeys = [
- # my personal key
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBkozy+X96u5ciX766bJ/AyQ3xm1tXZTIr5+4PVFZFi"
- # key used to automatically unlock
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPr9Dv2MjZoRltmxi21PoS/42KnOhYxuq9r6ER62vjAx"
- # YubiKey 5C Nano (personal)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGX4+CuUjiX6Doi4n6RqmznzFUyRrxKhEFvuIxROzXDKAAAABHNzaDo= ssh:"
- # Yubikey 5C (keychain)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDnU4Xd8bElZYVWDbknlIgskR/q7ORrbvO0FLnJMQX+eAAAABHNzaDo= ssh:"
- # Yubikey 5C (keychain)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDnU4Xd8bElZYVWDbknlIgskR/q7ORrbvO0FLnJMQX+eAAAABHNzaDo= ssh:"
- # Yubikey 5C NFC (backup)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAINLBHE4O9RrTgTa+m0kcWL2Mhpi3C57MpTpip7riTophAAAABHNzaDo= ssh:"
- # Yubikey 5C Nano (work)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIBVuEgqp/pmfskha3gIaYIfP0JEgKG/vVV3Bswb63wr2AAAABHNzaDo="
- # Yubikey Security Key C NFC (work, backup)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGjs8WvWBuiL6hujqSaXLxBIs5unjBex22Whdrj/radmAAAABHNzaDo="
+ authorizedKeys = with adminUser.userinfo.sshPublicKeys; [
+ onepassword
+ yubikey-personal-nano
+ yubikey-personal-keychain
+ yubikey-personal-backup
];
};
};
diff --git a/profiles/users/admin-user.nix b/profiles/users/admin-user.nix
index 6658050..2e33603 100644
--- a/profiles/users/admin-user.nix
+++ b/profiles/users/admin-user.nix
@@ -11,20 +11,7 @@
shell = pkgs.fish;
isNormalUser = true;
hashedPassword = "$y$j9T$U3mXpCzXC1VUp8wV5snJz/$32vTk0KwVXvP/jLO13nMlGPHy0nCe4ZtebdvqU4hwmD";
- openssh.authorizedKeys.keys = [
- # 1password
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBkozy+X96u5ciX766bJ/AyQ3xm1tXZTIr5+4PVFZFi"
- # YubiKey 5C Nano (personal)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGX4+CuUjiX6Doi4n6RqmznzFUyRrxKhEFvuIxROzXDKAAAABHNzaDo="
- # Yubikey 5C (keychain)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDnU4Xd8bElZYVWDbknlIgskR/q7ORrbvO0FLnJMQX+eAAAABHNzaDo="
- # Yubikey 5C NFC (backup)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAINLBHE4O9RrTgTa+m0kcWL2Mhpi3C57MpTpip7riTophAAAABHNzaDo="
- # Yubikey 5C Nano (work)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIBVuEgqp/pmfskha3gIaYIfP0JEgKG/vVV3Bswb63wr2AAAABHNzaDo="
- # Yubikey Security Key C NFC (work, backup)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGjs8WvWBuiL6hujqSaXLxBIs5unjBex22Whdrj/radmAAAABHNzaDo="
- ];
+ openssh.authorizedKeys.keys = pkgs.lib.attrValues adminUser.userinfo.sshPublicKeys;
extraGroups = [
"wheel"
"docker"
diff --git a/profiles/users/builder.nix b/profiles/users/builder.nix
index 2998c19..0b91efe 100644
--- a/profiles/users/builder.nix
+++ b/profiles/users/builder.nix
@@ -1,23 +1,13 @@
-{ ... }:
+{ adminUser, ... }:
{
nix.settings.trusted-users = [ "builder" ];
users.users.builder = {
- openssh.authorizedKeys.keys = [
- # 1password
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBkozy+X96u5ciX766bJ/AyQ3xm1tXZTIr5+4PVFZFi"
- # remote builder ssh key
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGFGxdplt9WwGjdhoYkmPe2opZMJShtpqnGCI+swrgvw"
- # YubiKey 5C Nano (personal)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGX4+CuUjiX6Doi4n6RqmznzFUyRrxKhEFvuIxROzXDKAAAABHNzaDo= ssh:"
- # Yubikey 5C (keychain)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDnU4Xd8bElZYVWDbknlIgskR/q7ORrbvO0FLnJMQX+eAAAABHNzaDo= ssh:"
- # Yubikey 5C NFC (backup)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAINLBHE4O9RrTgTa+m0kcWL2Mhpi3C57MpTpip7riTophAAAABHNzaDo= ssh:"
- # Yubikey 5C Nano (work)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIBVuEgqp/pmfskha3gIaYIfP0JEgKG/vVV3Bswb63wr2AAAABHNzaDo="
- # Yubikey Security Key C NFC (work, backup)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGjs8WvWBuiL6hujqSaXLxBIs5unjBex22Whdrj/radmAAAABHNzaDo="
+ openssh.authorizedKeys.keys = with adminUser.userinfo.sshPublicKeys; [
+ onepassword
+ yubikey-personal-nano
+ yubikey-personal-keychain
+ yubikey-personal-backup
];
isNormalUser = true;
group = "nogroup";
generated by cgit v1.2.3 (git 2.25.1) at 2026-01-20 11:56:39 +0000