aboutsummaryrefslogtreecommitdiff
path: root/profiles
diff options
context:
space:
mode:
Diffstat (limited to 'profiles')
-rw-r--r--profiles/defaults.nix19
-rw-r--r--profiles/git-server.nix9
-rw-r--r--profiles/remote-unlock.nix24
-rw-r--r--profiles/users/admin-user.nix15
-rw-r--r--profiles/users/builder.nix22
5 files changed, 26 insertions, 63 deletions
diff --git a/profiles/defaults.nix b/profiles/defaults.nix
index 96b1461..2683c5a 100644
--- a/profiles/defaults.nix
+++ b/profiles/defaults.nix
@@ -2,6 +2,7 @@
config,
pkgs,
lib,
+ adminUser,
...
}:
{
@@ -112,19 +113,11 @@
users = {
mutableUsers = false;
- users.root.openssh.authorizedKeys.keys = [
- # 1password
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBkozy+X96u5ciX766bJ/AyQ3xm1tXZTIr5+4PVFZFi"
- # YubiKey 5C Nano (personal)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGX4+CuUjiX6Doi4n6RqmznzFUyRrxKhEFvuIxROzXDKAAAABHNzaDo= ssh:"
- # Yubikey 5C (keychain)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDnU4Xd8bElZYVWDbknlIgskR/q7ORrbvO0FLnJMQX+eAAAABHNzaDo= ssh:"
- # Yubikey 5C NFC (backup)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAINLBHE4O9RrTgTa+m0kcWL2Mhpi3C57MpTpip7riTophAAAABHNzaDo= ssh:"
- # Yubikey 5C Nano (work)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIBVuEgqp/pmfskha3gIaYIfP0JEgKG/vVV3Bswb63wr2AAAABHNzaDo="
- # Yubikey Security Key C NFC (work, backup)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGjs8WvWBuiL6hujqSaXLxBIs5unjBex22Whdrj/radmAAAABHNzaDo="
+ users.root.openssh.authorizedKeys.keys = with adminUser.userinfo.sshPublicKeys; [
+ onepassword
+ yubikey-personal-nano
+ yubikey-personal-keychain
+ yubikey-personal-backup
];
};
diff --git a/profiles/git-server.nix b/profiles/git-server.nix
index 504027a..d162a8e 100644
--- a/profiles/git-server.nix
+++ b/profiles/git-server.nix
@@ -1,4 +1,9 @@
-{ pkgs, lib, ... }:
+{
+ pkgs,
+ lib,
+ adminUser,
+ ...
+}:
let
cgit-org2html = pkgs.writeShellScriptBin "org2html" ''
${pkgs.pandoc}/bin/pandoc \
@@ -27,7 +32,7 @@ in
{
services.gitolite = {
enable = true;
- adminPubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBkozy+X96u5ciX766bJ/AyQ3xm1tXZTIr5+4PVFZFi";
+ adminPubkey = adminUser.userinfo.sshPublicKeys."yubikey-personal-nano";
user = "git";
group = "git";
extraGitoliteRc = ''
diff --git a/profiles/remote-unlock.nix b/profiles/remote-unlock.nix
index 310d52b..9812ce8 100644
--- a/profiles/remote-unlock.nix
+++ b/profiles/remote-unlock.nix
@@ -1,4 +1,4 @@
-{ ... }:
+{ adminUser, ... }:
{
boot.kernelParams = [
"ip=dhcp"
@@ -14,23 +14,11 @@
hostKeys = [
"/etc/initrd/ssh_host_ed25519_key"
];
- authorizedKeys = [
- # my personal key
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBkozy+X96u5ciX766bJ/AyQ3xm1tXZTIr5+4PVFZFi"
- # key used to automatically unlock
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPr9Dv2MjZoRltmxi21PoS/42KnOhYxuq9r6ER62vjAx"
- # YubiKey 5C Nano (personal)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGX4+CuUjiX6Doi4n6RqmznzFUyRrxKhEFvuIxROzXDKAAAABHNzaDo= ssh:"
- # Yubikey 5C (keychain)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDnU4Xd8bElZYVWDbknlIgskR/q7ORrbvO0FLnJMQX+eAAAABHNzaDo= ssh:"
- # Yubikey 5C (keychain)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDnU4Xd8bElZYVWDbknlIgskR/q7ORrbvO0FLnJMQX+eAAAABHNzaDo= ssh:"
- # Yubikey 5C NFC (backup)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAINLBHE4O9RrTgTa+m0kcWL2Mhpi3C57MpTpip7riTophAAAABHNzaDo= ssh:"
- # Yubikey 5C Nano (work)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIBVuEgqp/pmfskha3gIaYIfP0JEgKG/vVV3Bswb63wr2AAAABHNzaDo="
- # Yubikey Security Key C NFC (work, backup)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGjs8WvWBuiL6hujqSaXLxBIs5unjBex22Whdrj/radmAAAABHNzaDo="
+ authorizedKeys = with adminUser.userinfo.sshPublicKeys; [
+ onepassword
+ yubikey-personal-nano
+ yubikey-personal-keychain
+ yubikey-personal-backup
];
};
};
diff --git a/profiles/users/admin-user.nix b/profiles/users/admin-user.nix
index 6658050..2e33603 100644
--- a/profiles/users/admin-user.nix
+++ b/profiles/users/admin-user.nix
@@ -11,20 +11,7 @@
shell = pkgs.fish;
isNormalUser = true;
hashedPassword = "$y$j9T$U3mXpCzXC1VUp8wV5snJz/$32vTk0KwVXvP/jLO13nMlGPHy0nCe4ZtebdvqU4hwmD";
- openssh.authorizedKeys.keys = [
- # 1password
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBkozy+X96u5ciX766bJ/AyQ3xm1tXZTIr5+4PVFZFi"
- # YubiKey 5C Nano (personal)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGX4+CuUjiX6Doi4n6RqmznzFUyRrxKhEFvuIxROzXDKAAAABHNzaDo="
- # Yubikey 5C (keychain)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDnU4Xd8bElZYVWDbknlIgskR/q7ORrbvO0FLnJMQX+eAAAABHNzaDo="
- # Yubikey 5C NFC (backup)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAINLBHE4O9RrTgTa+m0kcWL2Mhpi3C57MpTpip7riTophAAAABHNzaDo="
- # Yubikey 5C Nano (work)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIBVuEgqp/pmfskha3gIaYIfP0JEgKG/vVV3Bswb63wr2AAAABHNzaDo="
- # Yubikey Security Key C NFC (work, backup)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGjs8WvWBuiL6hujqSaXLxBIs5unjBex22Whdrj/radmAAAABHNzaDo="
- ];
+ openssh.authorizedKeys.keys = pkgs.lib.attrValues adminUser.userinfo.sshPublicKeys;
extraGroups = [
"wheel"
"docker"
diff --git a/profiles/users/builder.nix b/profiles/users/builder.nix
index 2998c19..0b91efe 100644
--- a/profiles/users/builder.nix
+++ b/profiles/users/builder.nix
@@ -1,23 +1,13 @@
-{ ... }:
+{ adminUser, ... }:
{
nix.settings.trusted-users = [ "builder" ];
users.users.builder = {
- openssh.authorizedKeys.keys = [
- # 1password
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBkozy+X96u5ciX766bJ/AyQ3xm1tXZTIr5+4PVFZFi"
- # remote builder ssh key
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGFGxdplt9WwGjdhoYkmPe2opZMJShtpqnGCI+swrgvw"
- # YubiKey 5C Nano (personal)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGX4+CuUjiX6Doi4n6RqmznzFUyRrxKhEFvuIxROzXDKAAAABHNzaDo= ssh:"
- # Yubikey 5C (keychain)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDnU4Xd8bElZYVWDbknlIgskR/q7ORrbvO0FLnJMQX+eAAAABHNzaDo= ssh:"
- # Yubikey 5C NFC (backup)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAINLBHE4O9RrTgTa+m0kcWL2Mhpi3C57MpTpip7riTophAAAABHNzaDo= ssh:"
- # Yubikey 5C Nano (work)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIBVuEgqp/pmfskha3gIaYIfP0JEgKG/vVV3Bswb63wr2AAAABHNzaDo="
- # Yubikey Security Key C NFC (work, backup)
- "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGjs8WvWBuiL6hujqSaXLxBIs5unjBex22Whdrj/radmAAAABHNzaDo="
+ openssh.authorizedKeys.keys = with adminUser.userinfo.sshPublicKeys; [
+ onepassword
+ yubikey-personal-nano
+ yubikey-personal-keychain
+ yubikey-personal-backup
];
isNormalUser = true;
group = "nogroup";
generated by cgit v1.2.3 (git 2.25.1) at 2026-01-20 12:53:50 +0000