From ce0066436d14efbc8a3592f504efcb409f14333b Mon Sep 17 00:00:00 2001 From: Franck Cuny Date: Mon, 12 Jan 2026 08:20:05 -0800 Subject: simplify ssh key management --- flake.nix | 8 ++++++++ home/modules/userinfo.nix | 10 ++++++++++ profiles/defaults.nix | 19 ++++++------------- profiles/git-server.nix | 9 +++++++-- profiles/remote-unlock.nix | 24 ++++++------------------ profiles/users/admin-user.nix | 15 +-------------- profiles/users/builder.nix | 22 ++++++---------------- 7 files changed, 44 insertions(+), 63 deletions(-) diff --git a/flake.nix b/flake.nix index c2a3b63..870bccb 100644 --- a/flake.nix +++ b/flake.nix @@ -101,6 +101,14 @@ userinfo = { email = "franck@fcuny.net"; fullName = "Franck Cuny"; + sshPublicKeys = { + onepassword = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBkozy+X96u5ciX766bJ/AyQ3xm1tXZTIr5+4Puffs"; + yubikey-personal-nano = "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGX4+CuUjiX6Doi4n6RqmznzFUyRrxKhEFvuIxROzXDKAAAABHNzaDo="; + yubikey-personal-keychain = "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDnU4Xd8bElZYVWDbknlIgskR/q7ORrbvO0FLnJMQX+eAAAABHNzaDo="; + yubikey-personal-backup = "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAINLBHE4O9RrTgTa+m0kcWL2Mhpi3C57MpTpip7riTophAAAABHNzaDo="; + yubikey-work-nano = "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIBVuEgqp/pmfskha3gIaYIfP0JEgKG/vVV3Bswb63wr2AAAABHNzaDo="; + yubikey-work-backup = "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGjs8WvWBuiL6hujqSaXLxBIs5unjBex22Whdrj/radmAAAABHNzaDo="; + }; }; }; diff --git a/home/modules/userinfo.nix b/home/modules/userinfo.nix index 46afc73..bea964e 100644 --- a/home/modules/userinfo.nix +++ b/home/modules/userinfo.nix @@ -10,6 +10,16 @@ type = types.str; example = "some@email.com"; }; + sshPublicKeys = mkOption { + type = types.attrsOf types.str; + default = { }; + example = { + yubikey-keychain = "sk-ssh-ed25519@openssh.com AAAAC3NzaC1lZDI1NTE5..."; + yubikey-backup = "sk-ssh-ed25519@openssh.com AAAAC3NzaC1lZDI1NTE5..."; + yubikey-nano = "sk-ssh-ed25519@openssh.com AAAAC3NzaC1lZDI1NTE5..."; + }; + description = "SSH public keys tagged by their source/location"; + }; }; }; } diff --git a/profiles/defaults.nix b/profiles/defaults.nix index 96b1461..2683c5a 100644 --- a/profiles/defaults.nix +++ b/profiles/defaults.nix @@ -2,6 +2,7 @@ config, pkgs, lib, + adminUser, ... }: { @@ -112,19 +113,11 @@ users = { mutableUsers = false; - users.root.openssh.authorizedKeys.keys = [ - # 1password - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBkozy+X96u5ciX766bJ/AyQ3xm1tXZTIr5+4PVFZFi" - # YubiKey 5C Nano (personal) - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGX4+CuUjiX6Doi4n6RqmznzFUyRrxKhEFvuIxROzXDKAAAABHNzaDo= ssh:" - # Yubikey 5C (keychain) - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDnU4Xd8bElZYVWDbknlIgskR/q7ORrbvO0FLnJMQX+eAAAABHNzaDo= ssh:" - # Yubikey 5C NFC (backup) - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAINLBHE4O9RrTgTa+m0kcWL2Mhpi3C57MpTpip7riTophAAAABHNzaDo= ssh:" - # Yubikey 5C Nano (work) - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIBVuEgqp/pmfskha3gIaYIfP0JEgKG/vVV3Bswb63wr2AAAABHNzaDo=" - # Yubikey Security Key C NFC (work, backup) - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGjs8WvWBuiL6hujqSaXLxBIs5unjBex22Whdrj/radmAAAABHNzaDo=" + users.root.openssh.authorizedKeys.keys = with adminUser.userinfo.sshPublicKeys; [ + onepassword + yubikey-personal-nano + yubikey-personal-keychain + yubikey-personal-backup ]; }; diff --git a/profiles/git-server.nix b/profiles/git-server.nix index 504027a..d162a8e 100644 --- a/profiles/git-server.nix +++ b/profiles/git-server.nix @@ -1,4 +1,9 @@ -{ pkgs, lib, ... }: +{ + pkgs, + lib, + adminUser, + ... +}: let cgit-org2html = pkgs.writeShellScriptBin "org2html" '' ${pkgs.pandoc}/bin/pandoc \ @@ -27,7 +32,7 @@ in { services.gitolite = { enable = true; - adminPubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBkozy+X96u5ciX766bJ/AyQ3xm1tXZTIr5+4PVFZFi"; + adminPubkey = adminUser.userinfo.sshPublicKeys."yubikey-personal-nano"; user = "git"; group = "git"; extraGitoliteRc = '' diff --git a/profiles/remote-unlock.nix b/profiles/remote-unlock.nix index 310d52b..9812ce8 100644 --- a/profiles/remote-unlock.nix +++ b/profiles/remote-unlock.nix @@ -1,4 +1,4 @@ -{ ... }: +{ adminUser, ... }: { boot.kernelParams = [ "ip=dhcp" @@ -14,23 +14,11 @@ hostKeys = [ "/etc/initrd/ssh_host_ed25519_key" ]; - authorizedKeys = [ - # my personal key - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBkozy+X96u5ciX766bJ/AyQ3xm1tXZTIr5+4PVFZFi" - # key used to automatically unlock - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPr9Dv2MjZoRltmxi21PoS/42KnOhYxuq9r6ER62vjAx" - # YubiKey 5C Nano (personal) - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGX4+CuUjiX6Doi4n6RqmznzFUyRrxKhEFvuIxROzXDKAAAABHNzaDo= ssh:" - # Yubikey 5C (keychain) - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDnU4Xd8bElZYVWDbknlIgskR/q7ORrbvO0FLnJMQX+eAAAABHNzaDo= ssh:" - # Yubikey 5C (keychain) - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDnU4Xd8bElZYVWDbknlIgskR/q7ORrbvO0FLnJMQX+eAAAABHNzaDo= ssh:" - # Yubikey 5C NFC (backup) - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAINLBHE4O9RrTgTa+m0kcWL2Mhpi3C57MpTpip7riTophAAAABHNzaDo= ssh:" - # Yubikey 5C Nano (work) - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIBVuEgqp/pmfskha3gIaYIfP0JEgKG/vVV3Bswb63wr2AAAABHNzaDo=" - # Yubikey Security Key C NFC (work, backup) - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGjs8WvWBuiL6hujqSaXLxBIs5unjBex22Whdrj/radmAAAABHNzaDo=" + authorizedKeys = with adminUser.userinfo.sshPublicKeys; [ + onepassword + yubikey-personal-nano + yubikey-personal-keychain + yubikey-personal-backup ]; }; }; diff --git a/profiles/users/admin-user.nix b/profiles/users/admin-user.nix index 6658050..2e33603 100644 --- a/profiles/users/admin-user.nix +++ b/profiles/users/admin-user.nix @@ -11,20 +11,7 @@ shell = pkgs.fish; isNormalUser = true; hashedPassword = "$y$j9T$U3mXpCzXC1VUp8wV5snJz/$32vTk0KwVXvP/jLO13nMlGPHy0nCe4ZtebdvqU4hwmD"; - openssh.authorizedKeys.keys = [ - # 1password - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBkozy+X96u5ciX766bJ/AyQ3xm1tXZTIr5+4PVFZFi" - # YubiKey 5C Nano (personal) - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGX4+CuUjiX6Doi4n6RqmznzFUyRrxKhEFvuIxROzXDKAAAABHNzaDo=" - # Yubikey 5C (keychain) - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDnU4Xd8bElZYVWDbknlIgskR/q7ORrbvO0FLnJMQX+eAAAABHNzaDo=" - # Yubikey 5C NFC (backup) - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAINLBHE4O9RrTgTa+m0kcWL2Mhpi3C57MpTpip7riTophAAAABHNzaDo=" - # Yubikey 5C Nano (work) - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIBVuEgqp/pmfskha3gIaYIfP0JEgKG/vVV3Bswb63wr2AAAABHNzaDo=" - # Yubikey Security Key C NFC (work, backup) - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGjs8WvWBuiL6hujqSaXLxBIs5unjBex22Whdrj/radmAAAABHNzaDo=" - ]; + openssh.authorizedKeys.keys = pkgs.lib.attrValues adminUser.userinfo.sshPublicKeys; extraGroups = [ "wheel" "docker" diff --git a/profiles/users/builder.nix b/profiles/users/builder.nix index 2998c19..0b91efe 100644 --- a/profiles/users/builder.nix +++ b/profiles/users/builder.nix @@ -1,23 +1,13 @@ -{ ... }: +{ adminUser, ... }: { nix.settings.trusted-users = [ "builder" ]; users.users.builder = { - openssh.authorizedKeys.keys = [ - # 1password - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBkozy+X96u5ciX766bJ/AyQ3xm1tXZTIr5+4PVFZFi" - # remote builder ssh key - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGFGxdplt9WwGjdhoYkmPe2opZMJShtpqnGCI+swrgvw" - # YubiKey 5C Nano (personal) - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGX4+CuUjiX6Doi4n6RqmznzFUyRrxKhEFvuIxROzXDKAAAABHNzaDo= ssh:" - # Yubikey 5C (keychain) - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDnU4Xd8bElZYVWDbknlIgskR/q7ORrbvO0FLnJMQX+eAAAABHNzaDo= ssh:" - # Yubikey 5C NFC (backup) - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAINLBHE4O9RrTgTa+m0kcWL2Mhpi3C57MpTpip7riTophAAAABHNzaDo= ssh:" - # Yubikey 5C Nano (work) - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIBVuEgqp/pmfskha3gIaYIfP0JEgKG/vVV3Bswb63wr2AAAABHNzaDo=" - # Yubikey Security Key C NFC (work, backup) - "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGjs8WvWBuiL6hujqSaXLxBIs5unjBex22Whdrj/radmAAAABHNzaDo=" + openssh.authorizedKeys.keys = with adminUser.userinfo.sshPublicKeys; [ + onepassword + yubikey-personal-nano + yubikey-personal-keychain + yubikey-personal-backup ]; isNormalUser = true; group = "nogroup"; -- cgit v1.2.3