felschr/nixos-config
1
1
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

fix(rpi4): fix initrd ssh

Browse source
This commit is contained in:
Felix Schröter 2021-10-23 03:06:06 +02:00
parent 4df25ee687
commit 2a4a0b850a
No known key found for this signature in database
GPG key ID: 910ACB9F6BD26F58
3 changed files with 22 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
flake.nix
View file

@ -165,7 +165,9 @@
(lib.createUser "felschr" { (lib.createUser "felschr" {
user = { user = {
extraGroups = [ "wheel" "audio" "disk" "media" ]; extraGroups = [ "wheel" "audio" "disk" "media" ];
openssh.authorizedKeys.keyFiles = [ ./key ]; openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIINDTp/k2m9yUn8NGDpCzyX2iK9lOwe6lJR5sk19apxC openpgp:0xBBA675EA"
];
}; };
modules = [ homeManagerModules.git ]; modules = [ homeManagerModules.git ];
config = ./home/felschr-rpi4.nix; config = ./home/felschr-rpi4.nix;

1
key
View file

@ -1 +0,0 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIINDTp/k2m9yUn8NGDpCzyX2iK9lOwe6lJR5sk19apxC openpgp:0xBBA675EA

23
rpi4.nix
View file

@ -1,6 +1,14 @@
{ config, pkgs, ... }: { config, lib, pkgs, ... }:
with builtins; { let
# mkdir /etc/secrets/initrd -p
# chmod 700 -R /etc/secrets/
# ssh-keygen -t ed25519 -N "" -f /etc/secrets/initrd/ssh_host_ed25519_key
hostKeys = [{
path = "/etc/secrets/initrd/ssh_host_ed25519_key";
type = "ed25519";
}];
in with builtins; {
imports = [ imports = [
# ./hardware/base.nix # ./hardware/base.nix
./hardware/gpu-rpi4.nix ./hardware/gpu-rpi4.nix
@ -66,12 +74,19 @@ with builtins; {
challengeResponseAuthentication = false; challengeResponseAuthentication = false;
passwordAuthentication = false; passwordAuthentication = false;
permitRootLogin = "no"; permitRootLogin = "no";
inherit hostKeys;
}; };
# ssh root@hostname "echo "$(read -s pass; echo \'"$pass"\')" > /crypt-ramfs/passphrase" # ssh root@hostname "echo "$(read -s pass; echo \'"$pass"\')" > /crypt-ramfs/passphrase"
boot.initrd.network.ssh = { boot.initrd.network = {
enable = true; enable = true;
authorizedKeys = [ (readFile "./key") ]; ssh = {
enable = true;
# requires support for initrd secrets (might work w/ uboot when it's supported)
# hostKeys = map (f: f.path) hostKeys;
hostKeys = [ ./host_key ];
authorizedKeys = config.users.users.felschr.openssh.authorizedKeys.keys;
};
}; };
# only change this when specified in release notes # only change this when specified in release notes