c3d2/nix-config
c3d2
/
nix-config
24
7
Fork 3
Code Issues 12 Pull Requests 2 Releases Wiki Activity

baremetal: generate initrd host keys if they don't exist and are required

This commit is contained in:
Sandro - 2023-05-20 22:12:16 +02:00
parent 124e74c48a
commit 45d251666e
Signed by: sandro
GPG Key ID: 3AF5A43A3EECC2E5
1 changed files with 17 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
modules/baremetal.nix
View File

@ -3,15 +3,19 @@
{
options.c3d2.baremetal = lib.mkEnableOption "baremetal";
config = lib.mkIf config.c3d2.baremetal {
config = let
initrdEd2219Key = "/etc/ssh/initrd/ssh_host_ed25519_key";
initrdRsaKey = "/etc/ssh/initrd/ssh_host_rsa_key";
in lib.mkIf config.c3d2.baremetal {
boot.initrd.network = {
enable = true;
ssh = {
enable = true;
# TODO: enable now per machine
# enable = true;
authorizedKeys = config.users.users.root.openssh.authorizedKeys.keys;
hostKeys = [
"/etc/ssh/initrd/ssh_host_ed25519_key"
"/etc/ssh/initrd/ssh_host_rsa_key"
initrdEd2219Key
initrdRsaKey
];
port = 4748;
};
@ -37,5 +41,14 @@
fstrim.enable = true;
smartd.enable = true;
};
system.activationScripts.generateInitrdOpensshHostKeys = lib.mkIf config.boot.initrd.network.ssh.enable ''
if [[ ! -e ${initrdEd2219Key} || ! -e ${initrdRsaKey} ]]; then
echo "Generating initrd OpenSSH hostkeys..."
mkdir -m700 -p /etc/ssh/initrd/
${pkgs.openssh}/bin/ssh-keygen -t ed25519 -N "" -f ${initrdEd2219Key}
${pkgs.openssh}/bin/ssh-keygen -t rsa -N "" -f ${initrdRsaKey}
fi
'';
};
}