public
/
paris-container
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Pass in SSH keys

This commit is contained in:
niten 2024-06-02 16:56:56 -07:00
parent e9e7d25ba8
commit 8f1bc956d1
1 changed files with 18 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
paris-container.nix
View File

@ -10,6 +10,10 @@ let
hostSecrets = config.fudo.secrets.host-secrets."${hostname}"; hostSecrets = config.fudo.secrets.host-secrets."${hostname}";
hostKeypairs = config.fudo.secrets.files.ssh.host-keypairs.paris;
keytabFilename = keypair: "host-paris-${keypair.key-type}-private-key";
in { in {
options.fudo.paris-container = with types; { options.fudo.paris-container = with types; {
enable = mkEnableOption "Enable Fudo Paris user server."; enable = mkEnableOption "Enable Fudo Paris user server.";
@ -151,7 +155,11 @@ in {
"LDAP_DEFAULT_AUTHTOKEN=${readFile cfg.ldap.bind-token-file}"; "LDAP_DEFAULT_AUTHTOKEN=${readFile cfg.ldap.bind-token-file}";
target-file = "/run/paris/sssd.env"; target-file = "/run/paris/sssd.env";
}; };
}; } // (listToAttrs (map (keypair:
nameValuePair (keypairFilename keypair) {
source-file = keypair.private-key;
target-file = "/run/paris/openssh/${keypairFilename keypair}";
}) parisKeypairs));
virtualisation.oci-containers.containers.paris-ldap-proxy = { virtualisation.oci-containers.containers.paris-ldap-proxy = {
image = cfg.ldap.image; image = cfg.ldap.image;
@ -167,7 +175,11 @@ in {
hostPath = "${cfg.state-directory}/home"; hostPath = "${cfg.state-directory}/home";
isReadOnly = false; isReadOnly = false;
}; };
}; } // (listToAttrs (map (keypair:
nameValuePair "/run/openssh/keys/${keypairFilename keypair}" {
hostPath = "/run/paris/openssh/${keypairFilename keypair}";
isReadOnly = true;
}) parisKeypairs));
additionalCapabilities = [ "CAP_NET_ADMIN" ]; additionalCapabilities = [ "CAP_NET_ADMIN" ];
config = { config = {
nixpkgs.pkgs = pkgs; nixpkgs.pkgs = pkgs;
@ -178,7 +190,10 @@ in {
opensssh = { opensssh = {
enable = true; enable = true;
startWhenNeeded = true; startWhenNeeded = true;
hostKeys = FIXME; hostKeys = map (keypair: {
path = "/run/openssh/keys/${keypairFilename keypair}";
type = keypair.key-type;
}) parisKeypairs;
settings = { settings = {
UseDns = true; UseDns = true;
PermitRootLogin = "no"; PermitRootLogin = "no";