From dd60e07a144c7693541e5d32943bd3b48c59c763 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Motiejus=20Jak=C5=A1tys?= Date: Sun, 23 Jul 2023 15:23:09 +0300 Subject: [PATCH] wip more intitrd unlockers --- data.nix | 2 +- hosts/hel1-a/configuration.nix | 2 +- hosts/vno1-oh2/configuration.nix | 4 +++- modules/base/users/default.nix | 2 +- secrets.nix | 7 +++++-- 5 files changed, 11 insertions(+), 6 deletions(-) diff --git a/data.nix b/data.nix index 50fe9aa..c3ace63 100644 --- a/data.nix +++ b/data.nix @@ -4,7 +4,7 @@ rec { hel1a = "65.21.7.119"; }; - people = { + people_pubkeys = { motiejus = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC+qpaaD+FCYPcUU1ONbw/ff5j0xXu5DNvp/4qZH/vOYwG13uDdfI5ISYPs8zNaVcFuEDgNxWorVPwDw4p6+1JwRLlhO4J/5tE1w8Gt6C7y76LRWnp0rCdva5vL3xMozxYIWVOAiN131eyirV2FdOaqTwPy4ouNMmBFbibLQwBna89tbFMG/jwR7Cxt1I6UiYOuCXIocI5YUbXlsXoK9gr5yBRoTjl2OfH2itGYHz9xQCswvatmqrnteubAbkb6IUFYz184rnlVntuZLwzM99ezcG4v8/485gWkotTkOgQIrGNKgOA7UNKpQNbrwdPAMugqfSTo6g8fEvy0Q+6OXdxw5X7en2TJE+BLVaXp4pVMdOAzKF0nnssn64sRhsrUtFIjNGmOWBOR2gGokaJcM6x9R72qxucuG5054pSibs32BkPEg6Qzp+Bh77C3vUmC94YLVg6pazHhLroYSP1xQjfOvXyLxXB1s9rwJcO+s4kqmInft2weyhfaFE0Bjcoc+1/dKuQYfPCPSB//4zvktxTXud80zwWzMy91Q4ucRrHTBz3PrhO8ys74aSGnKOiG3ccD3HbaT0Ff4qmtIwHcAjrnNlINAcH/A2mpi0/2xA7T8WpFnvgtkQbcMF0kEKGnNS5ULZXP/LC8BlLXxwPdqTzvKikkTb661j4PhJhinhVwnQ=="; }; diff --git a/hosts/hel1-a/configuration.nix b/hosts/hel1-a/configuration.nix index 51ae55b..7a3ca1c 100644 --- a/hosts/hel1-a/configuration.nix +++ b/hosts/hel1-a/configuration.nix @@ -26,7 +26,7 @@ in { initrd = { enable = true; - authorizedKeys = builtins.attrValues myData.ssh_pubkeys; + authorizedKeys = builtins.attrValues myData.people_pubkeys; hostKeys = ["/etc/secrets/initrd/ssh_host_ed25519_key"]; }; snapshot = { diff --git a/hosts/vno1-oh2/configuration.nix b/hosts/vno1-oh2/configuration.nix index 6fca3cd..9b45b8e 100644 --- a/hosts/vno1-oh2/configuration.nix +++ b/hosts/vno1-oh2/configuration.nix @@ -17,7 +17,9 @@ ]; sshUnlock = { enable = true; - authorizedKeys = builtins.attrValues myData.ssh_pubkeys; + authorizedKeys = + (builtins.attrValues myData.people_pubkeys) + ++ [myData.hosts."hel1-a.servers.jakst".publicKey]; }; }; }; diff --git a/modules/base/users/default.nix b/modules/base/users/default.nix index 03ffaa8..623189b 100644 --- a/modules/base/users/default.nix +++ b/modules/base/users/default.nix @@ -33,7 +33,7 @@ isNormalUser = true; extraGroups = ["wheel"]; uid = 1000; - openssh.authorizedKeys.keys = [myData.ssh_pubkeys.motiejus]; + openssh.authorizedKeys.keys = [myData.people_pubkeys.motiejus]; } // lib.filterAttrs (n: v: v != null) passwd.motiejus or {}; diff --git a/secrets.nix b/secrets.nix index 4d77182..f8d9ce4 100644 --- a/secrets.nix +++ b/secrets.nix @@ -8,16 +8,19 @@ let vno1-oh2 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHtYsaht57g2sp6UmLHqsCK+fHjiiZ0rmGceFmFt88pY"; systems = [hel1-a vno1-oh2]; in { + # hel1-a + motiejus "secrets/hel1-a/borgbackup/password.age".publicKeys = [hel1-a] ++ motiejus; "secrets/hel1-a/postfix/sasl_passwd.age".publicKeys = [hel1-a] ++ motiejus; "secrets/hel1-a/turn/static_auth_secret.age".publicKeys = [hel1-a] ++ motiejus; "secrets/hel1-a/synapse/jakstys_lt_signing_key.age".publicKeys = [hel1-a] ++ motiejus; "secrets/hel1-a/synapse/registration_shared_secret.age".publicKeys = [hel1-a] ++ motiejus; "secrets/hel1-a/synapse/macaroon_secret_key.age".publicKeys = [hel1-a] ++ motiejus; - - "secrets/hel1-a/zfs-passphrase.age".publicKeys = [vno1-oh2] ++ motiejus; "secrets/vno1-oh2/zfs-passphrase.age".publicKeys = [hel1-a] ++ motiejus; + # vno1-oh2 + motiejus + "secrets/hel1-a/zfs-passphrase.age".publicKeys = [vno1-oh2] ++ motiejus; + + # all hosts + motiejus "secrets/motiejus_passwd_hash.age".publicKeys = [hel1-a vno1-oh2] ++ motiejus; "secrets/root_passwd_hash.age".publicKeys = [hel1-a vno1-oh2] ++ motiejus;