alexion/dev
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(nixos): scope SSH lint suppressions

Browse Source
This commit is contained in:
alexion
2026-10-07 20:10:44 -04:00
parent dbd3fc8bae
commit 1b682b430f
1 changed files with 66 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files

142
configs/nixos/modules/network/ssh.nix
View File

@@ -6,82 +6,72 @@
}:
# Configures inbound and outbound SSH access.
let
cfg = config.modules.network.ssh; # NOLINT(let_order)
defaultAuthorizedKeys = lib.flatten (
clientKeysFor fleet.workstationNames
++ lib.optional fleet.isServer (clientKeysFor fleet.serverNames)
);
clientKeysFor =
names: lib.filter (key: key != null) (map (name: fleet.targets.${name}.clientKey) names);
cfg = config.modules.network.ssh;
user = config.user.name; # NOLINT(let_order)
fleet =
# Keep fleet policy and target construction in conceptual order.
# NOLINT(let_order)
let
workstationNames = [
"neogaia"
"zeus"
# NOLINT(let_order)
workstationNames = [
"neogaia"
"zeus"
];
serverNames = [ "pikachu" ];
managedHostNames = workstationNames ++ serverNames; # NOLINT(let_order)
isWorkstation = lib.elem config.networking.hostName workstationNames; # NOLINT(let_order)
isServer = lib.elem config.networking.hostName serverNames; # NOLINT(let_order)
# NOLINT(let_order)
clientKeyFor = host: builtins.readFile (../../hosts + "/${host}/ssh_user_ed25519_key.pub");
hostKeysFor =
host:
map builtins.readFile [
(../../hosts + "/${host}/ssh_host_ed25519_key.pub")
(../../hosts + "/${host}/ssh_host_rsa_key.pub")
];
# NOLINT(let_order)
managedTargets = lib.genAttrs managedHostNames (name: {
hostName = registry.address.${name}.self;
clientKey = clientKeyFor name;
hostKeys = hostKeysFor name;
});
extraTargets = {
# TODO: Pin Gitea's host key after migrating it from Proxmox.
gitea = {
hostName = "git.alexion.dev";
port = 2022;
user = "gitea";
aliases = [
"gitea"
"git.alexion.dev"
];
serverNames = [ "pikachu" ];
managedHostNames = workstationNames ++ serverNames;
isWorkstation = lib.elem config.networking.hostName workstationNames;
isServer = lib.elem config.networking.hostName serverNames;
clientKeyFor = host: builtins.readFile (../../hosts + "/${host}/ssh_user_ed25519_key.pub");
hostKeysFor =
host:
map builtins.readFile [
(../../hosts + "/${host}/ssh_host_ed25519_key.pub")
(../../hosts + "/${host}/ssh_host_rsa_key.pub")
];
managedTargets = lib.genAttrs managedHostNames (name: {
hostName = registry.address.${name}.self;
clientKey = clientKeyFor name;
hostKeys = hostKeysFor name;
});
extraTargets = {
# TODO: Pin Gitea's host key after migrating it from Proxmox.
gitea = {
hostName = "git.alexion.dev";
port = 2022;
user = "gitea";
aliases = [
"gitea"
"git.alexion.dev"
];
};
};
mkTarget = name: target: {
hostName = target.hostName or name;
user = target.user or user;
port = target.port or 22;
aliases = target.aliases or [ name ];
clientKey = target.clientKey or null;
hostKeys = target.hostKeys or [ ];
};
targets = lib.mapAttrs mkTarget (managedTargets // extraTargets);
outboundTargetNames =
let
groupTargets =
if isServer then
[ "gitea" ] ++ serverNames
else if isWorkstation then
[ "gitea" ] ++ serverNames ++ workstationNames
else
[ "gitea" ];
in
lib.filter (name: name != config.networking.hostName) groupTargets;
in
{
inherit
isServer
outboundTargetNames
serverNames
targets
workstationNames
;
};
user = config.user.name;
};
# NOLINT(let_order)
mkTarget = name: target: {
hostName = target.hostName or name;
user = target.user or user;
port = target.port or 22;
aliases = target.aliases or [ name ];
clientKey = target.clientKey or null;
hostKeys = target.hostKeys or [ ];
};
targets = lib.mapAttrs mkTarget (managedTargets // extraTargets); # NOLINT(let_order)
clientKeysFor = names: lib.filter (key: key != null) (map (name: targets.${name}.clientKey) names); # NOLINT(let_order)
# NOLINT(let_order)
defaultAuthorizedKeys = lib.flatten (
clientKeysFor workstationNames ++ lib.optional isServer (clientKeysFor serverNames)
);
outboundTargetNames = # NOLINT(let_order)
let
groupTargets =
if isServer then
[ "gitea" ] ++ serverNames
else if isWorkstation then
[ "gitea" ] ++ serverNames ++ workstationNames
else
[ "gitea" ];
in
lib.filter (name: name != config.networking.hostName) groupTargets;
knownHosts = lib.listToAttrs (
lib.concatLists (
@@ -94,7 +84,7 @@ let
publicKey = keyWithoutComment key;
}
) target.hostKeys
) fleet.targets
) targets
)
);
knownHostNamesFor =
@@ -109,7 +99,7 @@ let
sshSettingsFor =
name:
let
target = fleet.targets.${name};
target = targets.${name};
in
{
header = "Host ${lib.concatStringsSep " " target.aliases}";
@@ -174,7 +164,7 @@ in
enable = true;
enableDefaultConfig = false;
settings = lib.mapAttrs (name: _: sshSettingsFor name) (
lib.genAttrs fleet.outboundTargetNames (name: name)
lib.genAttrs outboundTargetNames (name: name)
);
};
}