alexion/dev
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(nixos): group SSH configuration bindings

Browse Source
This commit is contained in:
alexion
2026-10-07 19:58:22 -04:00
parent f6a49879e6
commit 879d17dce8
1 changed files with 37 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

74
configs/nixos/modules/network/ssh.nix
View File

@@ -5,35 +5,21 @@
...
}:
# Configures inbound and outbound SSH access.
# Keep bindings grouped by purpose rather than dependency traversal.
# NOLINT(let_order)
let
cfg = config.modules.network.ssh; # NOLINT(let_order)
defaultAuthorizedKeys = lib.flatten (
clientKeysFor workstationNames ++ lib.optional isServer (clientKeysFor serverNames)
);
clientKeysFor = names: lib.filter (key: key != null) (map (name: targets.${name}.clientKey) names);
targets = lib.mapAttrs mkTarget (managedTargets // extraTargets);
mkTarget = name: target: {
hostName = target.hostName or name;
user = target.user or user;
port = target.port or 22;
aliases = target.aliases or [ name ];
clientKey = target.clientKey or null;
hostKeys = target.hostKeys or [ ];
};
cfg = config.modules.network.ssh;
user = config.user.name;
managedTargets = lib.genAttrs managedHostNames (name: {
hostName = registry.address.${name}.self;
clientKey = clientKeyFor name;
hostKeys = hostKeysFor name;
});
managedHostNames = workstationNames ++ serverNames;
workstationNames = [
"neogaia"
"zeus"
];
serverNames = [ "pikachu" ];
managedHostNames = workstationNames ++ serverNames;
isWorkstation = lib.elem config.networking.hostName workstationNames;
isServer = lib.elem config.networking.hostName serverNames;
clientKeyFor = host: builtins.readFile (../../hosts + "/${host}/ssh_user_ed25519_key.pub");
hostKeysFor =
host:
@@ -41,7 +27,11 @@ let
(../../hosts + "/${host}/ssh_host_ed25519_key.pub")
(../../hosts + "/${host}/ssh_host_rsa_key.pub")
];
managedTargets = lib.genAttrs managedHostNames (name: {
hostName = registry.address.${name}.self;
clientKey = clientKeyFor name;
hostKeys = hostKeysFor name;
});
extraTargets = {
# TODO: Pin Gitea's host key after migrating it from Proxmox.
gitea = {
@@ -54,7 +44,31 @@ let
];
};
};
isServer = lib.elem config.networking.hostName serverNames;
mkTarget = name: target: {
hostName = target.hostName or name;
user = target.user or user;
port = target.port or 22;
aliases = target.aliases or [ name ];
clientKey = target.clientKey or null;
hostKeys = target.hostKeys or [ ];
};
targets = lib.mapAttrs mkTarget (managedTargets // extraTargets);
clientKeysFor = names: lib.filter (key: key != null) (map (name: targets.${name}.clientKey) names);
defaultAuthorizedKeys = lib.flatten (
clientKeysFor workstationNames ++ lib.optional isServer (clientKeysFor serverNames)
);
outboundTargetNames =
let
groupTargets =
if isServer then
[ "gitea" ] ++ serverNames
else if isWorkstation then
[ "gitea" ] ++ serverNames ++ workstationNames
else
[ "gitea" ];
in
lib.filter (name: name != config.networking.hostName) groupTargets;
knownHosts = lib.listToAttrs (
lib.concatLists (
@@ -77,7 +91,6 @@ let
names = lib.unique (target.aliases ++ [ target.hostName ]);
in
map withPort names;
keyWithoutComment = key: lib.concatStringsSep " " (lib.take 2 (lib.splitString " " key));
sshSettingsFor =
@@ -92,19 +105,6 @@ let
}
// lib.optionalAttrs (target.port != 22) { Port = target.port; };
outboundTargetNames =
let
groupTargets =
if isServer then
[ "gitea" ] ++ serverNames
else if isWorkstation then
[ "gitea" ] ++ serverNames ++ workstationNames
else
[ "gitea" ];
in
lib.filter (name: name != config.networking.hostName) groupTargets;
isWorkstation = lib.elem config.networking.hostName workstationNames;
hostKeySecret = type: "ssh-host-${type}-key";
hostKeyTypes = [
"ed25519"