diff options
| author | makefu <github@syntax-fehler.de> | 2015-10-14 00:17:15 +0200 |
|---|---|---|
| committer | makefu <github@syntax-fehler.de> | 2015-10-14 00:17:15 +0200 |
| commit | df3dc3dac1f6c1cc36dbbea506e3d610aa1b417d (patch) | |
| tree | 038a837b20d267d0ba5aad837884b6a5a9087613 /krebs/3modules/default.nix | |
| parent | f73fe104d84b2f0d2fc3b4f0342c36735b3fb220 (diff) | |
| parent | 96f4248b65ff1539eded24572ae1805b27c53d50 (diff) | |
Merge remote-tracking branch 'cd/master'
Diffstat (limited to 'krebs/3modules/default.nix')
| -rw-r--r-- | krebs/3modules/default.nix | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index edfbde9ba..ea1894709 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -138,6 +138,22 @@ let mkIf (privkey != null) (mkForce [privkey]); services.openssh.knownHosts = + # GitHub's IPv4 address range is 192.30.252.0/22 + # Refs https://help.github.com/articles/what-ip-addresses-does-github-use-that-i-should-whitelist/ + # 192.30.252.0/22 = 192.30.252.0-192.30.255.255 (1024 addresses) + # Because line length is limited by OPENSSH_LINE_MAX (= 8192), + # we split each /24 into its own entry. + listToAttrs (map + (c: { + name = "github${toString c}"; + value = { + hostNames = ["github.com"] ++ + map (d: "192.30.${toString c}.${toString d}") (range 0 255); + publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="; + }; + }) + (range 252 255)) + // mapAttrs (name: host: { hostNames = |