diff options
| author | lassulus <lass@aidsballs.de> | 2015-10-09 13:27:02 +0200 |
|---|---|---|
| committer | lassulus <lass@aidsballs.de> | 2015-10-09 13:27:02 +0200 |
| commit | 938b6fe2788d6257d7d273f02c5110e7b641f0a0 (patch) | |
| tree | eca3f607444b7b2fa581c112b621a5903085c6a3 /krebs/3modules | |
| parent | 43a48f25a4009967ac71cdab5cd19022a9742889 (diff) | |
| parent | f1cc52aeaf6c18afb1c79c08914471ff73943a77 (diff) | |
Merge remote-tracking branch 'nomic/master'
Diffstat (limited to 'krebs/3modules')
| -rw-r--r-- | krebs/3modules/default.nix | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index edfbde9ba..ea1894709 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -138,6 +138,22 @@ let mkIf (privkey != null) (mkForce [privkey]); services.openssh.knownHosts = + # GitHub's IPv4 address range is 192.30.252.0/22 + # Refs https://help.github.com/articles/what-ip-addresses-does-github-use-that-i-should-whitelist/ + # 192.30.252.0/22 = 192.30.252.0-192.30.255.255 (1024 addresses) + # Because line length is limited by OPENSSH_LINE_MAX (= 8192), + # we split each /24 into its own entry. + listToAttrs (map + (c: { + name = "github${toString c}"; + value = { + hostNames = ["github.com"] ++ + map (d: "192.30.${toString c}.${toString d}") (range 0 255); + publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="; + }; + }) + (range 252 255)) + // mapAttrs (name: host: { hostNames = |