summaryrefslogtreecommitdiffstats
path: root/lass
diff options
context:
space:
mode:
authorlassulus <lassulus@lassul.us>2021-05-03 17:59:52 +0200
committermakefu <github@syntax-fehler.de>2021-05-15 13:11:34 +0200
commitc65950414676f27a3a1edfd3e24b1e4565ecef8c (patch)
treedb53950f1555a51e93a6f6768a76bdc6c2d5790d /lass
parentbbe60be64d2647002be6b70c8dc92421d48cb0de (diff)
l: (re)init echelon.r (with ssh tor unlocking)
Diffstat (limited to 'lass')
-rw-r--r--lass/1systems/echelon/config.nix14
-rw-r--r--lass/1systems/echelon/physical.nix33
-rw-r--r--lass/2configs/tests/dummy-secrets/initrd/ssh.ed25519_key0
-rw-r--r--lass/2configs/tor-initrd.nix49
4 files changed, 96 insertions, 0 deletions
diff --git a/lass/1systems/echelon/config.nix b/lass/1systems/echelon/config.nix
new file mode 100644
index 000000000..9e72916b3
--- /dev/null
+++ b/lass/1systems/echelon/config.nix
@@ -0,0 +1,14 @@
+{ config, pkgs, ... }:
+{
+ imports = [
+ <stockholm/lass>
+
+ <stockholm/lass/2configs/retiolum.nix>
+ <stockholm/lass/2configs/tor-initrd.nix>
+ ];
+
+ krebs.build.host = config.krebs.hosts.echelon;
+
+ boot.tmpOnTmpfs = true;
+}
+
diff --git a/lass/1systems/echelon/physical.nix b/lass/1systems/echelon/physical.nix
new file mode 100644
index 000000000..fbacc3927
--- /dev/null
+++ b/lass/1systems/echelon/physical.nix
@@ -0,0 +1,33 @@
+{ config, lib, pkgs, modulesPath, ... }:
+{
+ imports = [
+ ./config.nix
+ (modulesPath + "/profiles/qemu-guest.nix")
+ ];
+
+ # Use the GRUB 2 boot loader.
+ boot.loader.grub.enable = true;
+ boot.loader.grub.version = 2;
+ boot.loader.grub.efiSupport = true;
+ boot.loader.grub.efiInstallAsRemovable = true;
+ # Define on which hard drive you want to install Grub.
+ boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
+
+ boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sd_mod" "sr_mod" ];
+ boot.initrd.kernelModules = [ "dm-snapshot" ];
+ boot.initrd.luks.devices.luksroot.device = "/dev/sda3";
+
+ networking.useDHCP = false;
+ networking.interfaces.ens18.useDHCP = true;
+
+ fileSystems."/" = {
+ device = "/dev/disk/by-uuid/5186edb1-9234-48ae-8679-61facb56b818";
+ fsType = "xfs";
+ };
+
+ fileSystems."/boot" = {
+ device = "/dev/disk/by-uuid/56D1-34A0";
+ fsType = "vfat";
+ };
+
+}
diff --git a/lass/2configs/tests/dummy-secrets/initrd/ssh.ed25519_key b/lass/2configs/tests/dummy-secrets/initrd/ssh.ed25519_key
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/lass/2configs/tests/dummy-secrets/initrd/ssh.ed25519_key
diff --git a/lass/2configs/tor-initrd.nix b/lass/2configs/tor-initrd.nix
new file mode 100644
index 000000000..64e64b5b3
--- /dev/null
+++ b/lass/2configs/tor-initrd.nix
@@ -0,0 +1,49 @@
+{config, pkgs, ... }:
+## unlock command:
+# (pass admin/$host/root;echo) | torify ssh root@$(pass hosts/$host/initrd/hostname) 'cat > /crypt-ramfs/passphrase'
+{
+ boot.initrd.network.enable = true;
+ boot.initrd.network.ssh = {
+ enable = true;
+ port = 22;
+ authorizedKeys = [
+ config.krebs.users.lass.pubkey
+ config.krebs.users.lass-mors.pubkey
+ config.krebs.users.lass-green.pubkey
+ ];
+ hostKeys = [ <secrets/initrd/ssh.ed25519_key> ];
+ };
+ boot.initrd.availableKernelModules = [ "e1000e" ];
+
+ boot.initrd.secrets = {
+ "/etc/tor/onion/bootup" = <secrets/initrd>;
+ };
+
+ boot.initrd.extraUtilsCommands = ''
+ copy_bin_and_libs ${pkgs.tor}/bin/tor
+ '';
+
+ # start tor during boot process
+ boot.initrd.network.postCommands = let
+ torRc = (pkgs.writeText "tor.rc" ''
+ DataDirectory /etc/tor
+ SOCKSPort 127.0.0.1:9050 IsolateDestAddr
+ SOCKSPort 127.0.0.1:9063
+ HiddenServiceDir /etc/tor/onion/bootup
+ HiddenServicePort 22 127.0.0.1:22
+ '');
+ in ''
+ echo "tor: preparing onion folder"
+ # have to do this otherwise tor does not want to start
+ chmod -R 700 /etc/tor
+
+ echo "make sure localhost is up"
+ ip a a 127.0.0.1/8 dev lo
+ ip link set lo up
+
+ echo "tor: starting tor"
+ tor -f ${torRc} --verify-config
+ tor -f ${torRc} &
+ '';
+}
+