summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--krebs/3modules/default.nix8
-rw-r--r--krebs/4lib/types.nix26
2 files changed, 26 insertions, 8 deletions
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index 8e79cd014..4a9be8676 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -104,7 +104,11 @@ let
combined-hosts = (mapAttrsToList (name: value: value.extraZones) cfg.hosts );
in lib.mapAttrs' (name: value: nameValuePair (("zones/" + name)) ({ text=value; })) all-zones;
- programs.ssh.knownHosts =
+ services.openssh.hostKeys =
+ let inherit (config.krebs.build.host.ssh) privkey; in
+ mkIf (privkey != null) (mkForce [privkey]);
+
+ services.openssh.knownHosts =
mapAttrs
(name: host: {
hostNames =
@@ -550,7 +554,7 @@ let
'';
};
};
- ssh.privkey = <secrets/ssh.id_ed25519>;
+ ssh.privkey.path = <secrets/ssh.id_ed25519>;
ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICuShEqU0Cdm7KCaMD5x1D6mgj+cr7qoqbzFJDKoBbbw";
};
ire = {
diff --git a/krebs/4lib/types.nix b/krebs/4lib/types.nix
index a7df92084..0aa594fb1 100644
--- a/krebs/4lib/types.nix
+++ b/krebs/4lib/types.nix
@@ -57,13 +57,27 @@ types // rec {
else trace "The option `krebs.hosts.${config.name}.ssh.pubkey' is unused." null;
};
ssh.privkey = mkOption {
- type = either path str;
- apply = x: {
- path = toString x;
- string = x;
- }.${typeOf x};
+ type = nullOr (submodule {
+ options = {
+ bits = mkOption {
+ type = nullOr (enum ["4096"]);
+ default = null;
+ };
+ path = mkOption {
+ type = either path str;
+ apply = x: {
+ path = toString x;
+ string = x;
+ }.${typeOf x};
+ };
+ type = mkOption {
+ type = enum ["rsa" "ed25519"];
+ default = "ed25519";
+ };
+ };
+ });
+ default = null;
};
-
};
});