summaryrefslogtreecommitdiffstats
path: root/krebs/3modules/default.nix
diff options
context:
space:
mode:
Diffstat (limited to 'krebs/3modules/default.nix')
-rw-r--r--krebs/3modules/default.nix126
1 files changed, 113 insertions, 13 deletions
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index dc30b9c50..2d3b7b077 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -6,7 +6,7 @@ let
out = {
imports = [
- ./build
+ ./build.nix
./exim-retiolum.nix
./exim-smarthost.nix
./github-hosts-sync.nix
@@ -84,13 +84,16 @@ let
mapAttrsToList (hostname: host:
mapAttrsToList (netname: net:
let
- aliases = toString (unique (longs ++ shorts));
+ aliases = longs ++ shorts;
providers = dns.split-by-provider net.aliases cfg.dns.providers;
longs = providers.hosts;
- shorts = map (removeSuffix ".${cfg.search-domain}") longs;
+ shorts =
+ map (removeSuffix ".${cfg.search-domain}")
+ (filter (hasSuffix ".${cfg.search-domain}")
+ longs);
in
- map (addr: "${addr} ${aliases}") net.addrs
- ) host.nets
+ map (addr: "${addr} ${toString aliases}") net.addrs
+ ) (filterAttrs (name: host: host.aliases != []) host.nets)
) cfg.hosts
));
@@ -100,6 +103,36 @@ let
([cfg.zone-head-config] ++ combined-hosts) ;
combined-hosts = (mapAttrsToList (name: value: value.extraZones) cfg.hosts );
in lib.mapAttrs' (name: value: nameValuePair (("zones/" + name)) ({ text=value; })) all-zones;
+
+ services.openssh.hostKeys =
+ let inherit (config.krebs.build.host.ssh) privkey; in
+ mkIf (privkey != null) (mkForce [privkey]);
+
+ services.openssh.knownHosts =
+ mapAttrs
+ (name: host: {
+ hostNames =
+ concatLists
+ (mapAttrsToList
+ (net-name: net:
+ let
+ aliases = shorts ++ longs;
+ longs = net.aliases;
+ shorts =
+ map (removeSuffix ".${cfg.search-domain}")
+ (filter (hasSuffix ".${cfg.search-domain}")
+ longs);
+ add-port = a:
+ if net.ssh.port != null
+ then "[${a}]:${toString net.ssh.port}"
+ else a;
+ in
+ aliases ++ map add-port net.addrs)
+ host.nets);
+
+ publicKey = host.ssh.pubkey;
+ })
+ (filterAttrs (_: host: host.ssh.pubkey != null) cfg.hosts);
}
];
@@ -110,7 +143,7 @@ let
dc = "lass"; #dc = "cac";
nets = rec {
internet = {
- addrs4 = ["162.248.8.63"];
+ addrs4 = ["104.233.84.57"];
aliases = [
"echelon.internet"
];
@@ -125,12 +158,42 @@ let
];
tinc.pubkey = ''
-----BEGIN RSA PUBLIC KEY-----
- MIIBCgKCAQEA92ybhDahtGybpAkUNlG5Elxw05MVY4Pg7yK0dQugB4nVq+pnmi78
- DOMeIciecMHmJM8n9UlUU0eWZVCgHeVd23d6J0hTHCv24p24uHEGGy7XlO/dPJ6A
- IjROYU0l8c03pipdJ3cDBx6riArSglwmZJ7xH/Iw0BUhRZrPqbtijY7EcG2wc+8K
- N9N9mBofVMl4EcBiDR/eecK+ro8OkeOmYPtYgFJLvxTYXiPIhOxMAlkOY2fpin/t
- cgFLUFuN4ag751XjjcNpVovVq95vdg+VhKrrNVWZjJt03owW81BzoryY6CD2kIPq
- UxK89zEdeYOUT7AxaT/5V5v41IvGFZxCzwIDAQAB
+ MIIBCgKCAQEAuscWOYdHu0bpWacvwTNd6bcmrAQ0YFxJWHZF8kPZr+bMKIhnXLkJ
+ oJheENIM6CA9lQQQFUxh2P2pxZavW5rgVlJxIKeiB+MB4v6ZO60LmZgpCsWGD/dX
+ MipM2tLtQxYhvLJIJxEBWn3rxIgeEnCtZsH1KLWyLczb+QpvTjMJ4TNh1nEBPE/f
+ 4LUH1JHaGhcaHl2dLemR9wnnDIjmSj0ENJp2al+hWnIggcA/Zp0e4b86Oqbbs5wA
+ n++n5j971cTrBdA89nJDYOEtepisglScVRbgLqJG81lDA+n24RWFynn+U3oD/L8p
+ do+kxlwZUEDRbPU4AO5L+UeIbimsuIfXiQIDAQAB
+ -----END RSA PUBLIC KEY-----
+ '';
+ };
+ };
+ };
+ fastpoke = {
+ dc = "lass"; #dc = "cac";
+ nets = rec {
+ internet = {
+ addrs4 = ["193.22.164.36"];
+ aliases = [
+ "fastpoke.internet"
+ ];
+ };
+ retiolum = {
+ via = internet;
+ addrs4 = ["10.243.253.152"];
+ addrs6 = ["42:422a:194f:ff3b:e196:2f82:5cf5:bc00"];
+ aliases = [
+ "fastpoke.retiolum"
+ "cgit.fastpoke.retiolum"
+ ];
+ tinc.pubkey = ''
+ -----BEGIN RSA PUBLIC KEY-----
+ MIIBCgKCAQEAs4p5xsQYx06v+OkUbc09K6voFAbkvO66QdFoM71E10XyCeLP6iuq
+ DaIOFN4GrPR36pgyjqtJ+62G9uR+WsB/y14eio1p1ivDWgcpt5soOZAH5zVRRD9O
+ FBDlgVNwIJ6stMHy6OenEKWsfEiZRN3XstnqAqyykzjddglth1tJntn6kbZehzNQ
+ ezfIyN4XgaX2fhSu+UnAyLcV8wWnF9cMABjz7eKcSmRJgtG4ZiuDkbgiiEew7+pB
+ EPqOVQ80lJvzQKgO4PmVoAjD9A+AHnmLJNPDQQi8nIVilGCT60IX+XT1rt85Zpdy
+ rEaeriw/qsVJnberAhDAdQYYuM1ai2H5swIDAQAB
-----END RSA PUBLIC KEY-----
'';
};
@@ -501,6 +564,7 @@ let
"cgit.cd.viljetic.de"
"cd.krebsco.de"
];
+ ssh.port = 11423;
};
retiolum = {
via = internet;
@@ -527,6 +591,8 @@ let
'';
};
};
+ ssh.privkey.path = <secrets/ssh.id_ed25519>;
+ ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOd/HqZIO9Trn3eycl23GZAz21HQCISaVNfNyaLSQvJ6";
};
mkdir = rec {
cores = 1;
@@ -534,7 +600,7 @@ let
infest.addr = head nets.internet.addrs4;
nets = rec {
internet = {
- addrs4 = ["104.233.84.102"];
+ addrs4 = ["104.233.84.215"];
aliases = [
"mkdir.internet"
];
@@ -559,6 +625,35 @@ let
'';
};
};
+ ssh.privkey.path = <secrets/ssh.id_ed25519>;
+ ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICuShEqU0Cdm7KCaMD5x1D6mgj+cr7qoqbzFJDKoBbbw";
+ };
+ ire = {
+ nets = {
+ internet = {
+ addrs4 = ["198.147.22.115"];
+ ssh.port = 11423;
+ };
+ retiolum = {
+ addrs4 = ["10.243.231.66"];
+ addrs6 = ["42:b912:0f42:a82d:0d27:8610:e89b:490c"];
+ aliases = [
+ "ire.retiolum"
+ ];
+ tinc.pubkey = ''
+ -----BEGIN RSA PUBLIC KEY-----
+ MIIBCgKCAQEAwofjmP/XBf5pwsJlWklkSzI+Bo0I0B9ONc7/j+zpbmMRkwbWk4X7
+ rVLt1cWvTY15ujg2u8l0o6OgEbIkc6rslkD603fv1sEAd0KOv7iKLgRpE9qfSvAt
+ 6YpiSv+mxEMTpH0g36OmBfOJ10uT+iHDB/FfxmgGJx//jdJADzLjjWC6ID+iGkGU
+ 1Sf+yHXF7HRmQ29Yak8LYVCJpGC5bQfWIMSL5lujLq4NchY2d+NZDkuvh42Ayr0K
+ LPflnPBQ3XnKHKtSsnFR2vaP6q+d3Opsq/kzBnAkjL26jEuFK1v7P/HhNhJoPzwu
+ nKKWj/W/k448ce374k5ycjvKm0c6baAC/wIDAQAB
+ -----END RSA PUBLIC KEY-----
+ '';
+ ssh.port = 11423;
+ };
+ };
+ ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBaMjBJ/BfYlHjyn5CO0xzFNaQ0LPvMP3W9UlOs1OxGY";
};
nomic = {
cores = 2;
@@ -584,6 +679,7 @@ let
};
};
secure = true;
+ ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILn7C3LxAs9kUynENdRNgQs4qjrhNDfXzlHTpVJt6e09";
};
rmdir = rec {
cores = 1;
@@ -616,6 +712,8 @@ let
'';
};
};
+ ssh.privkey.path = <secrets/ssh.id_ed25519>;
+ ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICLuhLRmt8M5s2Edwwl9XY0KAAivzmPCEweesH5/KhR4";
};
wu = {
cores = 4;
@@ -641,6 +739,7 @@ let
};
};
secure = true;
+ ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcJvu8JDVzObLUtlAQg9qVugthKSfitwCljuJ5liyHa";
};
xu = {
cores = 4;
@@ -666,6 +765,7 @@ let
};
};
secure = true;
+ ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID554niVFWomJjuSuQoiCdMUYrCFPpPzQuaoXXYYDxlw";
};
};
users = addNames {