sokai/mynixos-config
1
1
Fork 0
forked from mirrors_public/oddlama_nix-config
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refactor: merge initrd-ssh.nix with ssh.nix, remove ccid override (now upstream)

Browse source
This commit is contained in:
oddlama 2024-10-29 23:56:03 +01:00
parent ccffba4930
commit 32e9896154
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
19 changed files with 167 additions and 439 deletions
Download patch file Download diff file Expand all files Collapse all files

29
config/optional/initrd-ssh.nix
View file

@ -1,29 +0,0 @@
{
config,
pkgs,
...
}: {
age.secrets.initrd_host_ed25519_key.generator.script = "ssh-ed25519";
boot.initrd.network.enable = true;
boot.initrd.network.ssh = {
enable = true;
port = 4;
hostKeys = [config.age.secrets.initrd_host_ed25519_key.path];
};
# Make sure that there is always a valid initrd hostkey available that can be installed into
# the initrd. When bootstrapping a system (or re-installing), agenix cannot succeed in decrypting
# whatever is given, since the correct hostkey doesn't even exist yet. We still require
# a valid hostkey to be available so that the initrd can be generated successfully.
# The correct initrd host-key will be installed with the next update after the host is booted
# for the first time, and the secrets were rekeyed for the the new host identity.
system.activationScripts.agenixEnsureInitrdHostkey = {
text = ''
[[ -e ${config.age.secrets.initrd_host_ed25519_key.path} ]] \
|| ${pkgs.openssh}/bin/ssh-keygen -t ed25519 -N "" -f ${config.age.secrets.initrd_host_ed25519_key.path}
'';
deps = ["agenixInstall" "users"];
};
system.activationScripts.agenixChown.deps = ["agenixEnsureInitrdHostkey"];
}