From bdcb1791ad87ad58f610d75c613cc98c359e731e Mon Sep 17 00:00:00 2001 From: Lilith Date: Sun, 21 Jun 2026 14:59:38 +0200 Subject: [PATCH] ssh --- .gitignore | 1 - flake.lock | 38 +++++++++++++-------------- hosts/lilith-pad/secrets/default.yaml | 12 ++++----- hosts/lilith-pc/secrets/default.yaml | 12 ++++----- server/wireguard.nix | 5 ++-- system/core/ssh.nix | 17 +++++++++--- system/core/users.nix | 7 ++++- 7 files changed, 52 insertions(+), 40 deletions(-) diff --git a/.gitignore b/.gitignore index 905fdf8..b2be92b 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1 @@ -old result diff --git a/flake.lock b/flake.lock index 47cb486..54cf5b8 100644 --- a/flake.lock +++ b/flake.lock @@ -271,11 +271,11 @@ ] }, "locked": { - "lastModified": 1781497404, - "narHash": "sha256-9GAF8sSsnkyCVCWkomXR0T+zdSxyUlfPt6neQidimdg=", + "lastModified": 1781989573, + "narHash": "sha256-npfH7Zv7t1akX/ArqCNro4zU4ViPlghLaPnbEfHbCxk=", "owner": "nix-community", "repo": "home-manager", - "rev": "1285cd3d6882a9847f2d56ed5541b3350c8a6162", + "rev": "78e7d8b13ecd7f5256a5c11ce216876164099d9f", "type": "github" }, "original": { @@ -407,11 +407,11 @@ "xdph": "xdph" }, "locked": { - "lastModified": 1781462409, - "narHash": "sha256-YJ7lWxGXD789bZFzOhwYk8bcwaiYgyq68OWs/HUuzjA=", + "lastModified": 1782038310, + "narHash": "sha256-OFQS7iO89c0GcUnyXnF/95G8inj4PNfzzt1To9yFOzI=", "ref": "refs/heads/main", - "rev": "e5c721f29ae035881aef1620b2d714da97067883", - "revCount": 7475, + "rev": "735c0e02247344ed5b8e38a5c39ba8c8c8cb85dd", + "revCount": 7487, "type": "git", "url": "https://github.com/hyprwm/Hyprland" }, @@ -704,11 +704,11 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1781359544, - "narHash": "sha256-iUuzKQcyXvopYDDzFpMK5eQKP3WIJExYny2kJtbgUcE=", + "lastModified": 1781607440, + "narHash": "sha256-rxO+uc/KFbSJp+pgyXRuAX6QlG9hJdnt0BXpEQRXY+U=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "9f11f828c213641c2369a9f1fa31fe31557e3156", + "rev": "3e41b24abd260e8f71dbe2f5737d24122f972158", "type": "github" }, "original": { @@ -726,11 +726,11 @@ ] }, "locked": { - "lastModified": 1781523504, - "narHash": "sha256-Nm02HrZLig9A3wmxqqnVpS6d6ZNc+FafmH4iyLQkJkg=", + "lastModified": 1782044691, + "narHash": "sha256-9+JBJ6maL8AznRW8kCSw30YxDy08QcVAMs87fRiUpGY=", "owner": "nix-community", "repo": "NUR", - "rev": "f397007f00ee42353a03a8192695b38ea5334a12", + "rev": "e3ca0670f374713742bf762c5c33b5bce30d36a6", "type": "github" }, "original": { @@ -838,11 +838,11 @@ ] }, "locked": { - "lastModified": 1780547341, - "narHash": "sha256-Gq8KNx5A7hBB3uGJaj6eQfLDIz5YdLu92gqBcvHvoUo=", + "lastModified": 1781943681, + "narHash": "sha256-NFHmA7H47adqiyp+0iEOyZOQhmigDqA/NBAlf4imB6U=", "owner": "Mic92", "repo": "sops-nix", - "rev": "9ed65852b6257fbeae4355bc24ecfea307ca759a", + "rev": "420f8d2e9882911f65cfac15cc706f639ba96cca", "type": "github" }, "original": { @@ -871,11 +871,11 @@ "tinted-zed": "tinted-zed" }, "locked": { - "lastModified": 1781018772, - "narHash": "sha256-C+cGIUaC6dqfwTbI+BwCd572PbESGA3WYxR1sLTqxkY=", + "lastModified": 1781997134, + "narHash": "sha256-muBZG4O/agq/ljgHr6c3AsobIWgODAS6vf50xIS7o+Q=", "owner": "danth", "repo": "stylix", - "rev": "a378e4c09031fb15a4d65da88aa628f71fc52f6b", + "rev": "a6a493119e492e15874caf6f7f8c7e572e64c655", "type": "github" }, "original": { diff --git a/hosts/lilith-pad/secrets/default.yaml b/hosts/lilith-pad/secrets/default.yaml index 9728706..e0afdaf 100644 --- a/hosts/lilith-pad/secrets/default.yaml +++ b/hosts/lilith-pad/secrets/default.yaml @@ -3,14 +3,13 @@ user: ssh: public: ENC[AES256_GCM,data:iJVUTqrBdArFmUsB8MYcimkUxWnuTxFhJ8xOM3LHNL2Qh8gHTMiyjxaU7AQZQtu+jfhpmMTj42h2PqoA31wgOcvnlpVbNc+GvSmThb7d/jFC,iv:k3e7tpbgoMS8ySVnoasimxShDrvXjKa5lB3xpyGddqc=,tag:qIeTjHlfZz73kxdWuCOprA==,type:str] private: ENC[AES256_GCM,data:INtOHRiH+lTGH6zTtjzO/VoYsNRVFBDaWpTjAnHEv+YgXAslHTF7AvFoM9XKvjLCe3x3celD8r4yd//vof6WRuGpr4foIN09CXS0VO0fEkcNo224ajNc+FGEUNzeWjCqDW8Jvlyq7tEE+ywjVM4MF/IeyHM3Oh93gTprq+ZjzXYfXuqElVzlcLJaOGIAXmqWqUtzmGh7xx2TXfapkCi8oHm3cx7/A8FG7kBxyCcJ/3aIzrWZo5zHdts8l+qB5hc86vwHVZ3WVBfuXKpTaXCzQHRRaw7vaIP5O2V8bpU8p56TxYDl9N8GrbF5S38AxwtW+FHZKLXD33I3uQk4qztpvT8AvStnMM4x2D8JIhWN7LYmbMFuJng5UfzwLveIVPl5MIHAtVvk2W/QTw/5+kbqHIud3UWv5o/vbnm8l88q5WlO0U9CgRmV0FPTK/hdEj+tEUR6AzFi/Ea6Qiv0BGVGLOHWYszfXzKA1mss+MteR9k+PQqx4wsQM9nWnMOTQGf99RMyeHG1u68gsKy55dvEMXx0lo2iUcdBttVHZaUP5baiOhr6VS74rBxpeLBN03Vzj6A6fG1b2u6V5vSZ6sC1MFlgL1gjwLzGlqi3thVAV9g=,iv:CHie+Sns7HefRwBqdo2Gw1UexHS+W1y6t4etbHA//5Y=,tag:X3U1+wHVzRBUOl8sNo8jtg==,type:str] - authorized: "" + authorized: ENC[AES256_GCM,data:KANbMG1qUPY1S7x+rekNrHHJG/hvqVoply4cCkm0lUh6XgNv4dKC2e3InTSEMwFa3S2GaNXdsRX3VZVLnItAq/YRntGR2+505su1aGViSi/cbbFxsH/wHA2PeYnkuWu2EU/LTxhgtYAR4CXq0JYbnELRkMFu9QTsHkueVy/XHqI+5HoDYIWTO7NzKQKb0+TPFgdnpPC/uLHV8PJC6tut7Ji8,iv:hX1+NlVsUuSvA4cPcV45Oc9f8vvmkqHnCM7xw50gyqo=,tag:idV46UIgJfYFgELrh9FCvA==,type:str] syncthing: cert.pem: ENC[AES256_GCM,data:zVGfurUvMA28jtWqBBHmlz+ujHGd9/ogZYLL1AMb8njzi5BJZHW0+QaHhLqjw7BKNs9CDmpIhIytvkY9WFoQ6zJe477ndXr7lPDdpoLkEDCZKXypVjAOuqHXTXJ44RI6hU87347bq2BP1Ph9847hryA4iWicdhYLj0SrFcQVu2MnGWJZ75k1eUqELjgT6rqmR7jzRs0Z4mGaGRwrG1Bi76mkfrOe0SVV6iE8Kk3U3iYDcqraWbS3Y3Fdr+UgPuK7uJ5RO5MFMjS1CHmUvo+K/tgcH74r2NS7FQBHnG5Ec0MMW1r08W5odd93oAJUC/PWYUW4giSahp1G+GyGMO3NSmTMW5PJ524I8izRRVg2jO9usv6ukxC9oUV4DIz9kpj9yVnHA7MJCw6yJTveLQMumYxKyorQUxkPDAyYty56D56mOnaxgRT7GsDkuj6VJ5aujqvzUq1f7bwxe43g75IY5BQpzWOufsCvnGt76dmZw3+gdsw4noQEv+Hm3FOvLnBA8H0hzDAtIs0Yy4GdviZj0687ZqAdM8y6+hOvC6UxSm5OkplCAi2E5yte5OS6csvMWR2atT6D13jZFU3PL7aIw0Z8y2Gx/jVlr68UHOn6jvonQzc2+fZmcQJL8aHW6jsDroIYHbl98OAFg+WE/Yp/lV3ffczhfzoH25qL8AHiHXwsBPOVkkpFSBxrNO2XFeDIEkl73amjCvkM1X3AxHBTgCgK2Y2kkvpwOiwUQdt5/YcLGgIWkpHpPDfGiqOkkMsWZbGcGPQtkUnhu16ul4+NUFDwiE2CYaw5+cPpdLq8DWv//V0iKcHP4jinYM+ZaUIh1loupdinhGKIeX+xNFcf9kB6dcdjR7TliN7gb5ekynSxjHM3i3EFp47bhkMbQpLVzOKZ8vgeb/eVU+t97lPNxhioHAeRPwIoxq8lnLHhY7p7AN0gzsfOeDKz2BuxaaFI0DCg63aJC2nHpvy+5lWtWYto6rUB2q4JTA9oKm6RLDcDaYTLfpQtM9sdH9N5TDsCukPVm+e6gr9AbjG8IFt9QUGb0UxzkqY20bI=,iv:XIhlEi02Il+RdKPjqRIPCg1ooij8ipTbbUZlupijTVg=,tag:7mU3OWolhHxtsN6rHs8vIQ==,type:str] key.pem: ENC[AES256_GCM,data:fo8ejY1p+oBwy4L5WiecLQLkwKVdVEi7fzKb8/ACD+7qKXMk+MChW1MeUrFjWCHtHIdw3Ld7SrCmEC/3cqL87aFiZFBOv/cV4Jkvy1kEmZLuKo8wM5Vn+7Ec4WVDAbqhiT5MEgaWHdSgmv2kvkeUnH4LJSx9uohRTgKlO0eIqY9aXO5PqZEPLuHvvTrUi1OCvadaAsKHx3yqTm2tuqK7mPzOL2A4WLQRMKSlQIbzgTz2CShql8D6/crzIAoQVnXf+/KbqzRw3NKtIzQA0aSx1tA4DjPSugWkx+sqjUShYOfZ8Rnbto5/Nbmk4QTaCkvsOli4lazGAKmPtMVBXfbFvZUXiZ/QoawVmsw1MMCCtaRpV7cEAKHJCZ+lRA4CUoJm,iv:JQHPAdW1gJxpZaBcY/BdRBweEYAAj0ZWwAeHFR4J5zo=,tag:i5VWdxTu+Wez3poflwGiog==,type:str] sops: age: - - recipient: age1mqw75xvd2gnhx2wsmkr8yctegjfym6xkypwjh82s3yws2glk4vms3cxqaz - enc: | + - enc: | -----BEGIN AGE ENCRYPTED FILE----- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKRWRJOWZQY1ZpWGQ4ZXND RC83eEZGZkVjelkxZDNkdlMvODN6a0dnWFRRCmxGT0U1dWJ1bWJDQVRHYmlQMHZQ @@ -18,8 +17,9 @@ sops: OW5yTndZYU16NTYrdDZRUjZJS25VbEUKmD4HAa0e2p8SRw5mlzgh+ByFqCDhj8wv QumEed0Hb9jve8aO8K9MEayxi5jIULFYuYWD8D1RF/74UGrgBTAykA== -----END AGE ENCRYPTED FILE----- - lastmodified: "2025-09-24T16:29:01Z" - mac: ENC[AES256_GCM,data:0Le2kpYJ+C3SUN8QFOhBGlVdT58p0DZj0/m8uRcoTnrDMljWq1XACmnYl8OcqsQ/tkjjZIv908Lvn+tkfZxVxNhsIuZiLleMxkqWaAwLooyueJdrYtQR8MyLJD4GzLNiwhbW6aYBc7OhDcowcfDxe5R0ZXvI5OtEdBbw0Up0amg=,iv:CLBXlvq6zAp9PMWGYuhN3WvjLYOkt7mPzQ3dO7ulQnk=,tag:te/T4Uxbl4bVh/h7TXnLpg==,type:str] + recipient: age1mqw75xvd2gnhx2wsmkr8yctegjfym6xkypwjh82s3yws2glk4vms3cxqaz + lastmodified: "2026-06-21T12:38:52Z" + mac: ENC[AES256_GCM,data:8/Rw4MYLCPwvkbboPbd017RWFN0Cb9ZU616NpPo6Gr0GYxKouL19kAX1rll8VVVtv13UMMT99zGn15r7soX0ftJAXrQa1bAVxUq7DlwIFtLH+h/56sjO+5s3zkDtPntYo8qLWWMfyXz3Suvtx0qz45CqZfnzXD3Qsnkvgj2Qols=,iv:rvCJEOyermsVcH5/tTOi2mGQ0cP9EoRLdGHwcwL32Qg=,tag:DZvUFtcfIov/uttN2MLwag==,type:str] pgp: - created_at: "2025-03-15T23:51:35Z" enc: |- @@ -34,4 +34,4 @@ sops: -----END PGP MESSAGE----- fp: 3586D8D6689B9C9ECD598C588712A0F317C37175 unencrypted_suffix: _unencrypted - version: 3.10.2 + version: 3.13.1 diff --git a/hosts/lilith-pc/secrets/default.yaml b/hosts/lilith-pc/secrets/default.yaml index eacccf9..ccfd367 100644 --- a/hosts/lilith-pc/secrets/default.yaml +++ b/hosts/lilith-pc/secrets/default.yaml @@ -3,14 +3,13 @@ user: ssh: public: ENC[AES256_GCM,data:DYYGLTFvmZa/bvAo0dvHiL9jt6cfSeZZN5Omo3af1lHhOfQYapqm7DXOf6xBn0HNr32L4gFEpE+2IquUaPUtY48nsC+PiuFSp1x/73/sjOCZdcTkGh7ehwZ4PECN3goIBw==,iv:Q4YZSMQhuIuiuiN94aHk2pwForVESEHhXjDAGTAhvR0=,tag:dFFBjKqIwn75m8GaXosjMQ==,type:str] private: ENC[AES256_GCM,data:DHRNPGp2BRPuZ5mATxIsuKsKIjVo+hrzX+L+yZUWc/7xjjpMnlloZ7LCqlP4vXzJAEcolqwpnOLNM796WHtxO5I4HiK9R7p6EDfOGYor62RnhQ4YT7Rc75hWX0vX3dAsvd8/sAYcZMCxVAtCoc4c+UGHdNnh+0Nl6uWO5teakOGPnMqk+Wz1GI//quKxUWs9oRLrZ+093XqTjigcVJ8NcnYDl5RE46HLcgJOp8ii9PeSOI2XM2L6wSWpAO0E3OlAm3z0hTWUcvfIwKzWpkA132JCZJrQtNNsqez0ZBFJQkaaImRDi9y/jT6YInuDhc8gVct04oOda3qKxrm+JWXGOt7HkK54NQFouZbN6e3JZIQaMzz5jPhT/muPs6EsSudorcved/eoyR+rU2Yxn087EVRzqZUZXj3rZpCKWV9rZq8jzOd+g8P7pK1LyUqc98UqSigMdxYwcB6fp/iX7ZcG7wmoRNXbaXXhN1ksY36NqUSNtv5xrF95/THgxwFB6QgY6l+L/7bKblkeLGp1T4MeNSLjHku/0wKCF9fmBiGXTB3evyWlXA42WDJG1SZMS5vT89WV1FiIfsbW6WgYdtMrASxlsDE3qS5TSrUGfjA6+vY=,iv:B6PahG+KL0tuDVS+tF6qOvRJKqyDbKbH/4Qm9Ig7vw4=,tag:Xo0yBa0/fyc3zUzrf3w1LA==,type:str] - authorized: ENC[AES256_GCM,data:YQaf0bIuSrODiORXZsLPR5N3iteOdhgu/y1eNKGKjzn+Ko+kn8FfJYS6ON+PDC2oJXiopF+GHHWu3Rjew+5KL7osg40CB1daFUxtT9orYIr0,iv:dek8bzKcLgCtKbfTIAteA/bqc53GijmyDbnikKtZSIg=,tag:/NB6UnF+ufF1FZfnJZW+wg==,type:str] + authorized: ENC[AES256_GCM,data:EiZqJTpmjTs5vMmu5IZjpXS8ClcCz7cmnW56gTfBKU36MJc2gLkyg5SaPxpgDJFHi/zX39W7SQ96QCqQRNZyid/t334Bxau8DvcDIveBSGVanw+36DXAK/9SqMJs1mnjQHO5uzuTfzsHjXcDMSOJFs0kthGrL/s0mgZfcVWRcJQoXnaugbRnkRskuHSsF24TaZz5ZWmRDVATifabwblpFvxq,iv:H1XZKm/JO3jP++ZkUVW7GtEQ0K50HCsKg+mZMZgprMY=,tag:0bQVbLhNiIQH8aJLFVPZCg==,type:str] syncthing: cert.pem: ENC[AES256_GCM,data:2a+d67lXxj3Vo0JyJO1xjnrXbPj9qN4CrJn+oyr7PLrNwnsWuAkH1dIMcEvWqL1jENc+Joqkt9ksqXP0QFSDPtM30UZGgTUh7XeFH3D1iUroBBDqmCdYK41au4Y5LIaNSpW8eBaNGKHTh1jMV1aJqjcssfyVcRpI6D6etZQ0pQSb1AhVtiNE2Gkt1+10BK0B5IxmAu4FYe7fIKFAfyoQolW3JnHRO7JTILIumSS7w2LHll7ZHVZ6U1jh96awua1CpsbYM3LdZWyDcPfD9NQLAerO/woNnPoCHttVZxMvUKtfNWfgnOcX0sXaliVF1q0J3VsXHCOEB40b3flp0omTFrMGJecQua0qp0mFQzkTbgiu53tHypF2EOheJVdAZMv6hmeqL1yHhWGXvq12USwH6mvrUu9eI6/7cKIv3HXyD0mdT3BMC8eSzWagtwPMBf1tXFSeKUm+U6MpaSMq9XA0lCDQlGA+vNz2jusaUoQI1fj6NuqzKaBAJsbGVSWSN2rzBIXwL8w/PhjcULqNHaBHXUjSVWtSAmp9uYgG8zce2FZaR5LbqvJKYJpQKpAQCmk9lJ44CrE9EL6u1z1gyvMQtRyCGTZ5gTgHgRO67uM7/USoMlNFfGIitovEpSJZbPTa7biXCqCvXWDLAcxwMrJl3EpZ/w8VP1NFuXj8JUOh+NbzBvvwkVZQHxQaj6auOQoUwoPmYR8xjXQATBCklQytw1WTqJJOVNwNu45Q9hOzh2JjI2vPHkVYVrhdkskOWvEZMkK5zYZ22lI/9hxxufLUlG2qoUj9to0ACXLZihMdaQdemnGPFQ7VbNdQdSBeqOn7Q6MJ4VMfceZ/7MJRzyP3rSyCsab4Gq5GkNHU5RHlu7t429OBzFTb4gEpRIkXCiewndtbkW87RRoAuw3YLpc8nSF148nLxhlJpqp5YcvVca8DEluLvE0nKT2xyEPc6TrYrxI8vXBF8QGBJgNQ3xyLWoobOFBPFRh/CtF8OBcf2T6Q+qpNzaawG8fAz6FCLd2Qn1zjrZmRYAuFkKTLmhCZ5GQdBkwFLAIZxGw=,iv:FBTiEZfBxMURQT0B3razM4pQ4cz7xGzsjZ7b8FjbhIU=,tag:UMx6Q6Vy8yaTPk2IOrPuUA==,type:str] key.pem: ENC[AES256_GCM,data:66pGKtg2NZajHYKfUsm9fgItbeBeXf6pfsuBOhFkwhFM1AMATwRu1WEHQjD754Z5CC04vQhLONgwbTze6R+1mJJ3wEHjgrTA7v+agSgFfyQLZMV8YRH8eIbG4BLcr9afO84ahqZcWAH/ldFhZeC90nepHK2Lz0+zVIvKsGOPM45OU6Yypjr8FVTVinRr0yJpBgOciJTsZtFqnU2TFJxRoZuOTnTCrO2Kywg+rk1c7augAi30iljZx6Nfi24pBCrcwMeSkiT6uyAhkgiJH6XiIT3V7S/++krsijiTKqV2gqj6zgnE2aUQpinxTSMSj3V9+Hs9AMHdubjV+wb0Tm78m2Hev5iJ0f2gpVufadFCAjcy1ZPttfjBoZ26lOlKF16V,iv:0ewtb+t8woztUvr7XPE0gr94X97hnOaT0LomsmA3dQ0=,tag:0OBaQNkfrd3WQI9JBq15Ug==,type:str] sops: age: - - recipient: age1mqw75xvd2gnhx2wsmkr8yctegjfym6xkypwjh82s3yws2glk4vms3cxqaz - enc: | + - enc: | -----BEGIN AGE ENCRYPTED FILE----- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWaEN6bTVUakYzNE5lbm8x Z1hBbnlNVDNGcHV4b0VhL2hibGl0ZVh0VWgwClJnWWVvNm0yZ2Y3a0FqYVdwUTNK @@ -18,8 +17,9 @@ sops: cFV0ZkliUHpKdEsyU0dEQUdNZ0kzb0UKSHUzMLKwB0s2CimzsIbktvng7dDReOzT ygaLq22ZrYvb1etPyroaJA1M5hzNo2VnCMVqa7vUbu/5ZHVLxW9n6Q== -----END AGE ENCRYPTED FILE----- - lastmodified: "2025-08-21T19:25:06Z" - mac: ENC[AES256_GCM,data:MyUPAGFMhDALKcnZSHfThL2vQjA7twVStiZh5/YiCniBgQ9xcmQD4qgvUICHEmc4jS7kzZKJPWUGHVBIXHCSeK4uqHz8ApTpBdwpWW5+CZXKeQy8MRtQWq1p8ZhC5oTzaXZiBbmo74x4BL+26JltFPGCN7+NWsF7Kw/8bfCN7Ks=,iv:0SRJyoiQdotOZMY9sQc/dVvuOaCCx0ohj8ePZSjApHA=,tag:JOFwuyfkaiBaC+TS4a8NLw==,type:str] + recipient: age1mqw75xvd2gnhx2wsmkr8yctegjfym6xkypwjh82s3yws2glk4vms3cxqaz + lastmodified: "2026-06-21T12:38:49Z" + mac: ENC[AES256_GCM,data:aqRBNgibtgD4shlz2Y5Ha08nCnqH9TMlRmx36hw/c+N62oR+0W5duiI2gLf7weq+VvJxcF0FTr3GlM4iIVgcmbCukAMmHFO/7yTKFo7bn08EB+WwoPAunRj6a19Dtu2hGhk4UrJa4IA2YaKn7Tc8gZ8Zjf86UZzpJOG2djDdfu0=,iv:Syht6Iyd0SyxOiu94/zXoLNzFNbJUDj0wRsH8s9QjUY=,tag:2MVGIXLj720gaxq+np1/ww==,type:str] pgp: - created_at: "2024-06-07T11:56:01Z" enc: |- @@ -34,4 +34,4 @@ sops: -----END PGP MESSAGE----- fp: 3586D8D6689B9C9ECD598C588712A0F317C37175 unencrypted_suffix: _unencrypted - version: 3.10.2 + version: 3.13.1 diff --git a/server/wireguard.nix b/server/wireguard.nix index 6577076..ea10600 100644 --- a/server/wireguard.nix +++ b/server/wireguard.nix @@ -1,11 +1,10 @@ -{ config, lib, ... }: -{ +{ config, lib, ... }: { options.server.wireguard-bridge.enable = lib.mkEnableOption "Enables Wireguard host functionality"; options.server.wireguard-bridge.ip = lib.mkOption { }; config = lib.mkIf config.server.wireguard-bridge.enable { sops.secrets."wireguard/bridge/private" = { - sopsFile = ../hosts/${config.networking.hostName}/secrets/default.yaml; + sopsFile = ../hosts/${config.networking.hostName}/secrets/networking.yaml; }; networking.firewall.allowedUDPPorts = [ 51821 ]; diff --git a/system/core/ssh.nix b/system/core/ssh.nix index fd2e066..6e11231 100644 --- a/system/core/ssh.nix +++ b/system/core/ssh.nix @@ -1,5 +1,4 @@ -{ ... }: -{ +{ ... }: { networking.firewall.allowedTCPPorts = [ 22 ]; sops.secrets."ssh/nixremote/private" = { @@ -22,12 +21,22 @@ Host lilith-server-builder HostName firelilith.org User nixremote - IdentityFile /home/lilith/.ssh/nixremote + IdentityFile /root/.ssh/nixremote ConnectTimeout 5 Host lilith-pc-builder HostName lilith-pc User nixremote - IdentityFile /home/lilith/.ssh/nixremote + IdentityFile /root/.ssh/nixremote + ConnectTimeout 5 + Host lilith-lab-builder + HostName lilith-lab + User nixremote + IdentityFile /root/.ssh/nixremote + ConnectTimeout 5 + Host lilith-pad-builder + HostName lilith-pad + User nixremote + IdentityFile /root/.ssh/nixremote ConnectTimeout 5 ''; }; diff --git a/system/core/users.nix b/system/core/users.nix index c261b99..07ead61 100644 --- a/system/core/users.nix +++ b/system/core/users.nix @@ -14,7 +14,12 @@ in ]; hashedPasswordFile = config.sops.secrets."user/password".path; - # openssh.authorizedKeys.keyFiles = [ config.sops.secrets."user/ssh/authorized" ]; + # mistake in openssh module, using a keyfile here tries to read file at compile time + # openssh.authorizedKeys.keyFiles = [ config.sops.secrets."user/ssh/authorized".path ]; + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJaDyGTHTfzJ+soNsOfUiboKYRJxPAK+KspcUNwWWU0q" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHlt34e/9Im6AM8qjYWM+psPQEVTQVSDHNx6wrTDLbLD" + ]; }; nixremote = {