swarsel/.dotfiles
1
0
Fork 0
mirror of https://github.com/Swarsel/.dotfiles.git synced 2026-04-14 13:19:09 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix[server]: remote disk unlock breaking

Browse source
This commit is contained in:
Leon Schwarzäugl 2025-12-23 01:56:26 +01:00 • committed by Leon Schwarzäugl
parent b06c19c52b
commit 2d2cb3c8fe
8 changed files with 48 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

47
SwarselSystems.org
View file

@ -6271,7 +6271,6 @@ A breakdown of the flags being set:
additions = final: _: import "${self}/pkgs/config" { additions = final: _: import "${self}/pkgs/config" {
inherit self config lib; inherit self config lib;
pkgs = final; pkgs = final;
nixosConfig = config;
homeConfig = config.home-manager.users.${config.swarselsystems.mainUser}; homeConfig = config.home-manager.users.${config.swarselsystems.mainUser};
}; };
in in
@ -9044,6 +9043,11 @@ lspci -k -d 14c3:0616
"/persist/${hostKeyPathBase}" "/persist/${hostKeyPathBase}"
else else
"${hostKeyPathBase}"; "${hostKeyPathBase}";
# this key is only used only for ssh to stage 1 in initial provisioning (in nix store)
generatedHostKey = pkgs.runCommand "initrd-hostkey" { } ''
${pkgs.openssh}/bin/ssh-keygen -t ed25519 -N "" -f $out
'';
in in
{ {
options.swarselmodules.server.diskEncryption = lib.mkEnableOption "enable disk encryption config"; options.swarselmodules.server.diskEncryption = lib.mkEnableOption "enable disk encryption config";
@ -9054,15 +9058,15 @@ lspci -k -d 14c3:0616
config = lib.mkIf (config.swarselmodules.server.diskEncryption && config.swarselsystems.isCrypted) { config = lib.mkIf (config.swarselmodules.server.diskEncryption && config.swarselsystems.isCrypted) {
system.activationScripts."createPersistentStorageDirs" = lib.mkIf config.swarselsystems.isImpermanence { # as soon as we hit a stable system, we will use a persisted key
deps = [ "ensureInitrdHostkey" ]; # @future me: dont mkIf this to minimal, we need to create this as soon as possible
}; system.activationScripts.ensureInitrdHostkey = {
system.activationScripts.ensureInitrdHostkey = lib.mkIf (config.swarselprofiles.server || minimal) {
text = '' text = ''
[[ -e ${hostKeyPath} ]] || ${pkgs.openssh}/bin/ssh-keygen -t ed25519 -N "" -f ${hostKeyPath} [[ -e ${hostKeyPath} ]] || ${pkgs.openssh}/bin/ssh-keygen -t ed25519 -N "" -f ${hostKeyPath}
''; '';
deps = [ deps = [
"etc" "users"
"createPersistentStorageDirs"
]; ];
}; };
@ -9075,7 +9079,7 @@ lspci -k -d 14c3:0616
"ip=${localIp}::${gatewayIp}:${subnetMask}:${config.networking.hostName}::none" "ip=${localIp}::${gatewayIp}:${subnetMask}:${config.networking.hostName}::none"
]; ];
initrd = { initrd = {
secrets."${hostKeyPathBase}" = lib.mkIf (!minimal) hostKeyPathBase; secrets."/tmp${hostKeyPathBase}" = if minimal then (lib.mkForce generatedHostKey) else (lib.mkForce hostKeyPath); # need to mkForce this or it behaves stateful
availableKernelModules = config.swarselsystems.networkKernelModules; availableKernelModules = config.swarselsystems.networkKernelModules;
network = { network = {
enable = true; enable = true;
@ -9087,11 +9091,8 @@ lspci -k -d 14c3:0616
''command="/bin/systemctl default" ${builtins.readFile "${self}/secrets/public/ssh/yubikey.pub"}'' ''command="/bin/systemctl default" ${builtins.readFile "${self}/secrets/public/ssh/yubikey.pub"}''
''command="/bin/systemctl default" ${builtins.readFile "${self}/secrets/public/ssh/magicant.pub"}'' ''command="/bin/systemctl default" ${builtins.readFile "${self}/secrets/public/ssh/magicant.pub"}''
]; ];
hostKeys = [ hostKeyPathBase ]; hostKeys = [ "/tmp${hostKeyPathBase}" ]; # use a tmp file otherwise persist mount will be unhappy
}; };
# postCommands = ''
# echo 'cryptsetup-askpass || echo "Unlock was successful; exiting SSH session" && exit 1' >> /root/.profile
# '';
}; };
systemd = { systemd = {
initrdBin = with pkgs; [ initrdBin = with pkgs; [
@ -16107,9 +16108,9 @@ It is very convenient to have SSH aliases in place for machines that I use. This
serverAliveCountMax = 3; serverAliveCountMax = 3;
hashKnownHosts = false; hashKnownHosts = false;
userKnownHostsFile = "~/.ssh/known_hosts"; userKnownHostsFile = "~/.ssh/known_hosts";
controlMaster = "auto"; controlMaster = "no";
controlPath = "~/.ssh/master-%r@%n:%p"; controlPath = "~/.ssh/master-%r@%n:%p";
controlPersist = "5m"; controlPersist = "no";
}; };
} // confLib.getConfig.repo.secrets.common.ssh.hosts; } // confLib.getConfig.repo.secrets.common.ssh.hosts;
}; };
@ -23575,10 +23576,10 @@ This program sets up a new NixOS host remotely. It also takes care of secret man
mkdir -p "$FLAKE"/hosts/nixos/"$target_arch"/"$target_hostname" mkdir -p "$FLAKE"/hosts/nixos/"$target_arch"/"$target_hostname"
$scp_cmd root@"$target_destination":/mnt/etc/nixos/hardware-configuration.nix "${git_root}"/hosts/nixos/"$target_arch"/"$target_hostname"/hardware-configuration.nix $scp_cmd root@"$target_destination":/mnt/etc/nixos/hardware-configuration.nix "${git_root}"/hosts/nixos/"$target_arch"/"$target_hostname"/hardware-configuration.nix
# ------------------------ # ------------------------
# green "Generating hostkey for ssh initrd" green "Generating hostkey for ssh initrd"
# $ssh_root_cmd "mkdir -p $temp/etc/secrets/initrd /etc/secrets/initrd" $ssh_root_cmd "mkdir -p $temp/etc/secrets/initrd /etc/secrets/initrd"
# $ssh_root_cmd "ssh-keygen -t ed25519 -N '' -f $temp/etc/secrets/initrd/ssh_host_ed25519_key" $ssh_root_cmd "ssh-keygen -t ed25519 -N '' -f $temp/etc/secrets/initrd/ssh_host_ed25519_key"
# $ssh_root_cmd "cp $temp/etc/secrets/initrd/ssh_host_ed25519_key /etc/secrets/initrd/ssh_host_ed25519_key" $ssh_root_cmd "cp $temp/etc/secrets/initrd/ssh_host_ed25519_key /etc/secrets/initrd/ssh_host_ed25519_key"
# ------------------------ # ------------------------
green "Deploying minimal NixOS installation on $target_destination" green "Deploying minimal NixOS installation on $target_destination"
@ -24733,12 +24734,12 @@ This script allows for quick git replace of a string.
:END: :END:
#+begin_src nix-ts :tangle pkgs/config/default.nix #+begin_src nix-ts :tangle pkgs/config/default.nix
{ self, homeConfig, lib, pkgs, nixosConfig ? null, ... }: { self, homeConfig, lib, pkgs, config, ... }:
let let
mkPackages = names: pkgs: builtins.listToAttrs (map mkPackages = names: pkgs: builtins.listToAttrs (map
(name: { (name: {
inherit name; inherit name;
value = pkgs.callPackage "${self}/pkgs/config/${name}" { inherit self name homeConfig nixosConfig; }; value = pkgs.callPackage "${self}/pkgs/config/${name}" { inherit self name homeConfig config; };
}) })
names); names);
packageNames = lib.swarselsystems.readNix "pkgs/config"; packageNames = lib.swarselsystems.readNix "pkgs/config";
@ -24775,11 +24776,11 @@ This script allows for quick git replace of a string.
This script quickly lists all nix generatinos on the system This script quickly lists all nix generatinos on the system
#+begin_src nix-ts :tangle pkgs/config/swarsel-gens/default.nix #+begin_src nix-ts :tangle pkgs/config/swarsel-gens/default.nix
{ name, writeShellApplication, nixosConfig, ... }: { name, writeShellApplication, config, ... }:
writeShellApplication { writeShellApplication {
inherit name; inherit name;
runtimeInputs = [ nixosConfig.nix.package ]; runtimeInputs = [ config.nix.package ];
text = '' text = ''
sudo nix-env --list-generations --profile /nix/var/nix/profiles/system sudo nix-env --list-generations --profile /nix/var/nix/profiles/system
''; '';
@ -24793,11 +24794,11 @@ This script quickly lists all nix generatinos on the system
This script quickly switches to another nix generation. This script quickly switches to another nix generation.
#+begin_src nix-ts :tangle pkgs/config/swarsel-switch/default.nix #+begin_src nix-ts :tangle pkgs/config/swarsel-switch/default.nix
{ name, writeShellApplication, nixosConfig, ... }: { name, writeShellApplication, config, ... }:
writeShellApplication { writeShellApplication {
inherit name; inherit name;
runtimeInputs = [ nixosConfig.nix.package ]; runtimeInputs = [ config.nix.package ];
text = '' text = ''
sudo nix-env --switch-generation "$1" -p /nix/var/nix/profiles/system && sudo /nix/var/nix/profiles/system/bin/switch-to-configuration switch sudo nix-env --switch-generation "$1" -p /nix/var/nix/profiles/system && sudo /nix/var/nix/profiles/system/bin/switch-to-configuration switch
''; '';

8
files/scripts/swarsel-bootstrap.sh
View file

@ -245,10 +245,10 @@ $ssh_root_cmd "nixos-generate-config --force --no-filesystems --root /mnt"
mkdir -p "$FLAKE"/hosts/nixos/"$target_arch"/"$target_hostname" mkdir -p "$FLAKE"/hosts/nixos/"$target_arch"/"$target_hostname"
$scp_cmd root@"$target_destination":/mnt/etc/nixos/hardware-configuration.nix "${git_root}"/hosts/nixos/"$target_arch"/"$target_hostname"/hardware-configuration.nix $scp_cmd root@"$target_destination":/mnt/etc/nixos/hardware-configuration.nix "${git_root}"/hosts/nixos/"$target_arch"/"$target_hostname"/hardware-configuration.nix
# ------------------------ # ------------------------
# green "Generating hostkey for ssh initrd" green "Generating hostkey for ssh initrd"
# $ssh_root_cmd "mkdir -p $temp/etc/secrets/initrd /etc/secrets/initrd" $ssh_root_cmd "mkdir -p $temp/etc/secrets/initrd /etc/secrets/initrd"
# $ssh_root_cmd "ssh-keygen -t ed25519 -N '' -f $temp/etc/secrets/initrd/ssh_host_ed25519_key" $ssh_root_cmd "ssh-keygen -t ed25519 -N '' -f $temp/etc/secrets/initrd/ssh_host_ed25519_key"
# $ssh_root_cmd "cp $temp/etc/secrets/initrd/ssh_host_ed25519_key /etc/secrets/initrd/ssh_host_ed25519_key" $ssh_root_cmd "cp $temp/etc/secrets/initrd/ssh_host_ed25519_key /etc/secrets/initrd/ssh_host_ed25519_key"
# ------------------------ # ------------------------
green "Deploying minimal NixOS installation on $target_destination" green "Deploying minimal NixOS installation on $target_destination"

4
modules/home/common/ssh.nix
View file

@ -18,9 +18,9 @@
serverAliveCountMax = 3; serverAliveCountMax = 3;
hashKnownHosts = false; hashKnownHosts = false;
userKnownHostsFile = "~/.ssh/known_hosts"; userKnownHostsFile = "~/.ssh/known_hosts";
controlMaster = "auto"; controlMaster = "no";
controlPath = "~/.ssh/master-%r@%n:%p"; controlPath = "~/.ssh/master-%r@%n:%p";
controlPersist = "5m"; controlPersist = "no";
}; };
} // confLib.getConfig.repo.secrets.common.ssh.hosts; } // confLib.getConfig.repo.secrets.common.ssh.hosts;
}; };

1
modules/nixos/common/settings.nix
View file

@ -127,7 +127,6 @@ in
additions = final: _: import "${self}/pkgs/config" { additions = final: _: import "${self}/pkgs/config" {
inherit self config lib; inherit self config lib;
pkgs = final; pkgs = final;
nixosConfig = config;
homeConfig = config.home-manager.users.${config.swarselsystems.mainUser}; homeConfig = config.home-manager.users.${config.swarselsystems.mainUser};
}; };
in in

22
modules/nixos/server/disk-encrypt.nix
View file

@ -10,6 +10,11 @@ let
"/persist/${hostKeyPathBase}" "/persist/${hostKeyPathBase}"
else else
"${hostKeyPathBase}"; "${hostKeyPathBase}";
# this key is only used only for ssh to stage 1 in initial provisioning (in nix store)
generatedHostKey = pkgs.runCommand "initrd-hostkey" { } ''
${pkgs.openssh}/bin/ssh-keygen -t ed25519 -N "" -f $out
'';
in in
{ {
options.swarselmodules.server.diskEncryption = lib.mkEnableOption "enable disk encryption config"; options.swarselmodules.server.diskEncryption = lib.mkEnableOption "enable disk encryption config";
@ -20,15 +25,15 @@ in
config = lib.mkIf (config.swarselmodules.server.diskEncryption && config.swarselsystems.isCrypted) { config = lib.mkIf (config.swarselmodules.server.diskEncryption && config.swarselsystems.isCrypted) {
system.activationScripts."createPersistentStorageDirs" = lib.mkIf config.swarselsystems.isImpermanence { # as soon as we hit a stable system, we will use a persisted key
deps = [ "ensureInitrdHostkey" ]; # @future me: dont mkIf this to minimal, we need to create this as soon as possible
}; system.activationScripts.ensureInitrdHostkey = {
system.activationScripts.ensureInitrdHostkey = lib.mkIf (config.swarselprofiles.server || minimal) {
text = '' text = ''
[[ -e ${hostKeyPath} ]] || ${pkgs.openssh}/bin/ssh-keygen -t ed25519 -N "" -f ${hostKeyPath} [[ -e ${hostKeyPath} ]] || ${pkgs.openssh}/bin/ssh-keygen -t ed25519 -N "" -f ${hostKeyPath}
''; '';
deps = [ deps = [
"etc" "users"
"createPersistentStorageDirs"
]; ];
}; };
@ -41,7 +46,7 @@ in
"ip=${localIp}::${gatewayIp}:${subnetMask}:${config.networking.hostName}::none" "ip=${localIp}::${gatewayIp}:${subnetMask}:${config.networking.hostName}::none"
]; ];
initrd = { initrd = {
secrets."${hostKeyPathBase}" = lib.mkIf (!minimal) hostKeyPathBase; secrets."/tmp${hostKeyPathBase}" = if minimal then (lib.mkForce generatedHostKey) else (lib.mkForce hostKeyPath); # need to mkForce this or it behaves stateful
availableKernelModules = config.swarselsystems.networkKernelModules; availableKernelModules = config.swarselsystems.networkKernelModules;
network = { network = {
enable = true; enable = true;
@ -53,11 +58,8 @@ in
''command="/bin/systemctl default" ${builtins.readFile "${self}/secrets/public/ssh/yubikey.pub"}'' ''command="/bin/systemctl default" ${builtins.readFile "${self}/secrets/public/ssh/yubikey.pub"}''
''command="/bin/systemctl default" ${builtins.readFile "${self}/secrets/public/ssh/magicant.pub"}'' ''command="/bin/systemctl default" ${builtins.readFile "${self}/secrets/public/ssh/magicant.pub"}''
]; ];
hostKeys = [ hostKeyPathBase ]; hostKeys = [ "/tmp${hostKeyPathBase}" ]; # use a tmp file otherwise persist mount will be unhappy
}; };
# postCommands = ''
# echo 'cryptsetup-askpass || echo "Unlock was successful; exiting SSH session" && exit 1' >> /root/.profile
# '';
}; };
systemd = { systemd = {
initrdBin = with pkgs; [ initrdBin = with pkgs; [

4
pkgs/config/default.nix
View file

@ -1,9 +1,9 @@
{ self, homeConfig, lib, pkgs, nixosConfig ? null, ... }: { self, homeConfig, lib, pkgs, config, ... }:
let let
mkPackages = names: pkgs: builtins.listToAttrs (map mkPackages = names: pkgs: builtins.listToAttrs (map
(name: { (name: {
inherit name; inherit name;
value = pkgs.callPackage "${self}/pkgs/config/${name}" { inherit self name homeConfig nixosConfig; }; value = pkgs.callPackage "${self}/pkgs/config/${name}" { inherit self name homeConfig config; };
}) })
names); names);
packageNames = lib.swarselsystems.readNix "pkgs/config"; packageNames = lib.swarselsystems.readNix "pkgs/config";

4
pkgs/config/swarsel-gens/default.nix
View file

@ -1,8 +1,8 @@
{ name, writeShellApplication, nixosConfig, ... }: { name, writeShellApplication, config, ... }:
writeShellApplication { writeShellApplication {
inherit name; inherit name;
runtimeInputs = [ nixosConfig.nix.package ]; runtimeInputs = [ config.nix.package ];
text = '' text = ''
sudo nix-env --list-generations --profile /nix/var/nix/profiles/system sudo nix-env --list-generations --profile /nix/var/nix/profiles/system
''; '';

4
pkgs/config/swarsel-switch/default.nix
View file

@ -1,8 +1,8 @@
{ name, writeShellApplication, nixosConfig, ... }: { name, writeShellApplication, config, ... }:
writeShellApplication { writeShellApplication {
inherit name; inherit name;
runtimeInputs = [ nixosConfig.nix.package ]; runtimeInputs = [ config.nix.package ];
text = '' text = ''
sudo nix-env --switch-generation "$1" -p /nix/var/nix/profiles/system && sudo /nix/var/nix/profiles/system/bin/switch-to-configuration switch sudo nix-env --switch-generation "$1" -p /nix/var/nix/profiles/system && sudo /nix/var/nix/profiles/system/bin/switch-to-configuration switch
''; '';