e703bd374d
Remote rebuilding requires root access, but I don't want root ssh access (even by ssh key) to be a permanent fixture of my servers. So I've changed 'hey push' to copy my remote user's `authorized_keys` to /root/.ssh/ temporarily, until the rebuild is complete. It is removed afterwards. This should be done non-destructively in the future, but it suits my needs for now.
24 lines
556 B
Nix
24 lines
556 B
Nix
{ options, config, lib, ... }:
|
|
|
|
with lib;
|
|
with lib.my;
|
|
let cfg = config.modules.services.ssh;
|
|
in {
|
|
options.modules.services.ssh = {
|
|
enable = mkBoolOpt false;
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
services.openssh = {
|
|
enable = true;
|
|
challengeResponseAuthentication = false;
|
|
passwordAuthentication = false;
|
|
};
|
|
|
|
user.openssh.authorizedKeys.keys =
|
|
if config.user.name == "hlissner"
|
|
then [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB71rSnjuC06Qq3NLXQJwSz7jazoB+umydddrxL6vg1a henrik@lissner.net" ]
|
|
else [];
|
|
};
|
|
}
|