diff options
Diffstat (limited to 'os/srv/ssh.nix')
| -rw-r--r-- | os/srv/ssh.nix | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/os/srv/ssh.nix b/os/srv/ssh.nix index 2c7a4ac..ec39bbd 100644 --- a/os/srv/ssh.nix +++ b/os/srv/ssh.nix @@ -12,6 +12,7 @@ in options.os.srv.ssh = { server = { enable = lib.mkEnableOption "enables the ssh server module"; + enableInitrd = lib.mkEnableOption "enables ssh access during initrd"; enableWireguard = lib.mkEnableOption "only allows connections from wireguard"; }; client = { @@ -44,6 +45,35 @@ in users.users.${username}.openssh.authorizedKeys.keys = [ "${keys.main} adikro@disroot.org" ]; + + }) + (lib.mkIf (cfg.server.enable && cfg.server.enableInitrd) { + assertions = [ + { + assertion = config.os.srv.sops.enable; + message = "required for storing the ssh key"; + } + ]; + sops.secrets."initrd_ssh_key" = { + path = "/etc/secrets/initrd/ssh_host_ed25519_key"; + }; + boot = { + initrd = { + secrets = { + "/etc/secrets/initrd/ssh_host_ed25519_key" = config.sops.secrets.initrd_ssh_key.path; + }; + network = { + enable = true; + ssh = { + enable = true; + port = 2222; + authorizedKeys = [ "${keys.main}" ]; + hostKeys = [ "/etc/secrets/initrd/ssh_host_ed25519_key" ]; + }; + }; + }; + kernelParams = [ "ip=dhcp" ]; + }; }) (lib.mkIf (cfg.server.enable && cfg.server.enableWireguard) { services.openssh.listenAddresses = [ |