prescientmoon/satellite
1
Fork 0
Code Activity

Fix ssh permissions (take 3)

Browse source
This commit is contained in:
prescientmoon 2024-08-27 23:28:37 +02:00
parent e3147858c3
commit b6118974ec
Signed by: prescientmoon
SSH key fingerprint: SHA256:UUF9JT2s8Xfyv76b8ZuVL7XrmimH4o49p4b+iexbVH4
2 changed files with 21 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
home/features/cli/ssh.nix
View file

@ -1,15 +1,5 @@
{ config, ... }: { config, ... }:
{ {
programs.ssh.enable = true; programs.ssh.enable = true;
satellite.persistence.at.state.apps.ssh.directories = [ ".ssh" ]; satellite.persistence.at.state.apps.ssh.directories = [ ".ssh" ];
systemd.user.tmpfiles.rules =
let
ssh = "${config.satellite.persistence.at.state.home}/ssh/.ssh";
in
[
"d ${ssh} 0755 ${config.home.username} users"
"e ${ssh}/id_rsa 0700 ${config.home.username} users"
"e ${ssh}/id_ed25519 0700 ${config.home.username} users"
];
} }

21
hosts/nixos/common/users/pilot.nix
View file

@ -6,17 +6,22 @@
... ...
}: }:
{ {
# This is it's own attribute in order to prevent infinite recursion
# in certain places.
satellite.pilot.name = lib.mkDefault "adrielus"; satellite.pilot.name = lib.mkDefault "adrielus";
# {{{ Password handling
sops.secrets.pilot_password = { sops.secrets.pilot_password = {
sopsFile = ../secrets.yaml; sopsFile = ../secrets.yaml;
neededForUsers = true; neededForUsers = true;
}; };
# }}}
users = { users = {
# Configure users through nix only # Configure users through nix only
mutableUsers = false; mutableUsers = false;
# {{{ Create pilot user
users.pilot = { users.pilot = {
inherit (config.satellite.pilot) name; inherit (config.satellite.pilot) name;
@ -44,5 +49,21 @@
openssh.authorizedKeys.keyFiles = (import ./common.nix).authorizedKeys { inherit outputs lib; }; openssh.authorizedKeys.keyFiles = (import ./common.nix).authorizedKeys { inherit outputs lib; };
}; };
# }}}
}; };
# {{{ Set user-specific ssh permissions
# This is mainly useful because home-manager can often fail if the perms on
# `~/.ssh` are incorrect.
systemd.tmpfiles.rules =
let
user = config.users.users.pilot;
ssh = "/persist/state/${user.home}/ssh/.ssh";
in
[
"d ${ssh} 0755 ${user.name} ${user.group}"
"e ${ssh}/id_rsa 0700 ${user.name} ${user.group}"
"e ${ssh}/id_ed25519 0700 ${user.name} ${user.group}"
];
# }}}
} }