min
/
infra
1
0
Fork 0
Code Issues 6 Pull Requests Packages Projects Releases Wiki Activity

Luks SSH cleanup + disable console on eidola

This commit is contained in:
minish 2024-12-14 21:14:37 -05:00
parent 134d049a7b
commit a077e98cf3
Signed by: min
SSH Key Fingerprint: SHA256:NFjjdbkd6u7aoMlcrDCVvz6o2UBtlAuPm8IQ2vhZ3Fg
3 changed files with 18 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
nixos/hosts/eidola/configuration.nix
View File

@ -70,12 +70,13 @@
# My modules
gen.hardening.disableSack = true;
gen.hardening.disableConsole = true;
gen.bootloader.luksSsh = {
enable = true;
useDhcp = true;
port = 48722;
hostKeys = ["/persist/etc/secrets/initrd/ssh_host_ed25519_key"];
};
boot.initrd.network.udhcpc.enable = true;
system.stateVersion = "24.05";
}

1
nixos/hosts/silver/configuration.nix
View File

@ -101,6 +101,7 @@ in {
gen.hardening.disableSack = true;
gen.bootloader.luksSsh = {
enable = true;
useDhcp = false;
port = 48722;
hostKeys = ["/persist/etc/secrets/initrd/ssh_host_ed25519_key"];
};

41
nixos/modules/boot/luks-ssh.nix
View File

@ -8,7 +8,8 @@ with lib; let
cfg = baseCfg.luksSsh;
in {
options.gen.bootloader.luksSsh = {
enable = mkEnableOption "use boot process with luks unlock over ssh";
enable = mkEnableOption "boot process with luks unlock over ssh";
useDhcp = mkEnableOption "dhcp";
port = mkOption {
type = types.port;
description = "port for ssh server to listen on";
@ -20,34 +21,22 @@ in {
};
config = mkIf cfg.enable {
# ### Use systemd-boot ###
# boot.loader = {
# efi.canTouchEfiVariables = true;
# timeout = 2;
# systemd-boot = {
# enable = true;
# configurationLimit = 3;
# };
# };
### LUKS unlock through SSH ###
boot.initrd = {
network = {
boot.initrd.network = {
enable = true;
flushBeforeStage2 = true;
udhcpc.enable = cfg.useDhcp;
ssh = {
enable = true;
flushBeforeStage2 = true;
ssh = {
enable = true;
authorizedKeys = import ../../keys/ssh.nix;
inherit (cfg) hostKeys port;
};
postCommands = ''
# Automatically ask for the password on SSH login
echo 'cryptsetup-askpass || echo "Unlock was successful; exiting SSH session" && exit 1' >> /root/.profile
'';
authorizedKeys = import ../../keys/ssh.nix;
inherit (cfg) hostKeys port;
};
postCommands = ''
# Automatically ask for the password on SSH login
echo 'cryptsetup-askpass || echo "Unlock was successful; exiting SSH session" && exit 1' >> /root/.profile
'';
};
};
}