min
/
infra
1
0
Fork 0
Code Issues 6 Pull Requests Packages Projects Releases Wiki Activity

Luks SSH cleanup + disable console on eidola

This commit is contained in:
minish 2024-12-14 21:14:37 -05:00
parent 134d049a7b
commit a077e98cf3
Signed by: min
SSH Key Fingerprint: SHA256:NFjjdbkd6u7aoMlcrDCVvz6o2UBtlAuPm8IQ2vhZ3Fg
3 changed files with 18 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
nixos/hosts/eidola/configuration.nix
View File

@ -70,12 +70,13 @@
# My modules # My modules
gen.hardening.disableSack = true; gen.hardening.disableSack = true;
gen.hardening.disableConsole = true;
gen.bootloader.luksSsh = { gen.bootloader.luksSsh = {
enable = true; enable = true;
useDhcp = true;
port = 48722; port = 48722;
hostKeys = ["/persist/etc/secrets/initrd/ssh_host_ed25519_key"]; hostKeys = ["/persist/etc/secrets/initrd/ssh_host_ed25519_key"];
}; };
boot.initrd.network.udhcpc.enable = true;
system.stateVersion = "24.05"; system.stateVersion = "24.05";
} }

1
nixos/hosts/silver/configuration.nix
View File

@ -101,6 +101,7 @@ in {
gen.hardening.disableSack = true; gen.hardening.disableSack = true;
gen.bootloader.luksSsh = { gen.bootloader.luksSsh = {
enable = true; enable = true;
useDhcp = false;
port = 48722; port = 48722;
hostKeys = ["/persist/etc/secrets/initrd/ssh_host_ed25519_key"]; hostKeys = ["/persist/etc/secrets/initrd/ssh_host_ed25519_key"];
}; };

19
nixos/modules/boot/luks-ssh.nix
View File

@ -8,7 +8,8 @@ with lib; let
cfg = baseCfg.luksSsh; cfg = baseCfg.luksSsh;
in { in {
options.gen.bootloader.luksSsh = { options.gen.bootloader.luksSsh = {
enable = mkEnableOption "use boot process with luks unlock over ssh"; enable = mkEnableOption "boot process with luks unlock over ssh";
useDhcp = mkEnableOption "dhcp";
port = mkOption { port = mkOption {
type = types.port; type = types.port;
description = "port for ssh server to listen on"; description = "port for ssh server to listen on";
@ -20,22 +21,11 @@ in {
}; };
config = mkIf cfg.enable { config = mkIf cfg.enable {
# ### Use systemd-boot ###
# boot.loader = {
# efi.canTouchEfiVariables = true;
# timeout = 2;
# systemd-boot = {
# enable = true;
# configurationLimit = 3;
# };
# };
### LUKS unlock through SSH ### ### LUKS unlock through SSH ###
boot.initrd = { boot.initrd.network = {
network = {
enable = true; enable = true;
flushBeforeStage2 = true; flushBeforeStage2 = true;
udhcpc.enable = cfg.useDhcp;
ssh = { ssh = {
enable = true; enable = true;
@ -49,5 +39,4 @@ in {
''; '';
}; };
}; };
};
} }