kfearsoff/infra
0
0
Fork 0
forked from the-distro/infra
Code Pull requests Activity

builders: move provisioning of ssh hostkeys to a systemd service

Browse source 
at first activation it does not yet have a working network setup
This commit is contained in:
Yureka 2024-08-05 07:17:45 +02:00
parent bce44930b1
commit 20fc4c8f96
1 changed files with 14 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

29
services/baremetal-builder/netboot.nix
View file

@ -5,22 +5,21 @@ in
{
config = lib.mkIf (cfg.enable && cfg.netboot) {
system.activationScripts.agenixInstall.deps = ["provisionSshHostKey"];
system.activationScripts.provisionSshHostKey = {
text = ''
echo provisioning ssh hostkey
if [ ! -f /etc/ssh/ssh_host_ed25519_key ]
then
mkdir -p /etc/ssh
(
umask 0077
curl --local-port 25-1024 https://vpn-gw.wob01.infra.forkos.org/${config.networking.hostName}/ssh_host_ed25519_key > /etc/ssh/ssh_host_ed25519_key
)
fi
systemd.services.openssh.after = [ "provision-ssh-hostkey" ];
systemd.services.provision-ssh-hostkey = {
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
mkdir -p /etc/ssh
umask 0077
until ${pkgs.iputils}/bin/ping -c 1 vpn-gw.wob01.infra.forkos.org; do sleep 1; done
curl --local-port 25-1024 https://vpn-gw.wob01.infra.forkos.org/${config.networking.hostName}/ssh_host_ed25519_key > /etc/ssh/ssh_host_ed25519_key
# Run the activation script again to trigger agenix decryption
/run/current-system/activate
'';
deps = [
"specialfs"
];
};
system.build = {