54 lines
1.5 KiB
Nix
54 lines
1.5 KiB
Nix
{ core, network, users, ... }:
|
|
let
|
|
inherit(core) set;
|
|
in
|
|
{
|
|
boot.initrd.network
|
|
= {
|
|
enable = true;
|
|
postCommands
|
|
= ''
|
|
echo 'cryptsetup-askpass' >> /root/.profile
|
|
'';
|
|
ssh
|
|
= {
|
|
# TODO: We might not trust every user.
|
|
authorizedKeys
|
|
= set.foldValues
|
|
(
|
|
authorizedKeys:
|
|
{ trusted, user, ... }:
|
|
if trusted
|
|
then
|
|
authorizedKeys ++ (user.keys.${network.hostName} or [])
|
|
else
|
|
authorizedKeys
|
|
)
|
|
[]
|
|
users;
|
|
enable = true;
|
|
# List of Paths to Private Keys as Strings.
|
|
hostKeys = [ "/etc/initrdSecret.ssh" ];
|
|
port = network.tcp.ports.initrd.ssh;
|
|
};
|
|
};
|
|
|
|
networking
|
|
= {
|
|
defaultGateway6
|
|
= {
|
|
address = "fe80::1";
|
|
interface = "ens3";
|
|
};
|
|
};
|
|
|
|
security.acme
|
|
= {
|
|
acceptTerms = true;
|
|
defaults
|
|
= {
|
|
email = "cert@${network.domain}";
|
|
};
|
|
};
|
|
}
|