fix(deploy): set up 'colmena' wrapper for hardware-backed SSH keys

This commit is contained in:
2026-06-13 20:42:21 +02:00
parent fc38f49fbf
commit e845834833
7 changed files with 149 additions and 34 deletions
+9 -29
View File
@@ -2,17 +2,11 @@
config,
lib,
pkgs,
myUtils,
...
}:
let
cfg = config.ssh;
hostDir = ../../hosts;
hostNames = myUtils.dirNames hostDir;
hostsWithKeys = lib.filter (
hostname: builtins.pathExists (hostDir + "/${hostname}/ssh_host.pub")
) hostNames;
in
{
options.ssh.enable = lib.mkEnableOption "ssh";
@@ -24,30 +18,16 @@ in
enable = true;
enableDefaultConfig = false;
settings =
lib.genAttrs hostsWithKeys (
hostname:
let
meta = myUtils.hostMeta (hostDir + "/${hostname}");
isLocal = builtins.elem "local" meta.tags;
in
{
User = meta.host.username;
}
// lib.optionalAttrs (!isLocal) {
HostName = hostname;
}
)
// {
"*" = {
AddKeysToAgent = "yes";
ForwardAgent = false;
identityFile = [
"~/.ssh/id_ed25519_sk"
"~/.ssh/id_ed25519_sk_bak"
];
};
settings = {
"*" = {
AddKeysToAgent = "yes";
ForwardAgent = false;
identityFile = [
"~/.ssh/id_ed25519_sk"
"~/.ssh/id_ed25519_sk_bak"
];
};
};
};
};
}