]> Git — Sourcephile - sourcephile-nix.git/blob - machines/losurdo/security.nix
doc: explain tributes in naming the machines
[sourcephile-nix.git] / machines / losurdo / security.nix
1 { flakes, pkgs, lib, config, machineName, ... }:
2 let
3 inherit (config.security) gnupg;
4 rootKey = "root/key";
5 keygrip = "9AA84E6F6D71F9163C46BF396B141A0806219077";
6 in
7 {
8 security.gnupg.store = flakes.pass + "/machines/${machineName}";
9 #security.apparmor.policies."bin.ping".enable = false;
10 services.openssh.extraConfig = ''
11 # This is for removing remote gpg-agent's socket
12 StreamLocalBindUnlink yes
13 '';
14 /*
15 installer.ssh-nixos = {
16 PATH = [pkgs.gnupg pkgs.openssh];
17 sshFlags = [
18 #"-R" "/var/lib/gnupg/S.gpg-agent.extra:/run/user/1000/gnupg/d.w1sj57hx3zfcwadyxpr6wko9/S.gpg-agent.extra"
19 #"-o" "StreamLocalBindUnlink=yes"
20 ];
21 script = lib.mkBefore ''
22 ssh '${config.installer.ssh-nixos.target}' \
23 gpg-connect-agent --no-autostart --homedir /var/lib/gnupg "'keyinfo --list'" /bye 2>&1 |
24 grep -qx -e "gpg-connect-agent: no gpg-agent running in this session" \
25 -e "S KEYINFO ${keygrip} . . . 1 .*" || {
26 # Send the rootKey
27 gpg --decrypt '${gnupg.store}/${rootKey}.pass.gpg' |
28 gpg --batch --pinentry-mode loopback --passphrase-fd 0 --export-secret-subkeys @root@${machineName} |
29 ssh '${config.installer.ssh-nixos.target}' \
30 gpg --no-autostart --homedir /var/lib/gnupg --no-autostart --batch --pinentry-mode loopback --import
31
32 # Send the rootKey's passphrase
33 gpg --decrypt '${gnupg.store}/${rootKey}.pass.gpg' |
34 ssh '${config.installer.ssh-nixos.target}' \
35 gpg-preset-passphrase --homedir /var/lib/gnupg --preset ${keygrip}
36 }
37 '';
38 };
39 */
40 }