carotte: use passwordFile for unattended decryption

diff --git a/flake.lock b/flake.lock
index e10d834fccf4283d5d4b7d568d31aa04df7be90e..ced37fbbe94baecc741b6dc5483f6d25cf2b852f 100644 (file)
--- a/flake.lock
+++ b/flake.lock
@@ -418,7 +418,7 @@
     "secrets": {
       "flake": false,
       "locked": {
-        "narHash": "sha256-TYk/jJI/uAAwnjWA9dFYs4ViPDQ7XoGG6HzE8ABNHWk=",
+        "narHash": "sha256-sUFisSSWsrGcLRxYXPevF6OILAIOW4inek0twLe1DuM=",
         "path": "/home/julm/work/sourcephile/nix/sec",
         "type": "path"
       },

diff --git a/flake.nix b/flake.nix
index ea37b0d990806a7a446a8dac9857556517975b3c..6c029788f497c10b2109c6d68ba096963a865cab 100644 (file)
--- a/flake.nix
+++ b/flake.nix
@@ -1,6 +1,5 @@
 {
 # Pin down nixpkgs from github, instead of using global, system or user registries.
-
 inputs.nixpkgs.url = "github:NixOS/nixpkgs/c47fcb70c6885d6df869934280ebeb715ca7e6fd";
 #inputs.nixpkgs.url = "flake:nixpkgs";
 inputs.flake-utils.url = "github:numtide/flake-utils";
@@ -65,7 +64,6 @@ outputs = inputs: let
           system.nixos.revision = lib.mkIf (inputs.self ? rev) inputs.self.rev;
           # Let 'nixos-version --json' know about the Git revision of this flake.
           system.configurationRevision = lib.mkIf (inputs.self ? rev) inputs.self.rev;
-          boot.initrd.network.ssh.hostKeys = [ "/root/initrd/ssh.key" ];
           security.gnupg.agent.enable = true;
           security.gnupg.store = inputs.pass + "/hosts/${hostName}";
           /*
@@ -94,6 +92,8 @@ outputs = inputs: let
   in
   {
     # Example: nix -L build .#nixosConfigurations.losurdo.config.system.build.toplevel
+    # Example: nix -L build .#nixosConfigurations.losurdo.config.boot.kernelPackages.kernel.configfile
+    # Example: nix -L build .#nixosConfigurations.losurdo.pkgs.hello
     # Example: nix eval .#nixosConfigurations.losurdo.config.networking.hostName
     nixosConfigurations = hosts {
       carotte = hosts/carotte.nix;
@@ -122,24 +122,23 @@ outputs = inputs: let
       # Example: nix run .#losurdo.switch
       "switch" = {
         type = "app";
-        program = (pkgs.writeShellScript "switch" ''
+        program = (pkgs.writeShellScript "switch" (''
           set -eux
           set -o pipefail
           nix-store --add-root hosts/${hostName}.root --indirect --realise ${build.toplevel}
           nix copy --to ssh://${target} --substitute-on-destination ${build.toplevel}
           ${sendkeys.program}
+          '' + lib.optionalString config.boot.initrd.network.ssh.enable ''
           # Send the SSH key of the initrd
-          test ! -e '${config.security.gnupg.store}/initrd/ssh.key.gpg' ||
           gpg --decrypt '${config.security.gnupg.store}/initrd/ssh.key.gpg' |
           ssh ${target} install -D -m 400 -o root -g root /dev/stdin /root/initrd/ssh.key
           # Send the Wireguard key of the initrd
-          test ! -e '${config.security.gnupg.store}/wireguard/wg-intra/privateKey.gpg' ||
           gpg --decrypt '${config.security.gnupg.store}/wireguard/wg-intra/privateKey.gpg' |
           ssh ${target} install -D -m 400 -o root -g root /dev/stdin /root/initrd/wg-intra.key
           ssh ${target} \
             nix-env --profile '${profile}' --set '${build.toplevel}' '&&' \
             '${profile}'/bin/switch-to-configuration switch
-        '').outPath;
+        '')).outPath;
       };
       # Example: nix run .#carotte.install-sd
       "install-sd" = {
@@ -151,7 +150,6 @@ outputs = inputs: let
           nix-store --add-root hosts/${hostName}.root --indirect --realise ${build.sdImage}
           unzstd --stdout ${build.sdImage}/sd-image/*.img.zst |
           sudo -k dd conv=notrunc oflag=direct,sync status=progress of="''${1:-/dev/mmcblk0}"
-
         '').outPath;
       };
       # Example: nix run .#losurdo.sendkeys

diff --git a/hosts/carotte.nix b/hosts/carotte.nix
index e915825ec046fafff1601ea7b552083abfb64bdf..6d6bb2f42af798692cf479192c61f945f43fc426 100644 (file)
--- a/hosts/carotte.nix
+++ b/hosts/carotte.nix
@@ -14,7 +14,6 @@ modules = [
   carotte/system.nix
   carotte/users.nix
   (inputs.secrets + "/hosts/${hostName}/users.nix")
-  (inputs.secrets + "/hosts/${hostName}/security.nix")
   carotte/xserver.nix
 ];
 }

diff --git a/hosts/carotte/security.nix b/hosts/carotte/security.nix
index 7f1af3edd2369c0561af4a88e804ce1e7d05a874..0d766d7ee8edd08ce9377c1c3f420e80662326eb 100644 (file)
--- a/hosts/carotte/security.nix
+++ b/hosts/carotte/security.nix
@@ -5,6 +5,7 @@ security.virtualisation.flushL1DataCache = lib.mkForce null;
 security.gnupg.agent = {
   keyring."C7BCEA3D090956E7D51E94ADFF53191D9FA89552" = {
     passwordGpg = "gnupg/root.gpg";
+    passwordFile = "/root/.gnupg.C7BCEA3D090956E7D51E94ADFF53191D9FA89552.txt";
   };
 };
 services.openssh.extraConfig = ''

diff --git a/hosts/losurdo/fileSystems.nix b/hosts/losurdo/fileSystems.nix
index 7f93d9cf86b5843603ef234877c4c895585a813c..00417a17e9adc2702ca29a9d6acf9edd161d1870 100644 (file)
--- a/hosts/losurdo/fileSystems.nix
+++ b/hosts/losurdo/fileSystems.nix
@@ -6,8 +6,16 @@ imports = [
 
 fileSystems."/" = {
   device = "${hostName}/root";
-  fsType = "zfs";
+  fsType = "zfs"; # TODO: options = [ "zfsutil" ];
 };
+
+# This will automatically load the zfs password prompt on login
+# and kill the other prompt so boot can continue
+# The pkill zfs kills the zfs load-key from the console
+# allowing the boot to continue.
+boot.initrd.network.postCommands = ''
+  echo >>/root/.profile "zfs load-key rpool && pkill zfs"
+'';
 boot.zfs.requestEncryptionCredentials = [ hostName ];
 
 fileSystems."/nix" = {

diff --git a/hosts/losurdo/networking/nsupdate.nix b/hosts/losurdo/networking/nsupdate.nix
index f23de49d3f0de55b50951e255f33d59ab6f256e9..5b34f4df0216e108fae5b8aff7973a0475a00730 100644 (file)
--- a/hosts/losurdo/networking/nsupdate.nix
+++ b/hosts/losurdo/networking/nsupdate.nix
@@ -5,6 +5,7 @@ let
   inherit (config.networking) domain;
 in
 {
+# TODO: nsupdate in the initrd
 systemd.services.nsupdate = {
   after = [
     "network-online.target"

diff --git a/hosts/losurdo/networking/ssh.nix b/hosts/losurdo/networking/ssh.nix
index 8227d4ba96973f18c762cca8db12764029ff00bf..76063183b3a10c4bdafe71df5cef45b2bcf06ccb 100644 (file)
--- a/hosts/losurdo/networking/ssh.nix
+++ b/hosts/losurdo/networking/ssh.nix
@@ -1,8 +1,4 @@
 { pkgs, lib, config, hosts, ... }:
-let
-  inherit (config.security) gnupg;
-  inherit (config.users) users;
-in
 {
 /* Wireguard is used instead
 systemd.services.ssh-mermet-reverse = {
@@ -26,7 +22,7 @@ systemd.services.ssh-mermet-reverse = {
 boot.initrd.network.ssh = {
   enable = true;
   port = 2222;
-  authorizedKeys = users.root.openssh.authorizedKeys.keys;
+  authorizedKeys = config.users.users.root.openssh.authorizedKeys.keys;
   hostKeys = [ "/root/initrd/ssh.key" ];
   extraConfig = ''
   '';

diff --git a/hosts/mermet/fileSystems.nix b/hosts/mermet/fileSystems.nix
index 13910cce939f4e54c4da10c1f1c47002c4c83e83..c1744da841c1c19a9a35704a3d6885edb27dccfc 100644 (file)
--- a/hosts/mermet/fileSystems.nix
+++ b/hosts/mermet/fileSystems.nix
@@ -10,10 +10,20 @@ fileSystems."/boot" =
     fsType = "zfs";
   };
 */
-fileSystems."/" =
-  { device = "rpool/root";
-    fsType = "zfs";
-  };
+fileSystems."/" = {
+  device = "rpool/root";
+  fsType = "zfs"; # TODO: options = [ "zfsutil" ];
+};
+
+# This will automatically load the zfs password prompt on login
+# and kill the other prompt so boot can continue
+# The pkill zfs kills the zfs load-key from the console
+# allowing the boot to continue.
+boot.initrd.network.postCommands = ''
+  echo >>/root/.profile "zfs load-key rpool && pkill zfs"
+'';
+#boot.zfs.requestEncryptionCredentials = [ "rpool" ];
+#boot.zfs.requestEncryptionCredentials = [ hostName ];
 
 fileSystems."/home" =
   { device = "rpool/home";

diff --git a/hosts/mermet/networking.nix b/hosts/mermet/networking.nix
index 69ae05219590ad6cc44239bac5c24b02b429ecd1..2288e767bf8bdbeb870be637f292d7c3061cdd52 100644 (file)
--- a/hosts/mermet/networking.nix
+++ b/hosts/mermet/networking.nix
@@ -16,24 +16,6 @@ imports = [
   networking/ssh.nix
   networking/wireguard.nix
 ];
-boot.initrd.network = {
-  enable = true;
-  ssh = {
-    enable = true;
-    # To prevent ssh from freaking out because a different host key is used,
-    # a different port for dropbear is useful
-    # (assuming the same host has also a normal sshd running)
-    port = 2222;
-    authorizedKeys = users.users.root.openssh.authorizedKeys.keys;
-  };
-  # This will automatically load the zfs password prompt on login
-  # and kill the other prompt so boot can continue
-  # The pkill zfs kills the zfs load-key from the console
-  # allowing the boot to continue.
-  postCommands = ''
-    echo >>/root/.profile "zfs load-key rpool && pkill zfs"
-  '';
-};
 
 /* WARNING: using ipconfig (the ip= kernel parameter) IS NOT RELIABLE:
    a 91.216.110.35/32 becomes a 91.216.110.35/8
@@ -88,6 +70,7 @@ boot.initrd.preLVMCommands = ''
 '';
 
 # Workaround https://github.com/NixOS/nixpkgs/issues/56822
+# TODO: the issue is now closed
 #boot.initrd.kernelModules = [ "ipv6" ];
 
 # Useless without an out-of-band access, and unsecure

diff --git a/hosts/mermet/networking/ssh.nix b/hosts/mermet/networking/ssh.nix
index 8cfb261df92d6b05c324d679baf2a18f5a38aa52..92dac01c002259d662a54150e1abcc1d6a61636e 100644 (file)
--- a/hosts/mermet/networking/ssh.nix
+++ b/hosts/mermet/networking/ssh.nix
@@ -4,4 +4,23 @@ networking.nftables.ruleset = ''
   add rule inet filter net2fw tcp dport 10022 counter accept comment "SSH (reverse to losurdo)"
 '';
 services.openssh.gatewayPorts = "clientspecified";
+boot.initrd.network.ssh = {
+  enable = true;
+  # To prevent ssh from freaking out because a different host key is used,
+  # a different port for dropbear is useful
+  # (assuming the same host has also a normal sshd running)
+  port = 2222;
+  authorizedKeys = config.users.users.root.openssh.authorizedKeys.keys;
+  hostKeys = [ "/root/initrd/ssh.key" ];
+};
+boot.initrd.network = {
+  enable = true;
+  # This will automatically load the zfs password prompt on login
+  # and kill the other prompt so boot can continue
+  # The pkill zfs kills the zfs load-key from the console
+  # allowing the boot to continue.
+  postCommands = ''
+    echo >>/root/.profile "zfs load-key rpool && pkill zfs"
+  '';
+};
 }

diff --git a/nixpkgs/patches.nix b/nixpkgs/patches.nix
index bc017d9fcefe44c2b8a7da7f4c5f225410f24a73..f22956e14a32f6da6a18b81ae83adc7deec38531 100644 (file)
--- a/nixpkgs/patches.nix
+++ b/nixpkgs/patches.nix
@@ -9,7 +9,7 @@
 {
   meta.description = "nixos/security.gnupg: provisioning GnuPG-protected secrets through the Nix store";
   url = "https://github.com/NixOS/nixpkgs/pull/93659.diff";
-  sha256 = "sha256-ECdCWZNREXxtKQYG2/EmTk6VFDTsOwrVBGZhU1y79Rc=";
+  sha256 = "sha256-rHf6TRd2O6SBdk7B4FGUm3upFJavrRSxko0iQti+xzs=";
 }
 {
   meta.description = "Update public-inbox to 1.6.1 and add systemd services";