nix: upgrade to latests nixos-unstable-small, fix boot.initrd.network.ssh.hostKeys

diff --git a/.config/nixpkgs-channel/nixos-unstable-small.nix b/.config/nixpkgs-channel/nixos-unstable-small.nix
index 16a3994636863c485932e30edcc28f3394c55fe5..325c1d0f358b3b9d0f113e3ca716bd0b170e5bdc 100644 (file)
--- a/.config/nixpkgs-channel/nixos-unstable-small.nix
+++ b/.config/nixpkgs-channel/nixos-unstable-small.nix
@@ -1 +1 @@
-builtins.fetchTarball {url="https://github.com/NixOS/nixpkgs-channels/archive/21cf33331027a4f3aa3d9fa6e57170c34ca68fc1.tar.gz"; sha256="055b7k3q7w5n2787pm3khrh9y92ibj5x8f72nb5nvxsrd615qdnq";}
+builtins.fetchTarball {url="https://github.com/NixOS/nixpkgs-channels/archive/1085c056376041af71e8f1cf72c1ed4a4db01dc6.tar.gz"; sha256="17sh68825jhjfpn1q02ni8xifrgaszz494irx096f0mmi2k2lkqp";}

diff --git a/nixos/profiles/hardware/apu2e4.nix b/nixos/profiles/hardware/apu2e4.nix
index af318228752fa1e5e1b30005346e1ca01cb58aeb..97d2bce90d3f052858229057c8b996a773f4c90f 100644 (file)
--- a/nixos/profiles/hardware/apu2e4.nix
+++ b/nixos/profiles/hardware/apu2e4.nix
@@ -20,7 +20,7 @@ boot.loader = {
     enable = true;
     version = 2;
     copyKernels = true;
-    configurationLimit = 3;
+    configurationLimit = 1;
     # efiSupport = true;
     # In case canTouchEfiVariables doesn't work
     #efiInstallAsRemovable = true;

diff --git a/nixos/profiles/hardware/dl10j.nix b/nixos/profiles/hardware/dl10j.nix
index 00db6cc1c72d68044e643ffe6610092a40b64f40..26be42d52932d4da512ac3dbd5cff8665358156e 100644 (file)
--- a/nixos/profiles/hardware/dl10j.nix
+++ b/nixos/profiles/hardware/dl10j.nix
@@ -20,9 +20,9 @@ boot.loader = {
     enable = true;
     version = 2;
     copyKernels = true;
-    configurationLimit = 3;
+    configurationLimit = 1;
     efiSupport = true;
-    # Vecause canTouchEfiVariables doesn't work on this system
+    # Because canTouchEfiVariables doesn't work on this system
     efiInstallAsRemovable = true;
     devices = [
       # Completed in the importing configuration

diff --git a/nixpkgs/overlays.nix b/nixpkgs/overlays.nix
index 59c76750022089e2585685104cccbd11dcd6209e..ee22aef428321df02d74ca497ef58e8dae5fa5b7 100644 (file)
--- a/nixpkgs/overlays.nix
+++ b/nixpkgs/overlays.nix
@@ -1,7 +1,6 @@
 map import
 [ overlays/lib/filesystem.nix
   overlays/lib/strings.nix
-  overlays/gitweb.nix
   overlays/public-inbox.nix
   overlays/smartctl-tbw.nix
   overlays/swaplist.nix

diff --git a/nixpkgs/overlays/gitweb.nix b/nixpkgs/overlays/gitweb.nix
deleted file mode 100644 (file)
index 209ae2c..0000000
--- a/nixpkgs/overlays/gitweb.nix
+++ /dev/null
@@ -1,10 +0,0 @@
-self: super:
-{
-  gitweb = super.gitweb.override {
-    git = super.git.overrideAttrs (attrs: {
-      doCheck = false;
-      doInstallCheck = false;
-      patches = attrs.patches ++ [gitweb/0001-gitweb-fix-UTF-8-encoding-when-using-CGI-Fast.patch];
-    });
-  };
-}

diff --git a/servers/losurdo/networking.nix b/servers/losurdo/networking.nix
index 3dde6a70d910a23c7387183d9f62b08f636b6939..c141c59a2d8d6cea89bbbd7c63a12471b56bf2d4 100644 (file)
--- a/servers/losurdo/networking.nix
+++ b/servers/losurdo/networking.nix
@@ -19,20 +19,6 @@ boot.initrd.network = {
     # a different port for dropbear is useful
     # (assuming the same host has also a normal sshd running)
     port = 2222;
-    # The initrd needs a cleartext key and is built on the host,
-    # hence this key needs to be cleartext on the host.
-    # Moreover building the initrd means that the key will go into the Nix store,
-    # of the host, then of the target on deployment,
-    # because GRUB does not support boot.initrd.secrets
-    # (only systemd-boot does, but sticking to GRUB is more reassuring).
-    # In any case, the initrd is sent to a non-encrypted /boot partition
-    # to be able to start unattended, hence the key will be available
-    # to anyone who has physically access to the disk where /boot is.
-    hostKeys = [
-      (pass-to-file "servers/losurdo/ssh/ecdsa.key"
-                    (../../../sec + "/tmp/losurdo.ecdsa.key"))
-    ];
-    
     authorizedKeys = users.users.root.openssh.authorizedKeys.keys;
   };
   # This will automatically load the zfs password prompt on login

diff --git a/servers/losurdo/security.nix b/servers/losurdo/security.nix
index 80f3277692e56141172c77f189131f2e3d24fecc..14ef337f56bd81924375a4256398f9a9a3efdad0 100644 (file)
--- a/servers/losurdo/security.nix
+++ b/servers/losurdo/security.nix
@@ -2,6 +2,7 @@
 let
   inherit (config.security) pass;
   rootKey = "root/key";
+  initrdKey = "initrd/ssh.key";
 in
 {
 imports = [
@@ -23,12 +24,16 @@ security.pass = {
 };
 install.ssh-nixos = {
   PATH = with pkgs; [gnupg openssh];
-  # Decrypt the rootKey passphrase and send it to the target host.
+  # Decrypt the rootKey passphrase and the initrd SSH host key
+  # and send them to the target host.
   script = lib.mkBefore ''
     gpg --decrypt '${pass.store}/${rootKey}.pass.gpg' |
     ssh '${config.install.ssh-nixos.target}' install -D -m 400 -o root -g root /dev/stdin /${rootKey}.pass
+    gpg --decrypt '${pass.store}/${initrdKey}.gpg' |
+    ssh '${config.install.ssh-nixos.target}' install -D -m 400 -o root -g root /dev/stdin /run/${initrdKey}
   '';
 };
+boot.initrd.network.ssh.hostKeys = [ "/run/${initrdKey}" ];
 systemd.services = lib.mapAttrs' (target: secret:
   # Start the rootKey service before the other services decrypting secrets.
   lib.nameValuePair (lib.removeSuffix ".service" secret.service)

diff --git a/servers/mermet/networking.nix b/servers/mermet/networking.nix
index d315fddbfd59530c441b82d92b8751c278818562..c982e9449149df220b06707c4a3d6f67ed97287c 100644 (file)
--- a/servers/mermet/networking.nix
+++ b/servers/mermet/networking.nix
@@ -18,27 +18,12 @@ imports = [
 boot.initrd.network = {
   enable = true;
   ssh = {
-     enable = true;
-     # To prevent ssh from freaking out because a different host key is used,
-     # a different port for dropbear is useful
-     # (assuming the same host has also a normal sshd running)
-     port = 2222;
-     # The initrd needs a cleartext key and is built on the host,
-     # hence this key needs to be cleartext on the host.
-     # Moreover building the initrd means that the key will go into the Nix store,
-     # of the host, then of the target on deployment,
-     # because GRUB does not support boot.initrd.secrets
-     # (only systemd-boot does, but sticking to GRUB is more reassuring).
-     # In any case, the initrd is sent to a non-encrypted /boot partition
-     # to be able to start unattended, hence the key will be available
-     # to anyone who has physically access to the disk where /boot is.
-     # NOTE: dropbearkey -t ecdsa -f /tmp/dropbear-ecdsa.key
-    hostKeys = [
-      (pass-to-file "servers/mermet/ssh/ecdsa.key"
-                    (../../../sec + "/tmp/mermet.ecdsa.key"))
-    ];
-
-     authorizedKeys = users.users.root.openssh.authorizedKeys.keys;
+    enable = true;
+    # To prevent ssh from freaking out because a different host key is used,
+    # a different port for dropbear is useful
+    # (assuming the same host has also a normal sshd running)
+    port = 2222;
+    authorizedKeys = users.users.root.openssh.authorizedKeys.keys;
   };
   # This will automatically load the zfs password prompt on login
   # and kill the other prompt so boot can continue

diff --git a/servers/mermet/security.nix b/servers/mermet/security.nix
index 664aab20476a4b46d9f003e920dce71f658bc8b9..4f04cd5399dd6a8ba6cf11f42ba8da6b22d44ea9 100644 (file)
--- a/servers/mermet/security.nix
+++ b/servers/mermet/security.nix
@@ -2,6 +2,7 @@
 let
   inherit (config.security) pass;
   rootKey = "root/key";
+  initrdKey = "initrd/ssh.key";
 in
 {
 imports = [
@@ -22,12 +23,16 @@ security.pass = {
 };
 install.ssh-nixos = {
   PATH = with pkgs; [gnupg openssh];
-  # Decrypt the rootKey passphrase and send it to the target host.
+  # Decrypt the rootKey passphrase and the initrd SSH host key
+  # and send them to the target host.
   script = lib.mkBefore ''
     gpg --decrypt '${pass.store}/${rootKey}.pass.gpg' |
     ssh '${config.install.ssh-nixos.target}' install -D -m 400 -o root -g root /dev/stdin /${rootKey}.pass
+    gpg --decrypt '${pass.store}/${initrdKey}.gpg' |
+    ssh '${config.install.ssh-nixos.target}' install -D -m 400 -o root -g root /dev/stdin /run/${initrdKey}
   '';
 };
+boot.initrd.network.ssh.hostKeys = [ "/run/${initrdKey}" ];
 systemd.services = lib.mapAttrs' (target: secret:
   # Start the rootKey service before the other services decrypting secrets.
   lib.nameValuePair (lib.removeSuffix ".service" secret.service)