move around security

Signed-off-by: unexplrd <unexplrd@linerds.us>
This commit is contained in:
2025-05-04 19:31:59 +03:00
parent 9510cc48e2
commit 4652ce19db
19 changed files with 103 additions and 308 deletions

View File

@ -2,6 +2,5 @@
imports = [
./common.nix
./substituters.nix
# ./ssh-serve.nix
];
}

View File

@ -1,30 +0,0 @@
{
config,
inputs,
...
}: let
inherit (builtins) readFile;
inherit (config.networking) hostName;
inherit (config.sops) secrets;
inherit (inputs) mysecrets;
pubHost = readFile "${mysecrets}/ssh/ssh_host_ed25519_dunamis.base64";
in {
nix = {
distributedBuilds = true;
buildMachines = [
{
hostName = "dunamis";
publicHostKey = pubHost;
sshKey = secrets."ssh-${hostName}-user".path;
sshUser = "nix-ssh";
supportedFeatures = [
"benchmark"
"big-parallel"
"kvm"
"nixos-test"
];
system = "x86_64-linux";
}
];
};
}

View File

@ -1,11 +0,0 @@
{config, ...}: let
inherit (builtins) readFile;
inherit (config.users.users) user;
in {
nix.settings.trusted-users = ["nix-ssh"];
nix.sshServe = {
enable = true;
write = true;
keys = map (f: readFile f) user.openssh.authorizedKeys.keyFiles;
};
}