Archived
beatzaplentyandClaude Sonnet 4.6
5487490b8e
- modules/ipa/client.nix: add AuthorizedKeysCommand so sshd fetches SSH public keys from IPA via sss_ssh_authorizedkeys, enabling pubkey login without per-host authorized_keys files - hosts/tailscale-router/host.nix: add IPA client module + networking.domain so SSSD runs and wayne can authenticate on this host - secrets/tailscale-router.keytab: sops-encrypted keytab for tailscale-router.sweet.home (generated by create-nixos-ipa-host-account.sh) - .sops.yaml: creation rule for secrets/tailscale-router.keytab Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
36 lines
1.0 KiB
Nix
36 lines
1.0 KiB
Nix
{ vars, ... }:
|
|
|
|
{
|
|
imports = [
|
|
(import ../../modules/beszel/host-token.nix {
|
|
name = "tailscale-router";
|
|
sopsFile = ../../secrets/tailscale-router.yaml;
|
|
})
|
|
(import ../../modules/ipa/client.nix {
|
|
keytabSopsFile = ../../secrets/tailscale-router.keytab;
|
|
caCertFile = ../../certs/ipa-ca.crt;
|
|
})
|
|
];
|
|
|
|
networking = {
|
|
hostName = "tailscale-router";
|
|
domain = vars.homeDomain;
|
|
useDHCP = false;
|
|
interfaces.${vars.lxcLanInterface}.ipv4.addresses = [{
|
|
address = vars.tailscaleRouterIp;
|
|
prefixLength = vars.lanPrefixLength;
|
|
}];
|
|
defaultGateway = { address = vars.lanGateway; interface = vars.lxcLanInterface; };
|
|
nameservers = [ vars.domainControllerIp ];
|
|
};
|
|
|
|
services.beszel.agent.environment = {
|
|
KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG";
|
|
};
|
|
|
|
# No networking.hostId: only ZFS-touching hosts (server, docker) need one
|
|
# for pool-import safety, and this host does neither.
|
|
|
|
system.stateVersion = "26.05";
|
|
}
|