Archived
beatzaplentyandClaude Sonnet 4.6
a63e1c70c3
Replaces the gitignored host-keys/ directory with clan vars as the authoritative storage for SSH host keys. Keys are now generated as sops-binary-encrypted clan var files (admin-key only) and checked into vars/per-machine/<target>/openssh/, eliminating the plaintext private key that previously had to live outside the repo. Changes: - modules/clan/ssh-host-key.nix: clan vars generator for the ed25519 SSH host key pair (neededFor="activation" — not mapped to sops.secrets, delivered via tarball baking for LXC or --pre-format-files for VMs) - flake.nix: add clanCore module + required settings to every mkTarget; deduplicate bundled disko/sops-nix via follows; all 27 hosts eval clean - flake.lock: updated to reflect the new follows constraints - scripts/lib/clan-vars.sh: new helper library with clan_ssh_key_exists / clan_ssh_pubkey_path / clan_decrypt_ssh_key / clan_generate_ssh_key for use by the provisioning and sync scripts - scripts/secrets/sync-host-keys.sh: queue_host_sync() now checks clan vars first; generates via clan_generate_ssh_key if no key exists; derives age fingerprint from clan pub key for .sops.yaml registration - scripts/proxmox/create-proxmox-resource.sh: key management simplified (sync-host-keys.sh now generates the key if missing, so the inline prepare-host-key.sh call is gone); sync_remote_host_keys() decrypts the clan key into a temp dir and scps just the two files to the node when a clan key exists, falling back to the old host-keys/ scp for any remaining legacy entries Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01B2EJ4qTsM5KUqhS5c3GAwx
31 lines
1.4 KiB
Nix
31 lines
1.4 KiB
Nix
{ pkgs, ... }: {
|
|
# Defines the SSH host key as a clan vars generator so that:
|
|
# - `clan vars generate <target>` creates and encrypts the key pair
|
|
# - The private key lives at vars/per-machine/<target>/openssh/ssh_host_ed25519_key/secret
|
|
# (sops binary-encrypted, admin-key-only; decrypted by the build script)
|
|
# - The public key lives at vars/per-machine/<target>/openssh/ssh_host_ed25519_key.pub/value
|
|
# (plaintext; used by sync-host-keys.sh to derive the sops age fingerprint)
|
|
#
|
|
# neededFor = "activation" means clan's deployment tool would upload this
|
|
# before running nixos-rebuild/nixos-install (for VM/baremetal via
|
|
# nixos-anywhere). For lxc-* hosts, the build script bakes it into the
|
|
# tarball directly via NIXOS_HOST_KEYS_DIR -- the neededFor value here
|
|
# simply ensures it is NOT mapped to sops.secrets (which would try to
|
|
# decrypt it at runtime as a regular service secret, which is wrong: the
|
|
# SSH host key reaches the container via the tarball, not sops).
|
|
clan.core.vars.generators.openssh = {
|
|
files."ssh_host_ed25519_key" = {
|
|
secret = true;
|
|
neededFor = "activation";
|
|
};
|
|
files."ssh_host_ed25519_key.pub" = {
|
|
secret = false;
|
|
neededFor = "activation";
|
|
};
|
|
runtimeInputs = [ pkgs.openssh ];
|
|
script = ''
|
|
ssh-keygen -t ed25519 -N "" -C "" -f "$out/ssh_host_ed25519_key"
|
|
'';
|
|
};
|
|
}
|