Archived
beatzaplentyandClaude Sonnet 4.6
5487490b8e
- modules/ipa/client.nix: add AuthorizedKeysCommand so sshd fetches SSH public keys from IPA via sss_ssh_authorizedkeys, enabling pubkey login without per-host authorized_keys files - hosts/tailscale-router/host.nix: add IPA client module + networking.domain so SSSD runs and wayne can authenticate on this host - secrets/tailscale-router.keytab: sops-encrypted keytab for tailscale-router.sweet.home (generated by create-nixos-ipa-host-account.sh) - .sops.yaml: creation rule for secrets/tailscale-router.keytab Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
84 lines
3.1 KiB
Nix
84 lines
3.1 KiB
Nix
# Fully declarative FreeIPA domain membership.
|
|
#
|
|
# Configures security.ipa (SSSD, Kerberos, PAM, NSSwitch) and places a
|
|
# pre-provisioned host keytab via sops-nix so no imperative ipa-client-install
|
|
# step is needed after deployment.
|
|
#
|
|
# Usage (in a host.nix imports list):
|
|
# (import ../../modules/ipa/client.nix {
|
|
# keytabSopsFile = ../../secrets/nix-cache.keytab;
|
|
# caCertFile = ../../certs/ipa-ca.crt;
|
|
# })
|
|
#
|
|
# One-time operator setup per host (do this BEFORE deploying):
|
|
#
|
|
# 1. Fetch the IPA CA certificate (public — safe to commit):
|
|
# curl -o certs/ipa-ca.crt http://<ipa-server>/ipa/config/ca.crt
|
|
# Replace the placeholder at certs/ipa-ca.crt and commit it.
|
|
#
|
|
# 2. On the FreeIPA server, add the host and generate a keytab:
|
|
# ipa host-add <fqdn> --ip-address=<ip>
|
|
# ipa-getkeytab -s <ipa-server> -p host/<fqdn> -k /tmp/<host>.keytab
|
|
#
|
|
# 3. sops-encrypt the keytab as a binary secret from your admin machine
|
|
# (must run from repo root; sops matches creation rules against the file
|
|
# path, so copy to secrets/ first and encrypt in-place):
|
|
# cp /tmp/<host>.keytab secrets/<host>.keytab
|
|
# sops -e --input-type binary -i secrets/<host>.keytab
|
|
# Add secrets/<host>.keytab to .sops.yaml with the host's age key as a
|
|
# recipient (see the nix-cache.keytab entry for the pattern), then run:
|
|
# scripts/secrets/sync-host-keys.sh <target> # if not done yet
|
|
# sops updatekeys secrets/<host>.keytab
|
|
# Commit the encrypted file.
|
|
#
|
|
# 4. nixos-rebuild switch (or create-proxmox-resource.sh) — no further
|
|
# manual enrollment steps required.
|
|
#
|
|
# vars dependencies: homeDomain, ipaServer
|
|
|
|
{ keytabSopsFile, caCertFile }:
|
|
{ config, lib, pkgs, vars, ... }:
|
|
|
|
let
|
|
realm = lib.strings.toUpper vars.homeDomain;
|
|
fqdn = "${config.networking.hostName}.${vars.homeDomain}";
|
|
# "sweet.home" -> "dc=sweet,dc=home"
|
|
basedn = lib.strings.concatMapStringsSep "," (c: "dc=${c}") (lib.strings.splitString "." vars.homeDomain);
|
|
# security.ipa.certificate expects a derivation (package), not a raw path.
|
|
caCertPkg = pkgs.writeText "ipa-ca.crt" (builtins.readFile caCertFile);
|
|
in
|
|
{
|
|
security.ipa = {
|
|
enable = true;
|
|
domain = vars.homeDomain;
|
|
realm = realm;
|
|
server = vars.ipaServer;
|
|
certificate = caCertPkg;
|
|
basedn = basedn;
|
|
ipaHostname = fqdn;
|
|
offlinePasswords = true;
|
|
cacheCredentials = true;
|
|
};
|
|
|
|
# Fetch SSH public keys from IPA so users can log in with the key stored
|
|
# in their IPA profile rather than needing ~/.ssh/authorized_keys on every
|
|
# host. sss_ssh_authorizedkeys queries SSSD (which queries IPA LDAP).
|
|
services.openssh.extraConfig = ''
|
|
AuthorizedKeysCommand ${pkgs.sssd}/bin/sss_ssh_authorizedkeys %u
|
|
AuthorizedKeysCommandUser nobody
|
|
'';
|
|
|
|
# Host keytab: pre-provisioned on the IPA server, sops-encrypted binary.
|
|
# Placed at /etc/krb5.keytab before SSSD starts so the host authenticates
|
|
# to IPA without running ipa-client-install.
|
|
sops.secrets."ipa-host-keytab" = {
|
|
sopsFile = keytabSopsFile;
|
|
format = "binary";
|
|
path = "/etc/krb5.keytab";
|
|
owner = "root";
|
|
group = "root";
|
|
mode = "0600";
|
|
restartUnits = [ "sssd.service" ];
|
|
};
|
|
}
|