Refactor ssh&users
This commit is contained in:
+69
-7
@@ -63,13 +63,75 @@ User apps / dotfiles → wisdom. Daemons, firewall, kernel → NixOS. Sometimes
|
||||
- `desktopWallpapers` copies `inputs.wallpapers` into the store; override `chiasson.desktop.wallpapers.source` if needed.
|
||||
|
||||
|
||||
## Users
|
||||
## Users & SSH
|
||||
|
||||
User definitions live in `usersCatalogDefaults` (`modules/system/users/catalog-default.nix`) — olivier, server, builder, etc. Pick who exists on a host with `chiasson.users.enabled`.
|
||||
User definitions live in the catalog defaults block inside `modules/system/users.nix` (was previously split across four files in `modules/system/users/`; **folded into one for cohesion**). olivier, server, builder, etc. Pick who exists on a host with `chiasson.users.enabled`.
|
||||
|
||||
### SSH model — read this once
|
||||
|
||||
SSH authentication has two independent sides:
|
||||
|
||||
| Side | Holds | Decides |
|
||||
|------|-------|---------|
|
||||
| **Client** (connecting from) | identity private keys | "Here's proof I own key K" |
|
||||
| **Server** (connecting to) | `authorized_keys` | "Do I trust key K?" |
|
||||
|
||||
A key is just a cryptographic identity — it's not bound to a host or a machine account name. The model is **one key per user account**: each catalog account (`olivier`, `server`, `builder`) has its own keypair in `modules/lib/ssh-inventory.nix`, regardless of which machine that account runs on. Concretely: when `olivier@14900k` sshes to `server@r5500`, OpenSSH routes via a `Match user server` block (generated from `chiasson.ssh.outbound.rbw.extraIdentities`) → `IdentityFile ~/.ssh/id_ed25519_server.pub` (written from `users.server.publicKey`) to ask the rbw agent for the `server` private key; r5500's `server` `authorized_keys` holds the matching server pubkey. olivier's catalog default sets `extraIdentities = [ "server" "builder" ]` so `ssh <account>@<host>` Just Works for every catalog role. We also support `from="ip,cidr"` constraints per account to scope which source IPs may authenticate as it.
|
||||
|
||||
This repo enforces "one key per user": every user has one ed25519 keypair, the private key in Bitwarden, the public key inline in `modules/lib/ssh-inventory.nix`. On SSH connect:
|
||||
|
||||
1. `~/.ssh/config` (managed by home-manager) sets `IdentityAgent SSH_AUTH_SOCK` and `IdentityFile ~/.ssh/id_ed25519_<user>.pub` for every host block.
|
||||
2. OpenSSH reads the `.pub` file as a **filter** against the agent (OpenSSH 7.3+ trick — `.pub` as IdentityFile tells the agent "give me the private key matching this pub"), so even with multiple keys loaded, only the matching one is tried. This is why the old "too many auth failures" symptom is gone by construction.
|
||||
3. rbw holds the private key; HM-managed shells + the desktop session expose `SSH_AUTH_SOCK=$XDG_RUNTIME_DIR/rbw/…` declaratively (no activation scripts).
|
||||
|
||||
### Bitwarden onboarding
|
||||
|
||||
For each new user (run on the user's primary machine):
|
||||
|
||||
```sh
|
||||
# 1. Generate a keypair with rbw (creates a Bitwarden item + prints the pubkey).
|
||||
rbw gen ssh-key olivier
|
||||
|
||||
# 2. Paste the printed `ssh-ed25519 AAAA… olivier` line into
|
||||
# modules/lib/ssh-inventory.nix under users.olivier.publicKey.
|
||||
|
||||
# 3. Push the user to a host:
|
||||
ssh root@nix-server nixos-rebuild switch --flake .#nix-server
|
||||
|
||||
# 4. Have the user ssh into the fleet from any client — their rbw key
|
||||
# is the only thing offered, and every server already has it in
|
||||
# authorized_keys.
|
||||
```
|
||||
|
||||
### Adding a host
|
||||
|
||||
Edit `modules/lib/ssh-inventory.nix` and add:
|
||||
|
||||
```nix
|
||||
hosts."newhost" = {
|
||||
hostName = "192.168.2.X"; # IP — required for navi to deploy here
|
||||
aliases = [ "newhost" ]; # what you type at the ssh prompt
|
||||
};
|
||||
```
|
||||
|
||||
Then add `self.nixosModules.<host>Configuration` to `modules/deploy/navi.nix`.
|
||||
|
||||
### Adding a catalog user
|
||||
|
||||
1. Generate a keypair: `rbw gen ssh-key <name>`.
|
||||
2. Add a `users.<name> = { publicKey = "ssh-ed25519 …"; };` line under `users` in `modules/lib/ssh-inventory.nix`.
|
||||
3. Add a `<name> = { isNormalUser = true; … ssh.inbound.enable = true; ssh.inbound.authorizedHosts = "all"; }` entry under `chiasson.users.catalog` in `modules/system/users.nix`.
|
||||
4. Enable on every host that needs that user, e.g.:
|
||||
|
||||
```nix
|
||||
chiasson.users.enabled = [ "olivier" "<name>" ];
|
||||
```
|
||||
|
||||
### Passwords
|
||||
|
||||
Passwords aren't in the repo. They're in `secrets/secrets.yaml` (encrypted with sops). Each host that has `olivier` must declare that secret and set `neededForUsers = true`; sops-nix decrypts it at boot, and the catalog points `hashedPasswordFile` at that file. That's why the catalog is a proper module instead of a static list — it needs `config.sops.secrets.…` at eval time.
|
||||
|
||||
On a host:
|
||||
### Host overrides
|
||||
|
||||
```nix
|
||||
# configuration.nix — machine policy
|
||||
@@ -77,6 +139,8 @@ chiasson.users.enabled = [ "olivier" ];
|
||||
chiasson.users.hostOverrides.<name> = { /* optional */ };
|
||||
```
|
||||
|
||||
### Home-manager per-host slices (desktop/laptop hosts)
|
||||
|
||||
Desktop hosts also have `home.nix` exporting `flake.nixosModules.<host>Home`, wired from `default.nix` alongside `*Configuration`:
|
||||
|
||||
```nix
|
||||
@@ -86,7 +150,7 @@ modules = [
|
||||
self.nixosModules."14900kHome"
|
||||
];
|
||||
|
||||
# home.nix — flake fragment, per-host `chiasson.home.*` toggles
|
||||
# home.nix — flake fragment, per-host chiasson.home.* toggles
|
||||
{ self, inputs, ... }: {
|
||||
flake.nixosModules."14900kHome" = { self, pkgs, ... }: {
|
||||
imports = [ self.nixosModules.desktopHomeBase ];
|
||||
@@ -102,9 +166,7 @@ modules = [
|
||||
|
||||
`flake.nixosModules.desktopHomeBase` expands `lib.wisdomCatalogExtraModules` plus shared desktop toggles. Host `*Home` modules append per-host `chiasson.home` overrides (and rare inline `home.packages` blocks). `chiasson.users.extraModules` concatenates lists from multiple modules (base + host), so both can set the same user key.
|
||||
|
||||
`usersHomeIntegration` turns that into `users.users` + HM. Don't hand-roll catalog users unless you're changing the users module itself.
|
||||
|
||||
SSH: `sshInbound` on NixOS, outbound/rbw under `modules/ssh/home-manager/`.
|
||||
The integration block at the bottom of `modules/system/users.nix` turns the catalog + overrides into `users.users` + HM + inbound SSH. Don't hand-roll catalog users unless you're changing this module.
|
||||
|
||||
## Adding things
|
||||
|
||||
|
||||
Reference in New Issue
Block a user