forked from lukas/nixos-config
77a05a9030
Fetched via ssh-keyscan run directly on pinix (same physical LAN as the router, not over an untrusted network) and confirmed with the user. Closes half of the roadmap §1 hostkey-pinning gap; tnix still needs the same treatment once it's powered on. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
51 lines
1.7 KiB
Nix
51 lines
1.7 KiB
Nix
{ config, ... }:
|
|
{
|
|
# We do not use systemd's SSH proxy for local VMs or containers. Keeping its
|
|
# generated config enabled also makes OpenSSH reject remotely imported store
|
|
# paths whose files are owned by the Nix sandbox identity.
|
|
programs.ssh.systemd-ssh-proxy.enable = false;
|
|
|
|
programs.ssh.extraConfig = ''
|
|
Host pinix
|
|
HostName ${config.tailnetIPs.pinix}
|
|
User drone
|
|
IdentitiesOnly yes
|
|
IdentityFile /home/drone/.ssh/id_ed25519
|
|
|
|
# Mango travel router, pinix's LAN gateway. Only reachable via pinix,
|
|
# never directly from blunix.
|
|
Host mango
|
|
HostName 192.168.8.1
|
|
ProxyJump pinix
|
|
|
|
Host eu.nixbuild.net
|
|
PubkeyAcceptedKeyTypes ssh-ed25519
|
|
ServerAliveInterval 60
|
|
IPQoS throughput
|
|
IdentityFile /home/drone/.ssh/id_ed25519
|
|
'';
|
|
|
|
programs.ssh.knownHosts.nixbuild = {
|
|
hostNames = [ "eu.nixbuild.net" ];
|
|
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPIQCZc54poJ8vqawd8TraNryQeJnvH1eLpIDgbiqymM";
|
|
};
|
|
|
|
programs.ssh.knownHosts.pinix = {
|
|
hostNames = [ "pinix" config.tailnetIPs.pinix ];
|
|
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBTIBiB9JYYtViI1IKK96pH+x3D63BQQgmZstc8jPBNp";
|
|
};
|
|
|
|
# Fetched via ssh-keyscan run directly on pinix (same physical LAN as
|
|
# the router, not over an untrusted network); verified 29.07.2026.
|
|
programs.ssh.knownHosts.mango = {
|
|
hostNames = [ "mango" "192.168.8.1" ];
|
|
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHynU8QHK4NyZdUmj70u1B4hpMMgENRmH5huGUAZoQZf";
|
|
};
|
|
|
|
nix.settings.trusted-public-keys = [
|
|
"nixbuild.net/7M7RXY-1:cbc+CQirMbg9SlQxAatEYd4sZYXWOjN3OJi6sH+KK68="
|
|
];
|
|
|
|
# Heavy builds opt in through --store ssh-ng://eu.nixbuild.net. Do not
|
|
# register nixbuild.net as an automatic builder for ordinary builds.
|
|
}
|