forked from Fediversity/Fediversity
43 lines
1.3 KiB
Nix
43 lines
1.3 KiB
Nix
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
|
|
let
|
|
inherit (lib) attrValues elem;
|
|
inherit (lib.attrsets) concatMapAttrs optionalAttrs;
|
|
inherit (lib.strings) removeSuffix;
|
|
|
|
secretsPrefix = ../secrets;
|
|
secrets = import (secretsPrefix + "/secrets.nix");
|
|
keys = import ../keys;
|
|
|
|
in
|
|
{
|
|
# fediversityVm.hostPublicKey = mkDefault keys.systems.${config.fediversityVm.name};
|
|
|
|
## The configuration of the machine. We strive to keep in this file only the
|
|
## options that really need to be injected from the resource. Everything else
|
|
## should go into the `./nixos` subdirectory.
|
|
imports = [
|
|
../infra/common/options.nix
|
|
../infra/common/nixos
|
|
];
|
|
|
|
## Read all the secrets, filter the ones that are supposed to be readable
|
|
## with this host's public key, and add them correctly to the configuration
|
|
## as `age.secrets.<name>.file`.
|
|
age.secrets = concatMapAttrs (
|
|
name: secret:
|
|
optionalAttrs (elem config.fediversityVm.name secret.publicKeys) {
|
|
${removeSuffix ".age" name}.file = secretsPrefix + "/${name}";
|
|
}
|
|
) secrets;
|
|
|
|
## FIXME: switch root authentication to users with password-less sudo, see #24
|
|
users.users.root.openssh.authorizedKeys.keys = attrValues keys.contributors ++ [
|
|
# allow our panel vm access to the test machines
|
|
keys.panel
|
|
];
|
|
}
|