diff options
| author |  Tom van der Lee <tom@vanderlee.io> | 2026-09-18 15:08:10 +0200 |
|---|---|---|
| committer | Tom van der Lee <tom@vanderlee.io> | 2026-09-18 15:08:10 +0200 |
| commit | ca24ed1d3a1526934524290784ab9691fa895a83 (patch) | |
| tree | 6500c5499dbc1e7a53bb3bc3ea6735b887fdae40 /modules/nixos | |
| parent | a6d5680c87c31ab6da8dcb7cdeb76e77a02924e1 (diff) | |
| download | desktop-flake-ca24ed1d3a1526934524290784ab9691fa895a83.tar.gz desktop-flake-ca24ed1d3a1526934524290784ab9691fa895a83.tar.bz2 desktop-flake-ca24ed1d3a1526934524290784ab9691fa895a83.zip | |
Provision authorized SSH key for tom, fixing the lockout
services.openssh.settings.PasswordAuthentication = false was enabled
with no authorized key ever provisioned for the tom user, locking out
all SSH access on the first real host (floep). Adds the public keys
from https://github.com/tomvanderlee.keys as static literals -- a
one-time fetch, not a build-time network dependency, to stay pure.
Diffstat (limited to 'modules/nixos')
| -rw-r--r-- | modules/nixos/common.nix | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/modules/nixos/common.nix b/modules/nixos/common.nix index 2e70b15..27b14c1 100644 --- a/modules/nixos/common.nix +++ b/modules/nixos/common.nix | |||
| @@ -17,6 +17,14 @@ | |||
| 17 | isNormalUser = true; | 17 | isNormalUser = true; |
| 18 | extraGroups = [ "wheel" ]; | 18 | extraGroups = [ "wheel" ]; |
| 19 | shell = pkgs.bash; | 19 | shell = pkgs.bash; |
| 20 | # Fetched once from https://github.com/tomvanderlee.keys and pinned here | ||
| 21 | # as a static literal (not fetched at build time, which would require | ||
| 22 | # --impure) — update this list by hand if keys are added/rotated on | ||
| 23 | # GitHub. | ||
| 24 | openssh.authorizedKeys.keys = [ | ||
| 25 | "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDZQd4C53B3v7Si6NjNH8uXTrLOx5NXIWhF6R9Mk7hpDWQWwvXzCL6I/aY7cai2s8QgM5ptdVlx5pkogedPJCFEzLQoal/X6hOfNj1xAhDxEyEf7h+tflsnWqMFy92H7cC5o/xM48JRX1Fpm62xN7MrkUsZvV/t+HV6rISCNxOVXI7m0PowQT9zDGrAI2Q0dSLiqxvq/lMsU6aSJJz1kkQhcxLHJbm72mhZxf7NrF4I1OoEyuLTLpsgx8VpZwDlkp1m6+wy8xS/jNzr3ukjlTFy2RtDFyhiYTtwZI8j0ESNF3bp+FApUtHQ6dtcHGf5qHO9DaMYL94hPXuyebih723vQLVXqXDyXn7rHXD/laCPoE/2NeMA9h+g+MH6xqxbASVzWJuRq3RE+7VdIR+Y6Du1QkxLlNoPlDJTGb+n1OSMvVKum+XzNdneEP4txeXjvg/sfB/d53BCLaWB9tQEelNJaSue6JxckYNug4NE68b5dx4gvPw5qiKM8fzDZJSyvS0=" | ||
| 26 | "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDBz9LunRyAORLkF2S+MBwCmFdqp7sjJkKhTyog23cNVD2Ad9ElQZR9IgOGA0DjgOW3RgbDXoeGQi6v6V+Fy3dD+wieW2FMAmlsDOhUj9NdqC3ySbGZCGhnlKae8uZD4ywAA9Ipl+uz/s9A89rVDKzza7H7M7A0aaNKG306baPhiepAU+vLhlPgEZr0RJpbXt2HrBHWHKwTURJ4Gn2VmOIO6/tgsrlIdn3iZ4nO3GIZ06IM8U+MQhLWdfrzKI2E5gBMqRDVOih8upmkvbtwAcUl51tsMqEu0l3Xmn5D/OhTCFZXENiAqcfZNng7UDwI6iWQ201R9Dn4cJOK3e49lZhR" | ||
| 27 | ]; | ||
| 20 | }; | 28 | }; |
| 21 | 29 | ||
| 22 | services.openssh = { | 30 | services.openssh = { |