schmittlauch/nixconfigs
2
0
Fork 0
Code Issues 2 Pull requests Releases Wiki Activity

home: introduce ssh module that enables defining multi-proxy targets

Browse source 
also defines some good defaults for ssh.
workmac config already refactored. desktop config tbd.
This commit is contained in:
Trolli Schmittlauch 2026-03-18 01:54:09 +01:00
parent d66b6f5847
commit 703bdb8db0
4 changed files with 222 additions and 70 deletions
Download patch file Download diff file Expand all files Collapse all files

114
home/workmac.nix
View file

@ -37,17 +37,48 @@ in
programs.ssh = {
enable = true;
enableDefaultConfig = false; # deprecated
package = pkgs.openssh;
# TODO: common config for desktop as well
# early catchall to enforce agent socket usage. **NOT** the place for fallback defaults.
extraOptionOverrides = {
IdentityAgent = "\"~/Library/Group Containers/2BUA8C4S2C.com.1password/t/agent.sock\"";
CanonicalizeHostname = "yes";
CanonicalDomains = "fcio.net gocept.net";
CanonicalizeFallbackLocal = "yes";
};
multi-proxy.tags = {
# XXX genAttrs oder listToAttrs mit rzob/WHQ
# Connect to hosts directly, or if that fails (e.g. IPv4-only network)
# use the bastion host as a jump host.
"direct-rzob" = {
after = [ "*.fcio.net *.gocept.net" ];
jumpHost = "vpn-rzob.services.fcio.net";
connectType = [
"master"
"direct"
];
};
"direct-whq" = {
after = [ "*.fcio.net *.gocept.net" ];
jumpHost = "vpn-whq.services.fcio.net";
connectType = [
"master"
"direct"
];
};
"proxyjump-whq" = {
after = [ "tagged-direct-whq" ]; # XXX readOnly backref option
jumpHost = "kenny12.fe.whq.fcio.net";
connectType = [ "all" ];
noDirect = true;
};
"proxyjump-rzob" = {
after = [ "tagged-direct-rzob" ]; # XXX readOnly backref option
jumpHost = "kenny09.fe.whq.fcio.net";
connectType = [ "all" ];
noDirect = true;
};
};
# ssh host config
matchBlocks = {
# --- Host blocks (order matters: specific before wildcard) --------
@ -64,19 +95,17 @@ in
# For adding more topology-related specific rules, consider moving this into secrets like SOPS or so.
# Hostname wildcard for management network, also accessed via bastion host
"*.mgm.whq.fcio.net *.mgm.whq.gocept.net" =
lib.hm.dag.entryBefore [ "*.fcio.net *.gocept.net" ] {
extraOptions = {
Tag = "proxyjump-whq";
};
"*.mgm.whq.fcio.net *.mgm.whq.gocept.net" = lib.hm.dag.entryBefore [ "*.fcio.net *.gocept.net" ] {
extraOptions = {
Tag = "proxyjump-whq";
};
};
"*.mgm.rzob.fcio.net *.mgm.rzob.gocept.net" =
lib.hm.dag.entryBefore [ "*.fcio.net *.gocept.net" ] {
extraOptions = {
Tag = "proxyjump-rzob";
};
"*.mgm.rzob.fcio.net *.mgm.rzob.gocept.net" = lib.hm.dag.entryBefore [ "*.fcio.net *.gocept.net" ] {
extraOptions = {
Tag = "proxyjump-rzob";
};
};
# Fallback for all other FCIO hosts
"*.fcio.net *.gocept.net" = {
@ -85,61 +114,6 @@ in
};
};
# --- Match blocks (OpenSSH 9.4+ tags) ----------------------------
# Connect to hosts directly, or if that fails (e.g. IPv4-only network)
# use the bastion host as a jump host.
"tagged-direct-rzob" =
lib.hm.dag.entryAfter [ "*.fcio.net *.gocept.net" ] {
match = ''tagged="direct-rzob"'';
proxyCommand = "${lib.getExe pkgs.fc-scripts.ssh-multi-proxy} -p connect -i master,direct -j vpn-rzob.services.fcio.net %h %p";
extraOptions = {
ProxyUseFdpass = "yes";
};
};
"tagged-direct-whq" =
lib.hm.dag.entryAfter [ "*.fcio.net *.gocept.net" ] {
match = ''tagged="direct-whq"'';
proxyCommand = "${lib.getExe pkgs.fc-scripts.ssh-multi-proxy} -p connect -i master,direct -j vpn-whq.services.fcio.net %h %p";
extraOptions = {
ProxyUseFdpass = "yes";
};
};
# Don't connect directly, always use the bastion host as a jump host.
"tagged-proxyjump-whq" =
lib.hm.dag.entryAfter [ "tagged-direct" ] {
match = ''tagged="proxyjump-whq"'';
proxyCommand = "ssh-multi-proxy -p connect -ni all -j kenny12.fe.whq.fcio.net %h %p";
extraOptions = {
ProxyUseFdpass = "yes";
};
};
"tagged-proxyjump-rzob" =
lib.hm.dag.entryAfter [ "tagged-direct" ] {
match = ''tagged="proxyjump"'';
proxyCommand = "ssh-multi-proxy -p connect -ni all -j kenny09.fe.rzob.fcio.net %h %p";
extraOptions = {
ProxyUseFdpass = "yes";
};
};
# default, gets placed last by home-manager
"*" = {
serverAliveInterval = 10;
serverAliveCountMax = 2; # 2 strikes and you're out
forwardAgent = false;
addKeysToAgent = "no";
compression = false;
hashKnownHosts = false;
userKnownHostsFile = "~/.ssh/known_hosts";
controlMaster = "no";
controlPath = "~/.ssh/master-%r@%n:%p";
controlPersist = "no";
};
"hydra01" = {
hostname = "hydra01.access.whq.gocept.net";
user = "os";