home: introduce ssh module that enables defining multi-proxy targets
also defines some good defaults for ssh. workmac config already refactored. desktop config tbd.
This commit is contained in:
parent
d66b6f5847
commit
703bdb8db0
4 changed files with 222 additions and 70 deletions
|
|
@ -11,6 +11,8 @@
|
|||
./modules/vscodium.nix
|
||||
./modules/fonts.nix
|
||||
./modules/captive-browser.nix
|
||||
./modules/ensureDirs.nix
|
||||
./modules/ssh.nix
|
||||
];
|
||||
home.homeDirectory =
|
||||
if pkgs.stdenv.isDarwin then "/Users/${config.home.username}" else "/home/${config.home.username}";
|
||||
|
|
|
|||
66
home/modules/ensureDirs.nix
Normal file
66
home/modules/ensureDirs.nix
Normal file
|
|
@ -0,0 +1,66 @@
|
|||
{ config, lib, ... }:
|
||||
|
||||
let
|
||||
cfg = config.home.ensureDirs;
|
||||
|
||||
enabledDirs = lib.filterAttrs (_: opts: opts.enable) cfg;
|
||||
|
||||
dirType = lib.types.submodule (
|
||||
{ name, ... }:
|
||||
{
|
||||
options = {
|
||||
enable = lib.mkEnableOption "this directory" // {
|
||||
default = true;
|
||||
};
|
||||
|
||||
path = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = name;
|
||||
description = "Directory path relative to $HOME. Defaults to the attribute name.";
|
||||
};
|
||||
|
||||
mode = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "755";
|
||||
description = "Octal permissions to set on the directory.";
|
||||
};
|
||||
};
|
||||
}
|
||||
);
|
||||
|
||||
activationScript = builtins.concatStringsSep "\n" (
|
||||
lib.mapAttrsToList (_: opts: ''
|
||||
run mkdir -p "$HOME/${opts.path}"
|
||||
run chmod ${opts.mode} "$HOME/${opts.path}"
|
||||
'') enabledDirs
|
||||
);
|
||||
|
||||
in
|
||||
{
|
||||
options.home.ensureDirs = lib.mkOption {
|
||||
type = lib.types.attrsOf dirType;
|
||||
default = { };
|
||||
description = ''
|
||||
Set of directories (relative to $HOME) to create with specific
|
||||
permissions on every home-manager activation. Works on both
|
||||
Linux and Darwin. The attribute name defaults as the directory
|
||||
path but can be overridden via the `path` option.
|
||||
'';
|
||||
example = lib.literalExpression ''
|
||||
{
|
||||
".ssh" = { mode = "700"; };
|
||||
".gnupg" = { mode = "700"; };
|
||||
".local/share/myapp" = { mode = "700"; };
|
||||
"projects" = {};
|
||||
"my-workspace" = {
|
||||
path = "work/projects";
|
||||
mode = "750";
|
||||
};
|
||||
}
|
||||
'';
|
||||
};
|
||||
|
||||
config = lib.mkIf (enabledDirs != { }) {
|
||||
home.activation.ensureDirs = lib.hm.dag.entryAfter [ "writeBoundary" ] activationScript;
|
||||
};
|
||||
}
|
||||
110
home/modules/ssh.nix
Normal file
110
home/modules/ssh.nix
Normal file
|
|
@ -0,0 +1,110 @@
|
|||
{
|
||||
pkgs,
|
||||
inputs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (lib) types;
|
||||
controlDir = "~/.ssh/controlmasters";
|
||||
|
||||
proxyTagType = types.submodule (
|
||||
{ name, ... }:
|
||||
{
|
||||
options = {
|
||||
after = lib.mkOption {
|
||||
type = types.nullOr (types.listOf types.str);
|
||||
default = [ ];
|
||||
description = "List of other hm.dag.entryAfter conditions the match rule needs to be placed.";
|
||||
};
|
||||
# XXX extra args
|
||||
connectType = lib.mkOption {
|
||||
type = types.listOf (
|
||||
types.enum [
|
||||
"all"
|
||||
"nomaster"
|
||||
"master"
|
||||
"direct"
|
||||
"indirect"
|
||||
]
|
||||
);
|
||||
description = ''
|
||||
Select jump indirection mode:
|
||||
all|nomaster|{master,direct,indirect}
|
||||
using ControlMaster socket, only directly, only through SSH if direct connections fail
|
||||
'';
|
||||
};
|
||||
jumpHost = lib.mkOption {
|
||||
type = types.nullOr types.str; # null is also okay for achieving hyppy eyeballs
|
||||
};
|
||||
noDirect = lib.mkEnableOption "Skip connecting to the remote host directly, always use the jump hosts";
|
||||
};
|
||||
|
||||
}
|
||||
);
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
./ensureDirs.nix
|
||||
];
|
||||
options = {
|
||||
programs.ssh.multi-proxy.tags = lib.mkOption {
|
||||
type = types.attrsOf proxyTagType;
|
||||
default = { };
|
||||
description = "Set of ssh-multi-proxy target tag definitions.";
|
||||
};
|
||||
};
|
||||
config = lib.mkIf config.programs.ssh.enable {
|
||||
home.ensureDirs = {
|
||||
".ssh" = {
|
||||
mode = "700";
|
||||
};
|
||||
".ssh/controlmasters" = {
|
||||
mode = "700";
|
||||
};
|
||||
};
|
||||
home.packages = [ pkgs.fc-scripts.ssh-multi-proxy ];
|
||||
programs.ssh = {
|
||||
enableDefaultConfig = false; # deprecated
|
||||
package = lib.mkDefault pkgs.openssh;
|
||||
extraOptionOverrides = {
|
||||
CanonicalizeHostname = "yes";
|
||||
CanonicalizeFallbackLocal = "yes";
|
||||
};
|
||||
matchBlocks = {
|
||||
|
||||
# default, gets placed last by home-manager
|
||||
"*" = {
|
||||
serverAliveInterval = 10;
|
||||
serverAliveCountMax = 2; # 2 strikes and you're out
|
||||
forwardAgent = false;
|
||||
addKeysToAgent = "no";
|
||||
compression = false;
|
||||
hashKnownHosts = false;
|
||||
userKnownHostsFile = "~/.ssh/known_hosts";
|
||||
controlMaster = "no";
|
||||
controlPath = "${controlDir}/%r@%n:%p";
|
||||
controlPersist = "no";
|
||||
};
|
||||
}
|
||||
# ssh-multi-proxy tag definitions
|
||||
// lib.mapAttrs' (
|
||||
tag: tagDef:
|
||||
let
|
||||
dependency = if tagDef.after != null then lib.hm.dag.entryAfter tagDef.after else lib.id;
|
||||
in
|
||||
lib.nameValuePair "tagged-${tag}" {
|
||||
match = ''tagged="${tag}"'';
|
||||
proxyCommand = "${lib.getExe pkgs.fc-scripts.ssh-multi-proxy} -v -p connect --control-path='${controlDir}'${lib.optionalString tagDef.noDirect " -n"} -i ${lib.concatStringsSep "," tagDef.connectType}${
|
||||
lib.optionalString (tagDef.jumpHost != null) " -j ${tagDef.jumpHost}"
|
||||
} %h %p";
|
||||
extraOptions = {
|
||||
ProxyUseFdpass = "yes";
|
||||
};
|
||||
}
|
||||
) config.programs.ssh.multi-proxy.tags;
|
||||
};
|
||||
|
||||
};
|
||||
}
|
||||
102
home/workmac.nix
102
home/workmac.nix
|
|
@ -37,17 +37,48 @@ in
|
|||
|
||||
programs.ssh = {
|
||||
enable = true;
|
||||
enableDefaultConfig = false; # deprecated
|
||||
package = pkgs.openssh;
|
||||
# TODO: common config for desktop as well
|
||||
# early catchall to enforce agent socket usage. **NOT** the place for fallback defaults.
|
||||
extraOptionOverrides = {
|
||||
IdentityAgent = "\"~/Library/Group Containers/2BUA8C4S2C.com.1password/t/agent.sock\"";
|
||||
CanonicalizeHostname = "yes";
|
||||
CanonicalDomains = "fcio.net gocept.net";
|
||||
CanonicalizeFallbackLocal = "yes";
|
||||
};
|
||||
|
||||
multi-proxy.tags = {
|
||||
# XXX genAttrs oder listToAttrs mit rzob/WHQ
|
||||
|
||||
# Connect to hosts directly, or if that fails (e.g. IPv4-only network)
|
||||
# use the bastion host as a jump host.
|
||||
"direct-rzob" = {
|
||||
after = [ "*.fcio.net *.gocept.net" ];
|
||||
jumpHost = "vpn-rzob.services.fcio.net";
|
||||
connectType = [
|
||||
"master"
|
||||
"direct"
|
||||
];
|
||||
};
|
||||
|
||||
"direct-whq" = {
|
||||
after = [ "*.fcio.net *.gocept.net" ];
|
||||
jumpHost = "vpn-whq.services.fcio.net";
|
||||
connectType = [
|
||||
"master"
|
||||
"direct"
|
||||
];
|
||||
};
|
||||
|
||||
"proxyjump-whq" = {
|
||||
after = [ "tagged-direct-whq" ]; # XXX readOnly backref option
|
||||
jumpHost = "kenny12.fe.whq.fcio.net";
|
||||
connectType = [ "all" ];
|
||||
noDirect = true;
|
||||
};
|
||||
"proxyjump-rzob" = {
|
||||
after = [ "tagged-direct-rzob" ]; # XXX readOnly backref option
|
||||
jumpHost = "kenny09.fe.whq.fcio.net";
|
||||
connectType = [ "all" ];
|
||||
noDirect = true;
|
||||
};
|
||||
};
|
||||
# ssh host config
|
||||
matchBlocks = {
|
||||
# --- Host blocks (order matters: specific before wildcard) --------
|
||||
|
|
@ -64,15 +95,13 @@ in
|
|||
# For adding more topology-related specific rules, consider moving this into secrets like SOPS or so.
|
||||
|
||||
# Hostname wildcard for management network, also accessed via bastion host
|
||||
"*.mgm.whq.fcio.net *.mgm.whq.gocept.net" =
|
||||
lib.hm.dag.entryBefore [ "*.fcio.net *.gocept.net" ] {
|
||||
"*.mgm.whq.fcio.net *.mgm.whq.gocept.net" = lib.hm.dag.entryBefore [ "*.fcio.net *.gocept.net" ] {
|
||||
extraOptions = {
|
||||
Tag = "proxyjump-whq";
|
||||
};
|
||||
};
|
||||
|
||||
"*.mgm.rzob.fcio.net *.mgm.rzob.gocept.net" =
|
||||
lib.hm.dag.entryBefore [ "*.fcio.net *.gocept.net" ] {
|
||||
"*.mgm.rzob.fcio.net *.mgm.rzob.gocept.net" = lib.hm.dag.entryBefore [ "*.fcio.net *.gocept.net" ] {
|
||||
extraOptions = {
|
||||
Tag = "proxyjump-rzob";
|
||||
};
|
||||
|
|
@ -85,61 +114,6 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
# --- Match blocks (OpenSSH 9.4+ tags) ----------------------------
|
||||
|
||||
# Connect to hosts directly, or if that fails (e.g. IPv4-only network)
|
||||
# use the bastion host as a jump host.
|
||||
"tagged-direct-rzob" =
|
||||
lib.hm.dag.entryAfter [ "*.fcio.net *.gocept.net" ] {
|
||||
match = ''tagged="direct-rzob"'';
|
||||
proxyCommand = "${lib.getExe pkgs.fc-scripts.ssh-multi-proxy} -p connect -i master,direct -j vpn-rzob.services.fcio.net %h %p";
|
||||
extraOptions = {
|
||||
ProxyUseFdpass = "yes";
|
||||
};
|
||||
};
|
||||
|
||||
"tagged-direct-whq" =
|
||||
lib.hm.dag.entryAfter [ "*.fcio.net *.gocept.net" ] {
|
||||
match = ''tagged="direct-whq"'';
|
||||
proxyCommand = "${lib.getExe pkgs.fc-scripts.ssh-multi-proxy} -p connect -i master,direct -j vpn-whq.services.fcio.net %h %p";
|
||||
extraOptions = {
|
||||
ProxyUseFdpass = "yes";
|
||||
};
|
||||
};
|
||||
|
||||
# Don't connect directly, always use the bastion host as a jump host.
|
||||
"tagged-proxyjump-whq" =
|
||||
lib.hm.dag.entryAfter [ "tagged-direct" ] {
|
||||
match = ''tagged="proxyjump-whq"'';
|
||||
proxyCommand = "ssh-multi-proxy -p connect -ni all -j kenny12.fe.whq.fcio.net %h %p";
|
||||
extraOptions = {
|
||||
ProxyUseFdpass = "yes";
|
||||
};
|
||||
};
|
||||
|
||||
"tagged-proxyjump-rzob" =
|
||||
lib.hm.dag.entryAfter [ "tagged-direct" ] {
|
||||
match = ''tagged="proxyjump"'';
|
||||
proxyCommand = "ssh-multi-proxy -p connect -ni all -j kenny09.fe.rzob.fcio.net %h %p";
|
||||
extraOptions = {
|
||||
ProxyUseFdpass = "yes";
|
||||
};
|
||||
};
|
||||
|
||||
# default, gets placed last by home-manager
|
||||
"*" = {
|
||||
serverAliveInterval = 10;
|
||||
serverAliveCountMax = 2; # 2 strikes and you're out
|
||||
forwardAgent = false;
|
||||
addKeysToAgent = "no";
|
||||
compression = false;
|
||||
hashKnownHosts = false;
|
||||
userKnownHostsFile = "~/.ssh/known_hosts";
|
||||
controlMaster = "no";
|
||||
controlPath = "~/.ssh/master-%r@%n:%p";
|
||||
controlPersist = "no";
|
||||
};
|
||||
|
||||
"hydra01" = {
|
||||
hostname = "hydra01.access.whq.gocept.net";
|
||||
user = "os";
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue