diff --git a/hosts/raptus/configuration.nix b/hosts/raptus/configuration.nix index 924a717..d2048c5 100644 --- a/hosts/raptus/configuration.nix +++ b/hosts/raptus/configuration.nix @@ -40,6 +40,7 @@ in networking.firewall = lib.mkForce { enable = true; allowedTCPPorts = [ + 80 # for acme challenges 443 5984 # couchdb 3000 # forgejo @@ -47,22 +48,7 @@ in ] ++ config.services.openssh.ports ++ [ config.services.endlessh.port ]; }; - # User account to run remote builds - users.users.remote-build = { - isSystemUser = true; - hashedPassword = ""; # Only allow login via ssh - openssh.authorizedKeys.keys = sshAccess; - shell = pkgs.bash; - group = "remote-build"; - extraGroups = [ "wheel" ]; - }; - - security.sudo.wheelNeedsPassword = false; - - users.groups.remote-build = { }; - - # Ensure the user can build derivations - nix.settings.trusted-users = [ "remote-build" ]; + age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; security.acme.defaults.email = "admin@ccnlc.eu"; security.acme.acceptTerms = true; @@ -97,6 +83,8 @@ in services.openssh = { enable = true; ports = [ 56528 ]; + # Having automatic generation enabled breaks agenix + #hostKeys = [ ]; }; services.endlessh = { diff --git a/secrets/couchdb.age b/secrets/couchdb.age index 265d067..b270f1c 100644 Binary files a/secrets/couchdb.age and b/secrets/couchdb.age differ diff --git a/secrets/rustypaste.age b/secrets/rustypaste.age index e9333e7..8266472 100644 --- a/secrets/rustypaste.age +++ b/secrets/rustypaste.age @@ -1,11 +1,9 @@ age-encryption.org/v1 --> ssh-ed25519 JjL30A 1XNRKnK1XPGFU5+lqgoLMOnaf9IxQT6NV6tFK654gDc -OBePOZJ+eS1Wl7pAERJgj9MtmGqwNYibpdUWR6B84A8 --> ssh-ed25519 nueAfA SKBEBskfVR/OcKLlNj7SWr0RnYb67Npe8WRmjxytVCk -fqLgmEwmxISmpyzz3D/X5X0bN4xrIh8/hqs9vDiFkqE --> ssh-ed25519 WcjW5A cZDomiXanY2cwvZCPWcAG734dQg7RhlnqKMe5pfHMy4 -6jzLkXYDa8ZrUTlyqmAw0W4WRy0x83L53SQS0Aq7gtg ---- B4/2cwHiFwQDnGZELOsHLyxEfmZbl2I5rkZioWhh7GE -*X& [kwCV$;* -:zթgPQ+G -)b߃t-r9RߍQsčv/⇐<>'s@? \ No newline at end of file +-> ssh-ed25519 b3HlPA 2xnmAbE7usGlBUofIkT0+k9lkAOMfrUifn2kEp6u43w +IpuhSKZoguXHXBamt2xzKTIRPyKNmzIYPaIdKM90aow +-> ssh-ed25519 nueAfA LuY9xtX9NcTzA6t4XugshESmLA5omCP6CzgiEItj9CA +JCLnGxpvRLcMeTZOPy+7L02Jsni/AhYzTzL4mFk74Jo +-> ssh-ed25519 WcjW5A nQbOkYhDen935yMtYnWKeM54PeRUcAikvGRsjRQ/Ox4 +uL0PpSXX7+Xn91HYHtb/HNf90VNCRaCZ5sQjYCcOdWI +--- hr+DtkYLhfRAVjc0E6z970/JJT3iaJKTSRwMY0rLMPA +D \ YMW;nE iۉ5 _\Ճj@jc(J}5nK7ԾAh=׹:K?-V.kD6cv \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 552eba8..25dbe50 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -8,10 +8,9 @@ let userBrontes ]; - raptus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIErbhkpCL0DuJQTxeTqxtrGvELCQFkyZmhTZ8fagszOU"; - systems = [ raptus ]; + raptus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKdpjGR/pV1roktZdKIVVWqds0JB+x1ksfyQmYPMLK7o"; in { - "couchdb.age".publicKeys = [ raptus ]; + "couchdb.age".publicKeys = [ raptus ] ++ users; "rustypaste.age".publicKeys = [ raptus ] ++ users; }