mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:36 +01:00
ryan4yin | 二花
7cfda39c2c
The CanoKey resident SSH key (`ryan@canokey-moe`, the backup once a new primary key is enrolled) is now authorized for ryan and root on every host, and sudo on server and agent hosts accepts its touch through the forwarded agent (`pam_rssh`). Without the key or a forwarded agent, sudo asks for the password and login falls back to the file keys. Only `canokeySshKeys` can satisfy sudo. Risks to weigh: - Colmena deploys need one touch per host connection, since the agent offers the CanoKey key first. - Desktops now forward the agent to every `hostsAddr` alias, as they already did for `192.168.*`; while a session is open, root there can request signatures, each needing a touch. ### Verification - `just test` exits 0; CI passed on the first commit. - Evaluated: sudo PAM stack `rssh` → `unix` → `deny` on shoryu, kana, akane and k3s-test-1-master-1, ai-niri keeps `pam_u2f`; shoryu root and ryan list `ryan@canokey-moe`. - Not yet verified on a running host. ### Manual step after merge Deploy the servers, then `just niri`; close old multiplexed connections (`ssh -O exit <host>`) and try `sudo true` over SSH. AI assistance: DeepSeek Harness (claude-opus-5-5). Assisted-by: DeepSeek Harness (claude-opus-5-5)
Variables
Common variables and configuration used across my NixOS and nix-darwin configurations.
Current Structure
vars/
├── README.md
├── default.nix # Main variables entry point
├── networking.nix # Network configuration and host definitions
└── ports.nix # Loopback HTTP backend port registry
Components
1. default.nix
Contains user information, SSH keys, and password configuration:
- User credentials (username, full name, email)
- Initial hashed password for new installations
- SSH authorized keys (main and backup sets)
- Public key references for system access
- Remote-builder client host keys (
remoteBuilderClientKeys) that may build through aquamarine
2. networking.nix
Defines:
- Gateway settings: Main router and proxy gateway configurations
- Home LAN (
lanCidr): the trusted LAN prefix the shared host firewall trusts by source - Cluster addressing:
clusterULA6, the IPv6 ULA prefix for MicroVM guest addresses, andk8sVip, each k3s cluster's kube-vip API and LoadBalancer VIP block - DNS servers: IPv4 and IPv6 name servers
- Host inventory: static LAN hosts and their interfaces; DHCP/mobile hosts (such as the macOS
hosts) are omitted by design.
homeOnly = truemarks an address that exists only at home; SSH aliases and monitoring skip it - SSH configuration: Host aliases and known hosts configuration
- Network topology: Physical machines, VMs, Kubernetes clusters, and SBCs
Host Categories
networking.nix maps each host to its LAN address and interface. The authoritative inventory is
../hosts/README.md; this file holds only the addresses.
Usage
These variables are imported and used throughout the configuration.