mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:46 +01:00
Ryan Yin
7a4f62383f
The v6 fake pool is a lookup key, not the egress path, so it can be a public range: the shipped ULA default reads as "local" to browsers and prompts for local-network access on every site. The gvisor stack override goes with it -- mips is upstream's default, and nftables rules out the kernel stack here.
62 lines
1.8 KiB
Nix
62 lines
1.8 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
mysecrets,
|
|
...
|
|
}:
|
|
{
|
|
home.file.".ssh/romantic.pub".source = "${mysecrets}/public/romantic.pub";
|
|
|
|
programs.ssh = {
|
|
enable = true;
|
|
|
|
enableDefaultConfig = false;
|
|
settings."*" = {
|
|
ForwardAgent = false;
|
|
AddKeysToAgent = "yes";
|
|
Compression = true;
|
|
ServerAliveInterval = 0;
|
|
ServerAliveCountMax = 3;
|
|
HashKnownHosts = false;
|
|
UserKnownHostsFile = "~/.ssh/known_hosts";
|
|
ControlMaster = "no";
|
|
ControlPath = "~/.ssh/master-%r@%n:%p";
|
|
ControlPersist = "no";
|
|
};
|
|
|
|
settings = {
|
|
"github.com" = {
|
|
HostName = "ssh.github.com";
|
|
Port = 443;
|
|
User = "git";
|
|
IdentitiesOnly = true;
|
|
};
|
|
|
|
"192.168.*" = {
|
|
ForwardAgent = true;
|
|
# decrypted secret: AI agents must not read it
|
|
IdentityFile = "/etc/agenix/ssh-key-romantic";
|
|
IdentitiesOnly = true;
|
|
};
|
|
};
|
|
};
|
|
|
|
# Keep ~/.ssh/config a real, user-owned file rather than a /nix/store symlink.
|
|
#
|
|
# OpenSSH accepts a config owned by root or the invoking user, but
|
|
# bubblewrap-based sandboxes (`--unshare-user`) expose root-owned store files
|
|
# as `nobody`, which trips the check (`Bad owner or permissions`). Disabling
|
|
# the home.file entry keeps Home Manager's linker out of the way; `install`
|
|
# writes a fresh 0600 copy on each activation.
|
|
#
|
|
# Linux only: macOS' Seatbelt sandbox keeps store ownership intact, so the
|
|
# normal symlink is fine there.
|
|
home.file.".ssh/config".enable = lib.mkIf pkgs.stdenv.hostPlatform.isLinux false;
|
|
home.activation.sshConfigRegularFile = lib.mkIf pkgs.stdenv.hostPlatform.isLinux (
|
|
lib.hm.dag.entryAfter [ "linkGeneration" ] ''
|
|
run install -D -m 600 ${config.home.file.".ssh/config".source} "$HOME/.ssh/config"
|
|
''
|
|
);
|
|
}
|