commit 7f68af7ea8ef872d55728fdab7ca6ea26f0003ef parent edbc88761751d0b27a10bd50c2c361954efd5dc4 Author: MTRNord <mtrnord1@gmail.com> Date: Wed, 9 Aug 2023 14:02:33 +0200 Simplify remote unlock Diffstat:
| M | nixos/worker-1/configuration.nix | | | 17 | +---------------- |
1 file changed, 1 insertion(+), 16 deletions(-)
diff --git a/nixos/worker-1/configuration.nix b/nixos/worker-1/configuration.nix @@ -130,6 +130,7 @@ enable = true; # Defaults to 22. port = 2222; + shell = "/bin/cryptsetup-askpass"; # The key is generated using `ssh-keygen -t ed25519 -N "" -f /etc/secrets/initrd/ssh_host_ed25519_key` # # Stored in plain text on boot partition, so don't reuse your host @@ -140,22 +141,6 @@ # I'll just authorize all keys authorized post-boot. authorizedKeys = config.users.users.marcel.openssh.authorizedKeys.keys; }; - # Set the shell profile to meet SSH connections with a decryption - # prompt that writes to /tmp/continue if successful. - network.postCommands = - let - disk = "/dev/disk/by-uuid/56da9aee-dc91-4736-ae22-781e46ccb25e"; - in - '' - echo 'cryptsetup open ${disk} enc --type luks && echo > /tmp/continue' >> /root/.profile - echo 'starting sshd...' - ''; - # Block the boot process until /tmp/continue is written to - postDeviceCommands = '' - echo 'waiting for root device to be opened...' - mkfifo /tmp/continue - cat /tmp/continue - ''; };