Misc hackery
Eelco Dolstra committed
Jul 5, 2018 at 15:50 UTC
794315ca6aa8bb5de855aa5d4e486d6a115eda8d
1 file changed
+18
-5
bastion/network.nix
+18
-5
@@ -1,7 +1,7 @@
1
let
2
region = "eu-west-1";
3
zone = "eu-west-1a";
4
- accessKeyId = "lb-nixos";
4
+ accessKeyId = ""; # FIXME
5
sshKeys = import ../ssh-keys.nix;
6
in
7
@@ -34,9 +34,13 @@ in
34
inherit region accessKeyId;
35
vpcId = resources.vpc.bastion-vpc;
36
rules =
37
- [ { toPort = 22; fromPort = 22; sourceIp = "213.125.166.74/32"; } # Utrecht office
38
- { toPort = 22; fromPort = 22; sourceIp = "131.180.119.77/32"; } # wendy
39
- ];
37
+ with import ../ip-addresses.nix;
38
+ map
39
+ (ip: { toPort = 22; fromPort = 22; sourceIp = "${ip}/32"; })
40
+ [ eelcoHome
41
+ eelcoEC2
42
+ "34.254.208.229" # == resources.elasticIPs."bastion.nixos.org".address FIXME: doesn't work
43
+ ];
44
};
45
46
resources.vpcRouteTables.bastion-route-table =
@@ -106,9 +110,18 @@ in
110
openssh.authorizedKeys.keys = [ sshKeys.eelco sshKeys.rob ];
111
};
112
109
- environment.systemPackages = [ pkgs.nixops ];
113
+ environment.systemPackages =
114
+ [ pkgs.nixops
115
+ pkgs.awscli
116
+ ];
117
118
nix.gc.automatic = true;
119
nix.gc.dates = "hourly";
120
+
121
+ # Temporary hack until we have proper users/roles.
122
+ services.openssh.extraConfig =
123
+ ''
124
+ AcceptEnv AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY
125
+ '';
126
};
127
}